diff --git a/CHANGELOG.md b/CHANGELOG.md
index dca8bda..59d31f6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,22 @@ _In progress on this branch — content still accumulating; date set at tag time
 
 ### Added
 
+- **`Closure(...)` signature types.** A type hint such as `Closure(int $x, string $y):
+  bool` may appear in any parameter, return, or property position; it documents the
+  callable a slot expects and **erases to a bare `\Closure`** in the emitted PHP.
+  Where a closure literal is returned against a `Closure(...)` return type (a
+  typed-closure factory), xphp checks conformance — parameters contravariant, return
+  covariant, by-reference exact, arity compatible — and fails the build on a
+  **provable** mismatch (`xphp.closure_conformance`), while accepting anything it can't
+  prove wrong (untyped ⇒ `mixed`, an unresolved or built-in supertype, a
+  still-abstract type parameter, a union/intersection). A signature that references an
+  enclosing type parameter is **grounded** per specialization, so `Registry<int>` and
+  `Registry<string>` check the same factory against different concrete targets. A flat
+  union / intersection / nullable inside a signature (`Closure(int|string $x): void`,
+  `Closure(): A&B`, `?int`) is variance-checked member by member, following PHP's own
+  union/intersection subtyping; an intersection in a parameter position stays gradual
+  (an intersection of unrelated types is uninhabited). See
+  [closure types](docs/syntax/closure-types.md).
 - **Multi-root builds via an `xphp.json` manifest.** A project declares its source
   roots, output directory, and hash length in an `xphp.json` at the project root;
   `xphp compile` and `xphp check` auto-detect it (or take an explicit `--config`).
@@ -167,6 +183,160 @@ _In progress on this branch — content still accumulating; date set at tag time
 
 ### Fixed
 
+- **A turbofish on a dynamically-named call is rejected instead of silently dropped.**
+  A type-argument turbofish on a method or static call whose name is a runtime value —
+  `$o->$m::<int>()`, the nullsafe `$o?->$m::<int>()`, the variable-variable
+  `$$g::<int>()`, or the static `Foo::$m::<int>()` — used to be silently discarded (the
+  marker bound no AST node and the `::<…>` clause was stripped anyway), leaving a bare
+  dynamic call against a method that only exists in its specialized `_T_<hash>` form: a
+  runtime fatal behind a clean `compile` and `check`. Such a call cannot be
+  monomorphized — the method name is not known until runtime — so it now draws a clear
+  diagnostic at its real line (collected by `check`, thrown by `compile`). A turbofish on
+  a standalone variable holding a generic closure (`$f::<int>()`) is unaffected.
+- **A generic method may be named with a PHP keyword.** PHP permits every keyword
+  (`list`, `print`, …) as a method name, but a generic one could not be used: the
+  declaration `public function list<T>(…)` reached php-parser as a raw parse error, and
+  the static call `Foo::list::<int>()` did too (the instance call `$o->list::<int>()`
+  happened to work, because PHP re-tokenizes the name after `->`). Keyword-named generic
+  methods now declare, specialize, and are callable through both the instance and static
+  turbofish. Keyword-named non-generic methods and `list(...)` destructuring are
+  unchanged.
+- **A specialized generic body keeps calling the free functions and constants it
+  named.** When a generic class specializes, its body is relocated into an internal
+  `XPHP\Generated\…` namespace. An unqualified free-function call or constant read in
+  that body — `helper($x)`, `FACTOR`, whether resolved through the enclosing namespace
+  or a `use function` / `use const` import (single **or** grouped, e.g.
+  `use function Lib\{make, scale}`) — used to rebind against the generated namespace
+  (then PHP's global fallback), silently calling the wrong symbol or fatalling at
+  runtime with `Call to undefined function XPHP\Generated\…\helper()` behind a clean
+  `compile` and `check`. Each such reference the compilation unit can resolve is now
+  fully-qualified to the symbol the template meant; built-in functions, magic constants,
+  and any name the unit does not define keep PHP's normal global resolution (functions
+  match case-insensitively, constants case-sensitively). The re-qualification also
+  covers members supplied by the covariant-upcast gap-fill, which are appended after the
+  main relocation pass.
+- **A specialized generic body keeps resolving the classes it group-imported.** The
+  relocation into `XPHP\Generated\…` also re-qualifies class references against the
+  unit's imports, but a class brought in through a grouped import — `use Vendor\{Tool};`,
+  or a mixed `use Vendor\{Tool, function make};` — was not recorded in the class
+  import map (only single `use Vendor\Tool;` imports were), so a reference to it in the
+  relocated body fell back to the generated namespace (`\App\Tool`) and fatalled at class
+  load with `Class "App\Tool" not found` behind a clean `compile` and `check`. A
+  group-imported class now re-qualifies to its import target exactly like its
+  single-import form; `use function` / `use const` group members keep resolving through
+  their own symbol namespaces.
+- **A generic clause on a `use` import is rejected instead of misfiring.** Writing
+  a type argument on an import — `use App\Box<int>;`, `use App\Box<int> as B;`,
+  `use const App\BOX<int>;`, or the grouped `use App\{Box<int>, Bag};` — has no
+  meaning (imports name a symbol; they don't instantiate one). It used to either
+  blame a phantom double-qualified template (`Main\App\Box`) with no line, or — for
+  a grouped import whose name collided with a real template — **silently emit
+  unparseable PHP** (an absolute specialized name inside a `use N\{…}` prefix group)
+  that passed both `check` and `compile` and only failed when the file was loaded.
+  Every form now draws one clear diagnostic naming the real symbol at the import's
+  line, collected by `check` and thrown by `compile`. Import the template plainly
+  (`use App\Box;`) and apply the type arguments at the use site. A generic
+  **trait-use** (`class C { use Holder<int>; }`) is unaffected — it still specializes
+  the trait.
+- **A generic trait used with an `insteadof` / `as` adaptation loads instead of
+  fataling.** A generic trait combined with an adaptation block — `use A<int>, B<int>
+  { A::m insteadof B; B::m as bm; }` — specialized the `use`-**list** names to their
+  `\XPHP\Generated\…` form but left the `insteadof` / `as` **operand** names bare, so
+  they resolved to the now-removed template (`App\A`) and fataled at class load
+  (`Trait "App\A" not found`) behind a clean `compile` and `check`. Each adaptation
+  operand that names a generic trait the class uses is now rewritten to the **same**
+  specialization as its list entry, including operands that reference a trait brought
+  in by a different `use` statement of the same class. A non-generic trait operand (or
+  one the class does not use generically) stays untouched — it is a real trait. A bare
+  operand that matches two different specializations of one trait (`use A<int>,
+  A<string> { A::m insteadof B; }`) cannot be disambiguated in an adaptation clause and
+  now draws a clear diagnostic instead of silently picking one.
+- **`check` reports parse-stage rejections at their real source line.** Syntax
+  the scanner rejects before the AST exists — a variance marker on a method or
+  closure (`out T` / `in T`), the legacy `+T` / `-T` glyphs, a malformed or
+  misordered generic default (`T = ?int`, `T = Foo | Bar`, a required parameter
+  after a defaulted one), or a call signature on a non-`Closure` name — was
+  reported by `check` at line 1 regardless of where it occurred, so an editor
+  could not navigate to it (the real location survived only in the message text).
+  These now carry the offending token's line. A few structural rejections raised
+  after parsing (a self-referential bound, a default referencing a later
+  parameter) still fall back to line 1, where no token position is available.
+  `compile` behaviour is unchanged.
+- **A bare `new` of a generic without all-defaults is rejected instead of
+  silently emitting an uninstantiable marker.** `new Box(...)` where `Box<T>`
+  has a required type parameter and no turbofish was skipped by the
+  instantiation collector, leaving the call site pointing at the stripped marker
+  `interface Box {}` — so the emitted code fatalled with "Cannot instantiate
+  interface" behind a clean compile and a clean `check`. It now fails with
+  `xphp.missing_type_argument` (throwing in `compile`, collected in `check`),
+  exactly as a turbofish-less generic call does. All-defaults generics still
+  instantiate from a bare `new`, and a bare `new B` still works when a plain
+  `class B` coexists with a generic `class B<T>` (conditional same-name
+  declarations resolve to the plain class at runtime).
+- **A first-class callable of a turbofish specialization emits valid PHP.**
+  `$g = $f::<int>(...)` on a generic closure emitted `$f('T_…', ...)` — the
+  specialization tag prepended beside the `...` placeholder, which does not
+  parse, so the output failed to load. It now emits a forwarding closure that
+  routes through the dispatcher, preserving callable semantics (positional,
+  variadic, and named arguments and the closure's captures); empty-turbofish
+  all-defaults FCCs (`$f::<>(...)`) work the same way.
+- **Parenthesised DNF types inside `Closure(...)` signatures are supported.** A
+  DNF group (`(A&B)|C`, `A|(B&C)`) anywhere in a signature previously broke the
+  type scanner: a leading group in a return position failed to compile, a
+  trailing group in a return hint silently mis-erased (emitting a wrong type and
+  a truncated recorded return), and a group in a parameter threw the signature's
+  arity off — wrongly rejecting a conforming factory literal. A DNF group now
+  scans as one **gradual** leaf: the signature erases correctly, arity and the
+  slots around the group are checked as usual, and the group itself is accepted
+  rather than variance-checked member by member.
+- **Array-sugar types inside `Closure(...)` signatures are supported.** A
+  sugared leaf (`Closure(Item[] $items): int`, `Closure(): int[]`) previously
+  broke the signature scanner: in a return position the bracket pair survived
+  erasure as a raw parse error, and in a parameter position it mis-parsed as
+  three parameters — wrongly rejecting a conforming factory literal on arity.
+  The sugar now lowers to `array` inside signatures, the same lowering it gets
+  everywhere else, and is checked as a gradual `array` leaf.
+- **Provable violations against built-in target types are now caught.** A factory
+  whose literal returns a class with fully-known, built-in-free ancestry checked
+  against a built-in target (`Closure(): \Throwable` returning a plain user
+  class) was silently accepted — the guard treated EVERY built-in target as
+  unprovable. When the candidate's whole ancestry is declared user code, the
+  non-relation is provable and now fails the build. Everything genuinely
+  satisfiable at runtime keeps compiling: subclasses of built-ins
+  (`extends \Exception` vs `\Throwable`), enums against interfaces they
+  implement (enum `implements` clauses and the implicit `UnitEnum`/`BackedEnum`
+  edges are now modeled — which also lets `T : UnitEnum` bounds accept enum
+  arguments), `__toString` classes against `\Stringable`, and candidates with
+  any unknown ancestor.
+- **Expression-position `Closure(...)` calls are never mistaken for return types.**
+  The return-slot detector keyed on a bare `) :` pair — which ternaries,
+  `case expr():` labels, and alt-syntax blocks (`if/elseif/while/for/foreach/
+  declare (…):`) also produce. A call to a user function named `Closure` in
+  those positions was silently rewritten into a `\Closure` constant fetch, and a
+  call to ANY function there (`$a ? b() : g(FOO);`) failed the compile with the
+  only-Closure error. The detector now requires an actual `function`/`fn`
+  declaration header (including by-ref, `use (…)` clauses, and tight spellings)
+  and ignores member calls of the semi-reserved names (`C::fn()`).
+- **Relative `namespace\Foo` types resolve correctly everywhere names are read
+  from tokens.** A relative reference bound to the wrong name (`App\namespace\Foo`,
+  or a colliding `use` alias) wherever the resolver worked on raw token text —
+  most visibly a `Closure(): namespace\D` target type, which silently skipped
+  conformance checking. Relative names now bind to the current namespace, exactly
+  as PHP does, for signature targets, bounds, defaults, and generic arguments
+  alike; only the exact `namespace\` keyword segment is affected.
+- **Fully-qualified types in closure literals participate in conformance.** A
+  factory literal spelling its type fully qualified (`fn(): \App\Fruit`) had the
+  leading `\` dropped during extraction, mis-resolving the name relative to the
+  current namespace — an undeclared class, so the check silently went gradual and
+  provable violations were missed. FQ names now resolve absolutely (relative and
+  imported names are unchanged).
+- **Generic closures after array-sugar rewrites specialize correctly.** The
+  `Name[]` → `array` rewrite shortens the source, and the byte-keyed marker that
+  attaches type parameters to an anonymous `function<T>` / `fn<T>` was compared
+  against the shifted position — so a generic closure appearing after such a
+  rewrite silently lost its type parameters, compiled unspecialized, and the
+  emitted code fataled at runtime despite a clean validation pass. Marker
+  positions are now translated through the byte-offset map before matching.
 - **Undeclared type parameters are now rejected** instead of silently compiling to
   a reference to a non-existent class. A bare, single-segment, non-imported type
   name used in a generic member, bound, or default that is neither a declared type
@@ -221,6 +391,79 @@ _In progress on this branch — content still accumulating; date set at tag time
   scalars (`int`, `string`, `bool`, `float`, and case variants like `Int`) are unchanged;
   an undeclared `Double` member is now reported as `xphp.undeclared_type` instead of being
   silently absorbed as a scalar.
+- **Generic declarations keep their type parameters regardless of header layout.**
+  Four marker-alignment defects silently de-generified declarations — clean compile,
+  clean `check`, raw `T` hints in the emitted code, `TypeError` at runtime: any
+  **multi-line** generic clause, turbofish argument list, or `T[]` sugar span
+  collapsed its newlines when stripped, shifting every later declaration off its
+  marker (`class Wide<\n T\n>` before `class Box<T>` left `Box` raw); `static
+  fn<T>(...)` anchored its marker at `fn` while the node starts at `static`; an
+  attribute before a generic closure (`#[A] function<T>`, `#[A] static fn<T>`)
+  moved the node start to `#[`; and an attribute or modifier on its own line before
+  a **named** generic declaration (`#[Override]` above `public function wrap<T>`,
+  `final` above `class Pair<T>`) lost the marker too — or false-rejected the class
+  as "instantiated but never defined". Stripping now preserves newlines
+  byte-for-byte (multibyte- and CRLF-safe; the `T[]` lowering re-appends its span's
+  newlines), anonymous markers anchor at the node's true start (walking back over
+  attribute groups and `static`), and named markers match on the declaration
+  name's line. A `static fn<T>` now simply **specializes** like any arrow — it can
+  never bind `$this`; the rewritten dispatcher closure is technically non-static,
+  observable only via `Closure::bind`/reflection — while `static function<T>`
+  keeps its loud not-yet-supported error, which now also fires when an attribute
+  precedes it.
+- **A generic clause that fails to bind to its declaration is now a loud compile
+  error.** Every defect in the family above was silent for the same structural
+  reason: an unbound marker simply evaporated and the compiler carried on. The
+  strict compile path now reports it (as a transpiler bug to report), instead of
+  emitting silently de-generified code; the tolerant LSP path is exempt —
+  half-typed editor buffers legitimately strand markers. A `use function b<T>;`
+  typo gets PHP's own syntax error on the `<` rather than being swallowed.
+- **Fully-qualified and `namespace\`-relative spellings work at every generic
+  site.** Names were resolved from prefix-erased strings, losing the author's
+  qualification: `new \App\Box::<int>` hard-failed as the undefined, doubled
+  `App\App\Box` — and an FQ generic **function** call (`\App\make::<int>(...)`)
+  silently lost its dispatcher, an undefined-function fatal at runtime;
+  `new \App\Box("hi")` on an all-defaults generic silently emitted the stripped
+  marker interface plus the kept `new` — "Cannot instantiate interface" at
+  runtime; `new namespace\Box::<int>` never bound its marker and silently emitted
+  the same fatal shape; on one line, a relative generic return type could steal
+  the body turbofish's marker, specializing the wrong site; `class Gen<T> extends
+  namespace\Base` with a colliding `use Other\Base` in scope emitted the generated
+  class extending `\Other\Base` — a `use` alias never applies to a relative name —
+  and the same capture hit every marked type position, generic-method receiver
+  typing, and the conformance hierarchy (where a wrong parent edge could
+  false-reject a valid factory); and `namespace\Thing` colliding with a type
+  parameter was substituted like one, emitting `int $x` where the author wrote an
+  explicit class reference. Markers now record the raw source spelling
+  (case-folding only the `namespace` keyword), every resolver honors the node's
+  own qualification, fully-qualified call sites rewrite to their specializations,
+  and relative names bind to the current namespace — exactly as PHP does.
+- **Generic markers bind byte-exact — two same-spelling sites on one line can no
+  longer steal each other's markers.** Marker matching was line-keyed
+  (first-traversed-wins), so `f(Box $a, Box<int> $b)` emitted the specialization
+  on the **wrong parameter**; a plain return hint could steal a
+  `new Box::<int>(...)` marker, leaving a raw `new` against the marker interface;
+  one-line same-name conditional classes handed the generic clause to the plain
+  class — rewriting it into an uninstantiable marker interface; and
+  `Plain::pick(5) + Util::pick::<int>(4)` on one line **false-rejected both
+  calls** (the plain call's line-range claimed the generic call's marker). Every
+  marker now matches on the byte of the token it anchors at, translated through
+  the byte-offset map — exact across multi-line member chains, length-changing
+  `T[]` rewrites, interpolated-string turbofish, and multibyte identifiers.
+- **A generic closure that nothing specializes is now rejected**
+  (`xphp.unspecialized_generic_closure`) instead of silently emitting raw
+  type-parameter hints. Specialization is call-site-driven, so a generic
+  closure/arrow with no in-scope grounding `$var::<...>(...)` call kept hints
+  naming the non-existent class `App\T` in the emitted output — a `TypeError` on
+  first invocation behind a clean compile and a clean `check`, including when the
+  value was only handed away as a callable (`array_map($f, ...)`, a returned
+  factory) — which cannot ground it. Both modes reject every such shape:
+  assigned-but-uncalled, return-position, argument-position, `use (...)`-
+  capturing, defaulted, conditional arms, and — uniformly — a clause whose
+  parameters are never referenced (dead syntax; delete it). A template whose
+  call sites drew their own rejection (static closure, `$this` capture, missing
+  turbofish) is not double-reported, and a turbofish with still-abstract type
+  arguments counts as a real call.
 
 ## [0.2.1] - 2026-06-17
 
diff --git a/docs/caveats.md b/docs/caveats.md
index 68cfd17..6f8d30e 100644
--- a/docs/caveats.md
+++ b/docs/caveats.md
@@ -73,6 +73,12 @@ class Holder {
 
 ## `static` closures not supported
 
+`static` **arrows** work: `static fn<T>(T $x): T => $x` specializes
+exactly like a plain arrow (an arrow can never bind `$this`, so the
+`static` is inert; note the rewritten dispatcher closure is technically
+non-static — observable only through `Closure::bind` or reflection).
+The gap below is specific to the `static function` (closure) syntax.
+
 ### ❌ What doesn't work
 
 ```php
@@ -112,9 +118,11 @@ file-scope generic function side-steps it.
 
 ### ✅ Workaround
 
-Drop the `static` modifier, or lift the body to a named function:
+Use an arrow, drop the `static` modifier, or lift the body to a named
+function:
 
 ```php
+$f = static fn<T>(T $x): T => $x;               // works
 $f = function<T>(T $x): T { return $x; };       // works
 // or
 function id<T>(T $x): T { return $x; }
diff --git a/docs/errors.md b/docs/errors.md
index 1bcb174..9137681 100644
--- a/docs/errors.md
+++ b/docs/errors.md
@@ -37,7 +37,7 @@ The `json` and `github` formats tag each diagnostic with a stable code:
 |------|---------|
 | `xphp.bound_violation` | a concrete type argument doesn't satisfy its parameter's bound |
 | `xphp.default_bound_violation` | a parameter's default doesn't satisfy its own bound |
-| `xphp.missing_type_argument` | a required type argument was omitted and has no default — including a **turbofish-less call** to a generic method, function, or closure (`$x->pick('a')` instead of `$x->pick::<string>('a')`): a method generic takes no inference, so the type argument must be supplied explicitly |
+| `xphp.missing_type_argument` | a required type argument was omitted and has no default — including a **turbofish-less call** to a generic method, function, or closure (`$x->pick('a')` instead of `$x->pick::<string>('a')`), and a **bare `new` of a generic without all-defaults** (`new Box(...)` where `Box<T>` has a required parameter, instead of `new Box::<int>(...)`): the type argument takes no inference, so it must be supplied explicitly |
 | `xphp.too_many_type_arguments` | more type arguments were supplied than the template declares (e.g. `Box::<int, string>` for a one-parameter `Box`) |
 | `xphp.variance_position` | an `out T` / `in T` parameter appears in a position its variance forbids |
 | `xphp.inner_variance` | variance is violated through another generic's slot (composition) |
@@ -46,12 +46,14 @@ The `json` and `github` formats tag each diagnostic with a stable code:
 | `xphp.duplicate_generic_function` | the same generic function is declared in two files |
 | `xphp.closure_this_capture` | a generic closure/arrow used via turbofish captures `$this` (unsupported) |
 | `xphp.static_closure` | a generic `static` closure used via turbofish (unsupported) |
+| `xphp.unspecialized_generic_closure` | a generic closure/arrow is declared but no in-scope `$var::<...>(...)` call grounds its type parameters — the emitted value would keep raw hints naming non-existent classes (`App\T`) and fatal on first invocation, even when only handed away as a callable (which cannot ground it). Call it with a turbofish in the scope that declares it, or remove the `<...>` clause (also flagged when the parameters are never referenced — the clause is dead syntax) |
 | `xphp.unresolved_generic_call` | a turbofish method call (`$obj->m::<…>()` / `Foo::m::<…>()`) names a generic method that can't be resolved on the receiver's type — a typo or wrong receiver type, caught at compile time instead of fataling at runtime |
 | `xphp.bound_unprovable` | a method-generic bound that references an enclosing class type parameter (`contains<U : E>`) can't be proven because the receiver's type argument isn't determinable here — a raw `Box` with no argument, a branch whose arms disagree, a static call, or a `$this` self-call. Ground the receiver (bind it to a typed local) or the build fails |
 | `xphp.undetermined_receiver` | a turbofish method call's receiver has no statically-known type (an untyped `foreach` variable, a local whose type is ambiguous after a branch), so the call can't be specialized — it would emit a call to a stripped method that fatals at runtime. Give the receiver a declared type |
 | `xphp.unspecializable_self_call` | a `$this`-rooted self-call forwards a type parameter to a **non-erasable** generic method (one whose parameter is used nested, in the return, or structurally). Forwarding to an *erasable* method — parameter used only as a direct input — compiles and runs; otherwise move the call to a typed-receiver context |
 | `xphp.unschedulable_covariant_upcast` | a value is upcast to a covariant *interface* whose element-consuming method (`contains<U : E>`) needs a concrete implementation at the supertype argument that can neither be inherited through the covariant chain nor emitted directly onto the upcast source. Direct emission already covers the cases where inheritance can't carry it (the implementing class has another `extends` parent, implements only a parent of the interface, or reorders the clause); the upcast fails only when **no** emittable class body exists (a truly abstract or trait-only method), the method's **return type** names the element parameter (the widened argument would escape through a narrower return), or its parameters are bounded by **different** enclosing parameters (no single member can be derived). Provide a concrete implementation on a class — move a trait body onto the covariant base, or give the method a non-element return type |
-| `xphp.parse_error` | the file isn't valid PHP after the generic strip pass |
+| `xphp.closure_conformance` | a closure literal returned against a `Closure(...)` type doesn't conform to it — its parameters aren't wide enough, its return isn't narrow enough, its by-reference-ness differs, or its arity is incompatible |
+| `xphp.parse_error` | the source can't be parsed — either a PHP syntax error after the generic strip pass, or a parse-time xphp rejection (a variance marker on a method/closure, a malformed generic default, a generic clause on a `use` import), reported at the offending line |
 | `phpstan.*` | a PHPStan finding in the compiled output, mapped back to the template declaration (the code is `phpstan.` + PHPStan's own identifier, e.g. `phpstan.return.type`; a finding that carries no identifier falls back to the literal `phpstan.error`) — present only when the PHPStan pass runs |
 | `phpstan.unavailable` | (Warning) no phpstan binary was found, so the PHPStan pass was skipped |
 | `phpstan.run_failed` | (Warning) phpstan was found but couldn't complete (e.g. a config error) |
@@ -377,6 +379,24 @@ Nested generic specialization exceeded depth 16. Latest registry:
 <list>
 ```
 
+### Closure-signature conformance
+
+```
+Closure literal does not conform to the declared `Closure(...)` type:
+<detail>
+```
+
+Emitted when a closure literal is returned against a `Closure(...)` return
+type it doesn't satisfy. The `<detail>` names the exact mismatch, e.g.
+`parameter 1: string is not wider than int` (a parameter must be the same
+as or **wider** than the target's — contravariance), `return type: A is not
+a subtype of B` (the return must be the same as or **narrower** — covariance),
+`by-reference-ness must match exactly`, or an arity message. See
+[closure types](syntax/closure-types.md). The check only ever reports a
+*provable* mismatch: an unresolved class, a still-abstract type parameter, an
+untyped (⇒ `mixed`) slot, a union/intersection, or a built-in supertype is
+accepted rather than falsely rejected.
+
 ### Parse / AST
 
 ```
diff --git a/docs/guides/how-it-works.md b/docs/guides/how-it-works.md
index 1e92857..8d8b9cc 100644
--- a/docs/guides/how-it-works.md
+++ b/docs/guides/how-it-works.md
@@ -2,9 +2,9 @@
 
 Narrative walkthrough of the compile pipeline -- what `bin/xphp compile`
 does between reading `.xphp` source and writing vanilla `.php` files
-that any stock PHP 8.4 runtime can execute. Each stage is paired with
-a Mermaid diagram so the same information is available both
-visually and in prose.
+that any stock PHP 8.4 runtime can execute. Each stage has its own page
+below, paired with a Mermaid diagram so the same information is
+available both visually and in prose.
 
 For the feature inventory ("what does xphp support today?") see the
 [syntax tour](../syntax/index.md). For the strategic comparison against
@@ -26,11 +26,14 @@ directory while specialized classes land in a cache directory at
 `<cache-dir>/Generated/<template>/T_<hash>.php` (autoloaded under the
 `XPHP\Generated\` namespace).
 
-> The code's internal labels (`Phase 0`, `Phase 1a`, `Phase 1b.i`,
-> `Phase 1b.ii`, `Phase 2`, `Phase 2.5`, `Phase 3`, `Phase 4`,
-> `Phase 5`) are finer-grained than the six narrative stages below.
-> The stages group related phases for explanation; the source
-> docblock comments are the authority on exact ordering.
+> The code's internal phase labels are finer-grained than these
+> stages -- `Phase 0` (parse), `1a`, `1b.i`, `1b.ii`, `2` (the
+> fixed-point loop), `2.3`, `2.4`, `2.5` (variance-edge emission,
+> Stage 4.5), `3`, `3.5`, `4`, and `5`. The stages group related
+> phases for explanation; the source docblock comments are the
+> authority on exact ordering. The validation gate is command-level
+> orchestration around the pipeline (`xphp check`, and `compile`'s
+> pre-emit safety pass), not a numbered phase.
 
 ```mermaid
 flowchart TD
@@ -90,288 +93,18 @@ sequenceDiagram
 
 ---
 
-## Stage 1 -- Source parsing
-
-PHP doesn't recognise `class Box<T>` or `function identity<T>(T $x)`
-as legal syntax. nikic/php-parser would reject the source at the
-first `<`. The compiler works around this with a token-level **strip
-and reattach** trick implemented in
-[`XphpSourceParser`](../../src/Transpiler/Monomorphize/XphpSourceParser.php):
-
-1. **Tokenise** the source via PHP's own `token_get_all`.
-2. **Scan** for generic clauses -- `Name<...>` patterns -- with
-   depth tracking so arbitrarily nested `Box<List<Plastic>>` constructs
-   are handled.
-3. **Blank** every `<...>` clause by overwriting it with spaces of
-   equal length, producing plain valid PHP while keeping every byte
-   offset and line number identical to the original source.
-4. **Parse** the stripped source with nikic.
-5. **Reattach** the generic metadata to the resulting AST as node
-   attributes (`ATTR_GENERIC_PARAMS` on ClassLike declarations,
-   `ATTR_GENERIC_ARGS` + `ATTR_TEMPLATE_FQN` on instantiation Names,
-   `ATTR_METHOD_GENERIC_PARAMS` / `ATTR_METHOD_GENERIC_ARGS` on
-   method-scope generics).
-
-Because the `<...>` clauses are blanked with equal-length spaces,
-generic-clause stripping needs no position bookkeeping at all -- AST
-offsets round-trip to the original source for free. The one
-length-changing rewrite is the `T[]` array-suffix sugar: `T[]` (3
-bytes) becomes `array` (5 bytes), which shifts every offset to its
-right. That's what
-[`ByteOffsetMap`](../../src/Transpiler/Monomorphize/ByteOffsetMap.php)
-solves: it records each length-changing segment so any later byte
-offset in the stripped source can be translated back into the
-original -- which matters for editor diagnostics ("the offending
-`<int>` is at line 12, column 5"). When no length-changing
-replacement happened the map is the identity and returns the offset
-unchanged. The pair of (AST, ByteOffsetMap) is returned together as
-[`ParseWithMapResult`](../../src/Transpiler/Monomorphize/ParseWithMapResult.php).
-
-The parser exposes strict and tolerant modes, each in a with-map and
-without-map variant:
-
-- `parse()` / `parseWithMap()` -- strict mode, throws on parse
-  errors. `bin/xphp compile` uses the strict path because
-  compilation must fail on broken source.
-- `parseTolerant()` / `parseTolerantWithMap()` -- recover from
-  trailing parse errors by feeding the stripped source through
-  nikic's error-handler-collecting mode. Used when callers need
-  partial results from incomplete source.
+## The stages
 
----
-
-## Stage 2 -- Hierarchy and Registry construction
-
-Two parallel structures get populated from the parsed ASTs.
-
-**`TypeHierarchy`** ([source](../../src/Transpiler/Monomorphize/TypeHierarchy.php))
-is a direct-ancestor map keyed by FQN: for every `class Foo extends Bar
-implements Baz` declaration, it records `Foo => [Bar, Baz]`. Transitive
-ancestors are walked on demand via `isSubtype()`. A small whitelist of
-PHP built-in interfaces (`Stringable`, `Countable`, `Iterator`, `Traversable`,
-`ArrayAccess`, `JsonSerializable`, `Throwable`, etc.) is treated as known
-even without a source declaration -- a user class that explicitly
-`implements \Stringable` resolves its bound without the hierarchy
-needing to model PHP's internal class table.
-
-**`Registry`** ([source](../../src/Transpiler/Monomorphize/Registry.php))
-is the bookkeeping core of monomorphization. It holds two maps:
-
-- `definitions: array<string, GenericDefinition>` keyed by template
-  FQN -- one entry per `class Foo<T>` / `interface Foo<T>` / `trait
-  Foo<T>` / `function foo<T>(...)` template.
-- `instantiations: array<string, GenericInstantiation>` keyed by
-  the generated FQN -- one entry per concrete `(template, args)`
-  pair seen anywhere in the source set, including transitively
-  through specialization.
-
-Each map value is a small value object:
-
-- [`GenericDefinition`](../../src/Transpiler/Monomorphize/GenericDefinition.php)
-  carries `(templateFqn, templateShortName, typeParams, templateAst,
-  sourceFile)`.
-- [`GenericInstantiation`](../../src/Transpiler/Monomorphize/GenericInstantiation.php)
-  carries `(templateFqn, concreteTypes, generatedFqn)`.
-
-**`RegistryCollector`** ([source](../../src/Transpiler/Monomorphize/RegistryCollector.php))
-walks an AST and calls `Registry::recordDefinition()` for every
-template ClassLike and `Registry::recordInstantiation()` for every
-Name node carrying concrete generic args.
-
-`recordInstantiation()` is recursive: when called on
-`Wrapper<Box<Plastic>>`, it first records `Box<Plastic>` (so the
-inner generic shows up before the outer one) and then `Wrapper<...>`.
-Bounds are validated inside `recordInstantiation()` -- see Stage 6
-below.
-
----
-
-## Stage 3 -- Method- and function-scope specialization
-
-Method-scoped generics (`Cls::method::<T>(...)`) and free generic
-functions (`function f<T>(...)`) are handled by a separate pass
-before the class-level fixed-point loop runs. The reason is that
-their specialization is **call-site driven**: each unique arg list
-mints one mangled method or function appended to the same class /
-namespace.
-
-[`GenericMethodCompiler::process()`](../../src/Transpiler/Monomorphize/GenericMethodCompiler.php)
-runs on the full `astPerFile` map and:
-
-1. Collects every method-template (`ClassFqn::methodName`) and
-   free-function template (`Namespace\functionName`).
-2. Collects every `StaticCall` / `FuncCall` carrying
-   `ATTR_METHOD_GENERIC_ARGS` -- those are the call sites the
-   scanner detected during parse.
-3. For each call site, mangles a name (`methodName_T_<hash>` or
-   `functionName_T_<hash>`), clones the template body, substitutes
-   the type-param, and appends the result to the owning class
-   (for methods) or namespace (for functions). Calls
-   `Registry::checkBounds()` first so bound violations on
-   method-level type-params fire before the body is cloned.
-4. Strips the original template `ClassMethod` / `Function_`.
-5. Rewrites each call site's identifier to the mangled name.
-
-**Call-site coverage**: static calls (`Cls::method::<int>(...)`),
-instance calls (`$obj->method::<int>(...)`), and the nullsafe variant
-(`$obj?->method::<int>(...)`) all rewrite. Receiver-type analysis
-walks the AST tracking each variable's class from typed parameters,
-typed properties, `$this`, and local `$x = new Foo()` assignments;
-when the receiver class is unambiguous, the call binds to the right
-specialization. When the analysis can't prove a single class (e.g.,
-after a branching reassignment whose arms disagree), the turbofish call
-is a compile error (`xphp.undetermined_receiver`) rather than a silently
-de-specialized call that would fatal at runtime
-— see the [branching narrowing caveat](../caveats.md#branching-narrowing-precision-loss).
-
-Method-scoped generics work on non-generic AND generic enclosing
-classes; the type-param scopes from each layer are kept distinct.
-
----
-
-## Stage 4 -- Class-level fixed-point specialization
-
-After method-scope specialization is done, the class-level loop runs
-inside [`Compiler::compile()`](../../src/Transpiler/Monomorphize/Compiler.php)
-to drive the [`Specializer`](../../src/Transpiler/Monomorphize/Specializer.php).
-
-The loop is fixed-point because **specialization can introduce new
-instantiations**. The textbook example: `class Wrapper<T> { public
-Box<T> $b; }` is itself just a template, but when instantiated as
-`Wrapper<Plastic>`, the substitution produces a body that references
-`Box<Plastic>` -- a new instantiation that didn't exist in the
-original source. The fixed-point loop catches that transitively
-through any depth.
-
-```mermaid
-flowchart TD
-    A["countBefore = registry.instantiations.count"]
-    B["for each instantiation:<br/>look up definition<br/>specialize AST<br/>recollect specialized AST"]
-    C["countAfter = registry.instantiations.count"]
-    D{"countAfter > countBefore?"}
-    E{"iteration >= MAX_DEPTH (16)?"}
-    F["throw: depth cap exceeded<br/>+ instantiation trail"]
-    G["loop terminates<br/>proceed to rewrite + emit"]
-
-    A --> B --> C --> D
-    D -- yes --> E
-    D -- no --> G
-    E -- yes --> F
-    E -- no --> A
-```
-
-`Specializer::specialize()` takes the template AST and a substitution
-map (`['T' => 'App\Models\Plastic']`), clones the AST, and replaces
-every Name node referencing a type-param with a `FullyQualified`
-node pointing at the concrete type. The result is a stand-alone
-ClassLike AST that can be emitted as a normal `.php` file once
-rewriting runs.
-
-**The 16-iteration depth cap** exists to abort pathological recursive
-types -- a `class Recursive<T> { public Box<Recursive<T>> $b; }` would
-spin forever without it. On hitting the cap, the compiler throws with
-the full instantiation trail so the user can see which template caused
-the runaway.
-
----
-
-## Stage 4.5 -- Variance-edge emission
-
-Once the fixed-point loop has recorded *every* specialization (and not
-before -- the comparison is pairwise across the full set), a single
-pass over the specialized ASTs wires up the real subtype edges that
-declaration-site variance promises.
-[`VarianceEdgeEmitter::emitEdges()`](../../src/Transpiler/Monomorphize/VarianceEdgeEmitter.php)
-walks each pair of specializations of the same variant template and,
-where the type arguments are related the right way, adds the
-`extends` / `implements` link between them: `Producer<Banana>`
-actually `extends Producer<Fruit>` when `Banana extends Fruit` and
-`T` is covariant (`out T`), dually for contravariant (`in T`). The edges
-are appended to the cloned specialization's `implements` / `extends`
-list and survive the next stage untouched -- the rewriter only
-rewrites *template* `Class_` / `Interface_` nodes, not specialized
-ones.
-
----
+Each stage has its own page, in pipeline order:
 
-## Stage 5 -- Rewriting and emission
-
-Two transformations happen during rewrite, both implemented in
-[`CallSiteRewriter`](../../src/Transpiler/Monomorphize/CallSiteRewriter.php):
-
-1. **Generic Name nodes become FullyQualified references.** Every
-   Name node carrying `ATTR_GENERIC_ARGS` (with all args fully
-   concrete) is replaced with a `FullyQualified` Name pointing at
-   the Registry's generated FQN. This catches `new Box::<Plastic>(...)`,
-   `Box<Plastic> $b`, `function f(): Box<Plastic>`, and similar --
-   every position where a generic instantiation can appear.
-2. **Generic ClassLike definitions become empty marker interfaces.**
-   The original `class Box<T> { ... }` declaration is replaced at
-   compile time with an empty `interface Box {}` at the same FQN.
-   Every specialization (`Box_T_<hash>`) `implements` (or `extends`
-   for interfaces) that marker. Generic traits are dropped entirely
-   -- PHP can't `instanceof` a trait, so a marker would be useless.
-
-After the rewrite, two file groups get written:
-
-- **Specialized classes** to `<cacheDir>/Generated/<template-path>/T_<hash>.php`,
-  one per unique `(template, args)` instantiation. Emitted by
-  [`SpecializedClassGenerator::emit()`](../../src/Transpiler/Monomorphize/SpecializedClassGenerator.php).
-- **Rewritten user files** to `<targetDir>/<mirrored-source-path>.php`,
-  preserving the source's PSR-4 layout. The original `.xphp`
-  is pretty-printed back to PHP via `nikic/php-parser`'s
-  `Standard` printer.
-
-A summary of the registry (every template and every instantiation
-with its generated FQN) is written to `<cacheDir>/registry.json` as
-the final step.
-
----
-
-## Stage 6 -- Bound validation
-
-Bound checks happen inside the Registry when an instantiation is
-recorded. The validation is integrated into the recording flow so
-violations fire at the source-level instantiation (e.g.
-`new Box::<int>()`), not later when the obfuscated `T_<hash>` name
-shows up.
-
-```mermaid
-sequenceDiagram
-    participant SRC as Source line
-    Note right of SRC: new Box::<int>(...)
-    participant XSP as XphpSourceParser
-    participant RC as RegistryCollector
-    participant R as Registry
-    participant CB as Registry::checkBounds
-    participant TH as TypeHierarchy::isSubtype
-    SRC->>XSP: tokenise + resolveTypeRef
-    XSP->>RC: ATTR_GENERIC_ARGS=[TypeRef('int', isScalar=true)]
-    RC->>R: recordInstantiation('Box', args)
-    R->>CB: validateBounds(def.typeParams, args, hierarchy)
-    CB->>TH: isSubtype('int', 'Stringable')
-    TH-->>CB: false (scalar can't satisfy class bound)
-    CB->>R: throw RuntimeException
-    Note right of R: int does not extend/implement Stringable
-```
-
-`TypeHierarchy::isSubtype()` returns a **three-way verdict**:
-
-- `true` -- the concrete type extends / implements / equals the
-  bound (directly or transitively). Bound satisfied.
-- `false` -- the concrete type is known to the hierarchy and does
-  NOT have the bound in its ancestor closure. Also the answer for
-  scalars vs class bounds. Bound violated.
-- `null` -- the concrete type is not in the hierarchy and not a
-  recognised built-in. The compiler can't prove satisfaction
-  either way; the verdict surfaces as a distinct
-  "not in the source set" error message so users can either widen
-  the bound or include the missing type in the source set.
-
-The same `Registry::checkBounds()` helper is reused by
-`GenericMethodCompiler` for method-level type-param bounds, so
-class-instantiation and method-call-site validations share the
-exact same verdict-formatting + error-shape contract.
+1. [Stage 1 -- Source parsing](how-it-works/01-source-parsing.md) -- the strip-and-reattach trick that makes `Box<T>` parse as valid PHP.
+2. [Stage 2 -- Hierarchy and Registry construction](how-it-works/02-hierarchy-and-registry.md) -- the ancestor map and the definition / instantiation bookkeeping.
+3. [Stage 3 -- Method- and function-scope specialization](how-it-works/03-method-function-specialization.md) -- call-site-driven mangling for `method::<T>()` and `f<T>()`.
+4. [Stage 4 -- Class-level fixed-point specialization](how-it-works/04-fixed-point-specialization.md) -- the loop that expands every instantiation, transitively.
+5. [Stage 4.5 -- Variance-edge emission](how-it-works/04b-variance-edges.md) -- wiring real `extends` edges between specializations of a variant template.
+6. [Stage 5 -- Rewriting and emission](how-it-works/05-rewriting-and-emission.md) -- Names become generated FQNs, templates become markers, files are written.
+7. [Stage 6 -- Bound validation](how-it-works/06-bound-validation.md) -- the three-way subtype verdict, checked at instantiation time.
+8. [The validation gate](how-it-works/07-validation-gate.md) -- how `xphp check` and a safe `xphp compile` share one gate.
 
 ---
 
@@ -417,6 +150,51 @@ records those segments so any diagnostic span computed after the strip
 can be translated back to the original `.xphp` source; with no such
 rewrite it's the identity map.
 
+### Closure signature types
+
+A `Closure(int $x): bool` type hint documents the callable a slot
+expects. PHP has no such syntax, so the signature is **erased to a bare
+`\Closure`** in the emitted code -- it exists only to be checked, never
+to be emitted. The check mirrors the variance PHP itself enforces when
+an inherited method overrides its prototype.
+
+```mermaid
+flowchart TD
+    Src["Closure(int $x): bool $f<br/>param, return, or property slot"] --> Strip["XphpSourceParser<br/>blank the signature span,<br/>leaving a bare Closure type"]
+    Strip --> Attach["resolveAndAttach<br/>ATTR_CLOSURE_SIG = resolved target signature"]
+    Attach --> Emit["emitted PHP: slot typed as a bare Closure<br/>the signature is checking-only, never emitted"]
+    Attach --> Q{"a closure literal returned<br/>against a Closure(...) return type?"}
+    Q -->|no| Grad["gradual: accepted<br/>variable, argument, or property assignment"]
+    Q -->|yes| Extract["ClosureLiteralSignature::extract<br/>candidate = the literal's own signature"]
+    Extract --> Engine["ClosureSignatureConformance::check<br/>params contravariant, return covariant,<br/>by-ref exact, arity compatible"]
+    Engine --> V{"provable mismatch?"}
+    V -->|no| OK["accepted<br/>stays gradual while unproven"]
+    V -->|yes| Fail["xphp.closure_conformance<br/>throw in compile, collect in check"]
+```
+
+The signature span is blanked exactly like a generic clause
+(byte-length preserving), and `resolveAndAttach` hangs the resolved
+target signature on the surviving `\Closure` node as
+`ATTR_CLOSURE_SIG`. Only **one** site is statically decidable and thus
+checked: a closure literal returned against a `Closure(...)` return
+type (a typed-closure factory). A closure passed through a variable, a
+call argument, or a property assignment is checked gradually
+(accepted), because there is no static meeting point.
+
+The check is deliberately one-directional -- it only rejects a
+**provable** mismatch. An untyped parameter (⇒ `mixed`), an unresolved
+class, a still-abstract type parameter, or a union / intersection
+member leaves the relation unprovable and is accepted, mirroring the
+RFC's runtime leniency.
+
+A signature that names an **enclosing type parameter**
+(`Closure(T $x)`) is checked twice: once at the template pre-loop with
+`T` still abstract (gradually accepted), and again after the
+fixed-point loop substitutes it (Phase 2.4) -- where `Registry<int>`
+grounds the target to `Closure(int $x)` and a `string`-parameter
+literal becomes a provable failure. See
+[closure types](../syntax/closure-types.md) for the surface syntax.
+
 ---
 
 ## Class roster
diff --git a/docs/guides/how-it-works/01-source-parsing.md b/docs/guides/how-it-works/01-source-parsing.md
new file mode 100644
index 0000000..86580af
--- /dev/null
+++ b/docs/guides/how-it-works/01-source-parsing.md
@@ -0,0 +1,53 @@
+# Stage 1 -- Source parsing
+
+[← How the xphp compiler works](../how-it-works.md)
+
+PHP doesn't recognise `class Box<T>` or `function identity<T>(T $x)`
+as legal syntax. nikic/php-parser would reject the source at the
+first `<`. The compiler works around this with a token-level **strip
+and reattach** trick implemented in
+[`XphpSourceParser`](../../../src/Transpiler/Monomorphize/XphpSourceParser.php):
+
+1. **Tokenise** the source via PHP's own `token_get_all`.
+2. **Scan** for generic clauses -- `Name<...>` patterns -- with
+   depth tracking so arbitrarily nested `Box<List<Plastic>>` constructs
+   are handled.
+3. **Blank** every `<...>` clause by overwriting it with spaces of
+   equal length, producing plain valid PHP while keeping every byte
+   offset and line number identical to the original source.
+4. **Parse** the stripped source with nikic.
+5. **Reattach** the generic metadata to the resulting AST as node
+   attributes (`ATTR_GENERIC_PARAMS` on ClassLike declarations,
+   `ATTR_GENERIC_ARGS` + `ATTR_TEMPLATE_FQN` on instantiation Names,
+   `ATTR_METHOD_GENERIC_PARAMS` / `ATTR_METHOD_GENERIC_ARGS` on
+   method-scope generics).
+
+Because the `<...>` clauses are blanked with equal-length spaces,
+generic-clause stripping needs no position bookkeeping at all -- AST
+offsets round-trip to the original source for free. The one
+length-changing rewrite is the `T[]` array-suffix sugar: `T[]` (3
+bytes) becomes `array` (5 bytes), which shifts every offset to its
+right. That's what
+[`ByteOffsetMap`](../../../src/Transpiler/Monomorphize/ByteOffsetMap.php)
+solves: it records each length-changing segment so any later byte
+offset in the stripped source can be translated back into the
+original -- which matters for editor diagnostics ("the offending
+`<int>` is at line 12, column 5"). When no length-changing
+replacement happened the map is the identity and returns the offset
+unchanged. The pair of (AST, ByteOffsetMap) is returned together as
+[`ParseWithMapResult`](../../../src/Transpiler/Monomorphize/ParseWithMapResult.php).
+
+The parser exposes strict and tolerant modes, each in a with-map and
+without-map variant:
+
+- `parse()` / `parseWithMap()` -- strict mode, throws on parse
+  errors. `bin/xphp compile` uses the strict path because
+  compilation must fail on broken source.
+- `parseTolerant()` / `parseTolerantWithMap()` -- recover from
+  trailing parse errors by feeding the stripped source through
+  nikic's error-handler-collecting mode. Used when callers need
+  partial results from incomplete source.
+
+---
+
+[Index](../how-it-works.md) · Next: [Stage 2 -- Hierarchy and Registry construction](02-hierarchy-and-registry.md)
diff --git a/docs/guides/how-it-works/02-hierarchy-and-registry.md b/docs/guides/how-it-works/02-hierarchy-and-registry.md
new file mode 100644
index 0000000..5ca9923
--- /dev/null
+++ b/docs/guides/how-it-works/02-hierarchy-and-registry.md
@@ -0,0 +1,49 @@
+# Stage 2 -- Hierarchy and Registry construction
+
+[← How the xphp compiler works](../how-it-works.md)
+
+Two parallel structures get populated from the parsed ASTs.
+
+**`TypeHierarchy`** ([source](../../../src/Transpiler/Monomorphize/TypeHierarchy.php))
+is a direct-ancestor map keyed by FQN: for every `class Foo extends Bar
+implements Baz` declaration, it records `Foo => [Bar, Baz]`. Transitive
+ancestors are walked on demand via `isSubtype()`. A small whitelist of
+PHP built-in interfaces (`Stringable`, `Countable`, `Iterator`, `Traversable`,
+`ArrayAccess`, `JsonSerializable`, `Throwable`, etc.) is treated as known
+even without a source declaration -- a user class that explicitly
+`implements \Stringable` resolves its bound without the hierarchy
+needing to model PHP's internal class table.
+
+**`Registry`** ([source](../../../src/Transpiler/Monomorphize/Registry.php))
+is the bookkeeping core of monomorphization. It holds two maps:
+
+- `definitions: array<string, GenericDefinition>` keyed by template
+  FQN -- one entry per `class Foo<T>` / `interface Foo<T>` / `trait
+  Foo<T>` / `function foo<T>(...)` template.
+- `instantiations: array<string, GenericInstantiation>` keyed by
+  the generated FQN -- one entry per concrete `(template, args)`
+  pair seen anywhere in the source set, including transitively
+  through specialization.
+
+Each map value is a small value object:
+
+- [`GenericDefinition`](../../../src/Transpiler/Monomorphize/GenericDefinition.php)
+  carries `(templateFqn, templateShortName, typeParams, templateAst,
+  sourceFile)`.
+- [`GenericInstantiation`](../../../src/Transpiler/Monomorphize/GenericInstantiation.php)
+  carries `(templateFqn, concreteTypes, generatedFqn)`.
+
+**`RegistryCollector`** ([source](../../../src/Transpiler/Monomorphize/RegistryCollector.php))
+walks an AST and calls `Registry::recordDefinition()` for every
+template ClassLike and `Registry::recordInstantiation()` for every
+Name node carrying concrete generic args.
+
+`recordInstantiation()` is recursive: when called on
+`Wrapper<Box<Plastic>>`, it first records `Box<Plastic>` (so the
+inner generic shows up before the outer one) and then `Wrapper<...>`.
+Bounds are validated inside `recordInstantiation()` -- see
+[Stage 6 -- Bound validation](06-bound-validation.md).
+
+---
+
+Prev: [Stage 1 -- Source parsing](01-source-parsing.md) · [Index](../how-it-works.md) · Next: [Stage 3 -- Method- and function-scope specialization](03-method-function-specialization.md)
diff --git a/docs/guides/how-it-works/03-method-function-specialization.md b/docs/guides/how-it-works/03-method-function-specialization.md
new file mode 100644
index 0000000..47bb794
--- /dev/null
+++ b/docs/guides/how-it-works/03-method-function-specialization.md
@@ -0,0 +1,46 @@
+# Stage 3 -- Method- and function-scope specialization
+
+[← How the xphp compiler works](../how-it-works.md)
+
+Method-scoped generics (`Cls::method::<T>(...)`) and free generic
+functions (`function f<T>(...)`) are handled by a separate pass
+before the class-level fixed-point loop runs. The reason is that
+their specialization is **call-site driven**: each unique arg list
+mints one mangled method or function appended to the same class /
+namespace.
+
+[`GenericMethodCompiler::process()`](../../../src/Transpiler/Monomorphize/GenericMethodCompiler.php)
+runs on the full `astPerFile` map and:
+
+1. Collects every method-template (`ClassFqn::methodName`) and
+   free-function template (`Namespace\functionName`).
+2. Collects every `StaticCall` / `FuncCall` carrying
+   `ATTR_METHOD_GENERIC_ARGS` -- those are the call sites the
+   scanner detected during parse.
+3. For each call site, mangles a name (`methodName_T_<hash>` or
+   `functionName_T_<hash>`), clones the template body, substitutes
+   the type-param, and appends the result to the owning class
+   (for methods) or namespace (for functions). Calls
+   `Registry::checkBounds()` first so bound violations on
+   method-level type-params fire before the body is cloned.
+4. Strips the original template `ClassMethod` / `Function_`.
+5. Rewrites each call site's identifier to the mangled name.
+
+**Call-site coverage**: static calls (`Cls::method::<int>(...)`),
+instance calls (`$obj->method::<int>(...)`), and the nullsafe variant
+(`$obj?->method::<int>(...)`) all rewrite. Receiver-type analysis
+walks the AST tracking each variable's class from typed parameters,
+typed properties, `$this`, and local `$x = new Foo()` assignments;
+when the receiver class is unambiguous, the call binds to the right
+specialization. When the analysis can't prove a single class (e.g.,
+after a branching reassignment whose arms disagree), the turbofish call
+is a compile error (`xphp.undetermined_receiver`) rather than a silently
+de-specialized call that would fatal at runtime
+— see the [branching narrowing caveat](../../caveats.md#branching-narrowing-precision-loss).
+
+Method-scoped generics work on non-generic AND generic enclosing
+classes; the type-param scopes from each layer are kept distinct.
+
+---
+
+Prev: [Stage 2 -- Hierarchy and Registry construction](02-hierarchy-and-registry.md) · [Index](../how-it-works.md) · Next: [Stage 4 -- Class-level fixed-point specialization](04-fixed-point-specialization.md)
diff --git a/docs/guides/how-it-works/04-fixed-point-specialization.md b/docs/guides/how-it-works/04-fixed-point-specialization.md
new file mode 100644
index 0000000..4bb8b94
--- /dev/null
+++ b/docs/guides/how-it-works/04-fixed-point-specialization.md
@@ -0,0 +1,49 @@
+# Stage 4 -- Class-level fixed-point specialization
+
+[← How the xphp compiler works](../how-it-works.md)
+
+After method-scope specialization is done, the class-level loop runs
+inside [`Compiler::compile()`](../../../src/Transpiler/Monomorphize/Compiler.php)
+to drive the [`Specializer`](../../../src/Transpiler/Monomorphize/Specializer.php).
+
+The loop is fixed-point because **specialization can introduce new
+instantiations**. The textbook example: `class Wrapper<T> { public
+Box<T> $b; }` is itself just a template, but when instantiated as
+`Wrapper<Plastic>`, the substitution produces a body that references
+`Box<Plastic>` -- a new instantiation that didn't exist in the
+original source. The fixed-point loop catches that transitively
+through any depth.
+
+```mermaid
+flowchart TD
+    A["countBefore = registry.instantiations.count"]
+    B["for each instantiation:<br/>look up definition<br/>specialize AST<br/>recollect specialized AST"]
+    C["countAfter = registry.instantiations.count"]
+    D{"countAfter > countBefore?"}
+    E{"iteration >= MAX_DEPTH (16)?"}
+    F["throw: depth cap exceeded<br/>+ instantiation trail"]
+    G["loop terminates<br/>proceed to rewrite + emit"]
+
+    A --> B --> C --> D
+    D -- yes --> E
+    D -- no --> G
+    E -- yes --> F
+    E -- no --> A
+```
+
+`Specializer::specialize()` takes the template AST and a substitution
+map (`['T' => 'App\Models\Plastic']`), clones the AST, and replaces
+every Name node referencing a type-param with a `FullyQualified`
+node pointing at the concrete type. The result is a stand-alone
+ClassLike AST that can be emitted as a normal `.php` file once
+rewriting runs.
+
+**The 16-iteration depth cap** exists to abort pathological recursive
+types -- a `class Recursive<T> { public Box<Recursive<T>> $b; }` would
+spin forever without it. On hitting the cap, the compiler throws with
+the full instantiation trail so the user can see which template caused
+the runaway.
+
+---
+
+Prev: [Stage 3 -- Method- and function-scope specialization](03-method-function-specialization.md) · [Index](../how-it-works.md) · Next: [Stage 4.5 -- Variance-edge emission](04b-variance-edges.md)
diff --git a/docs/guides/how-it-works/04b-variance-edges.md b/docs/guides/how-it-works/04b-variance-edges.md
new file mode 100644
index 0000000..8923402
--- /dev/null
+++ b/docs/guides/how-it-works/04b-variance-edges.md
@@ -0,0 +1,44 @@
+# Stage 4.5 -- Variance-edge emission
+
+[← How the xphp compiler works](../how-it-works.md)
+
+Once the fixed-point loop has recorded *every* specialization (and not
+before -- the comparison is pairwise across the full set), a single
+pass over the specialized ASTs wires up the real subtype edges that
+declaration-site variance promises.
+[`VarianceEdgeEmitter::emitEdges()`](../../../src/Transpiler/Monomorphize/VarianceEdgeEmitter.php)
+walks each pair of specializations of the same variant template and,
+where the type arguments are related the right way, adds the
+`extends` / `implements` link between them: `Producer<Banana>`
+actually `extends Producer<Fruit>` when `Banana extends Fruit` and
+`T` is covariant (`out T`), dually for contravariant (`in T`). The edges
+are appended to the cloned specialization's `implements` / `extends`
+list and survive the next stage untouched -- the rewriter only
+rewrites *template* `Class_` / `Interface_` nodes, not specialized
+ones.
+
+```mermaid
+flowchart BT
+    Banana["Producer_Banana_&lt;hash&gt;<br/>the Producer&lt;Banana&gt; specialization"] -->|extends| Fruit["Producer_Fruit_&lt;hash&gt;<br/>the Producer&lt;Fruit&gt; specialization"]
+    Banana -->|implements| Marker["Producer<br/>empty marker interface"]
+    Fruit -->|implements| Marker
+```
+
+So the covariant promise holds at runtime: a `Producer<Banana>`
+**is-a** `Producer<Fruit>` (assignable where the wider type is
+expected), and both remain a bare `Producer` through the marker. A
+contravariant `in T` reverses the edge -- `Consumer<Fruit> extends
+Consumer<Banana>`.
+[`VarianceSubtyping`](../../../src/Transpiler/Monomorphize/VarianceSubtyping.php)
+decides each argument pair (invariant: equal; co-/contravariant: nested
+subtype), and **only a provable edge is emitted** -- an unprovable pair
+skips the edge rather than risk a wrong `extends` that would fatal at
+autoload (a missed edge only loses an `instanceof` the compiler
+couldn't prove). Class specializations take a single `extends`, and a
+source-declared parent wins -- the same-template leaf edge is then
+dropped (a missed `instanceof`, never a fatal); interface
+specializations take a multi-target `extends`.
+
+---
+
+Prev: [Stage 4 -- Class-level fixed-point specialization](04-fixed-point-specialization.md) · [Index](../how-it-works.md) · Next: [Stage 5 -- Rewriting and emission](05-rewriting-and-emission.md)
diff --git a/docs/guides/how-it-works/05-rewriting-and-emission.md b/docs/guides/how-it-works/05-rewriting-and-emission.md
new file mode 100644
index 0000000..38c747d
--- /dev/null
+++ b/docs/guides/how-it-works/05-rewriting-and-emission.md
@@ -0,0 +1,37 @@
+# Stage 5 -- Rewriting and emission
+
+[← How the xphp compiler works](../how-it-works.md)
+
+Two transformations happen during rewrite, both implemented in
+[`CallSiteRewriter`](../../../src/Transpiler/Monomorphize/CallSiteRewriter.php):
+
+1. **Generic Name nodes become FullyQualified references.** Every
+   Name node carrying `ATTR_GENERIC_ARGS` (with all args fully
+   concrete) is replaced with a `FullyQualified` Name pointing at
+   the Registry's generated FQN. This catches `new Box::<Plastic>(...)`,
+   `Box<Plastic> $b`, `function f(): Box<Plastic>`, and similar --
+   every position where a generic instantiation can appear.
+2. **Generic ClassLike definitions become empty marker interfaces.**
+   The original `class Box<T> { ... }` declaration is replaced at
+   compile time with an empty `interface Box {}` at the same FQN.
+   Every specialization (`Box_T_<hash>`) `implements` (or `extends`
+   for interfaces) that marker. Generic traits are dropped entirely
+   -- PHP can't `instanceof` a trait, so a marker would be useless.
+
+After the rewrite, two file groups get written:
+
+- **Specialized classes** to `<cacheDir>/Generated/<template-path>/T_<hash>.php`,
+  one per unique `(template, args)` instantiation. Emitted by
+  [`SpecializedClassGenerator::emit()`](../../../src/Transpiler/Monomorphize/SpecializedClassGenerator.php).
+- **Rewritten user files** to `<targetDir>/<mirrored-source-path>.php`,
+  preserving the source's PSR-4 layout. The original `.xphp`
+  is pretty-printed back to PHP via `nikic/php-parser`'s
+  `Standard` printer.
+
+A summary of the registry (every template and every instantiation
+with its generated FQN) is written to `<cacheDir>/registry.json` as
+the final step.
+
+---
+
+Prev: [Stage 4.5 -- Variance-edge emission](04b-variance-edges.md) · [Index](../how-it-works.md) · Next: [Stage 6 -- Bound validation](06-bound-validation.md)
diff --git a/docs/guides/how-it-works/06-bound-validation.md b/docs/guides/how-it-works/06-bound-validation.md
new file mode 100644
index 0000000..6a9e5bc
--- /dev/null
+++ b/docs/guides/how-it-works/06-bound-validation.md
@@ -0,0 +1,50 @@
+# Stage 6 -- Bound validation
+
+[← How the xphp compiler works](../how-it-works.md)
+
+Bound checks happen inside the Registry when an instantiation is
+recorded. The validation is integrated into the recording flow so
+violations fire at the source-level instantiation (e.g.
+`new Box::<int>()`), not later when the obfuscated `T_<hash>` name
+shows up.
+
+```mermaid
+sequenceDiagram
+    participant SRC as Source line
+    Note right of SRC: new Box::<int>(...)
+    participant XSP as XphpSourceParser
+    participant RC as RegistryCollector
+    participant R as Registry
+    participant CB as Registry::checkBounds
+    participant TH as TypeHierarchy::isSubtype
+    SRC->>XSP: tokenise + resolveTypeRef
+    XSP->>RC: ATTR_GENERIC_ARGS=[TypeRef('int', isScalar=true)]
+    RC->>R: recordInstantiation('Box', args)
+    R->>CB: validateBounds(def.typeParams, args, hierarchy)
+    CB->>TH: isSubtype('int', 'Stringable')
+    TH-->>CB: false (scalar can't satisfy class bound)
+    CB->>R: throw RuntimeException
+    Note right of R: int does not extend/implement Stringable
+```
+
+`TypeHierarchy::isSubtype()` returns a **three-way verdict**:
+
+- `true` -- the concrete type extends / implements / equals the
+  bound (directly or transitively). Bound satisfied.
+- `false` -- the concrete type is known to the hierarchy and does
+  NOT have the bound in its ancestor closure. Also the answer for
+  scalars vs class bounds. Bound violated.
+- `null` -- the concrete type is not in the hierarchy and not a
+  recognised built-in. The compiler can't prove satisfaction
+  either way; the verdict surfaces as a distinct
+  "not in the source set" error message so users can either widen
+  the bound or include the missing type in the source set.
+
+The same `Registry::checkBounds()` helper is reused by
+`GenericMethodCompiler` for method-level type-param bounds, so
+class-instantiation and method-call-site validations share the
+exact same verdict-formatting + error-shape contract.
+
+---
+
+Prev: [Stage 5 -- Rewriting and emission](05-rewriting-and-emission.md) · [Index](../how-it-works.md) · Next: [The validation gate](07-validation-gate.md)
diff --git a/docs/guides/how-it-works/07-validation-gate.md b/docs/guides/how-it-works/07-validation-gate.md
new file mode 100644
index 0000000..7e0ffd1
--- /dev/null
+++ b/docs/guides/how-it-works/07-validation-gate.md
@@ -0,0 +1,58 @@
+# The validation gate -- `check` and safe `compile`
+
+[← How the xphp compiler works](../how-it-works.md)
+
+`xphp check` validates without emitting anything, and `xphp compile`
+runs that **same** gate before it writes a single file -- so a typo'd
+type or an undeclared class fails the build at compile time instead of
+slipping through to runtime. Both commands share one composed gate
+([`CheckGate`](../../../src/StaticAnalysis/CheckGate.php)): the source-level
+generic validators first, then -- only if those are clean -- PHPStan
+over the compiled output.
+
+```mermaid
+flowchart TD
+    Check["xphp check"] --> Gate["CheckGate::run"]
+    Compile["xphp compile"] --> NoCheck{"--no-check?"}
+    NoCheck -->|yes| Emit["compile: emit dist/ + cache/Generated"]
+    NoCheck -->|no| Gate
+    Gate --> Generic["Compiler::check<br/>source-level generic validators:<br/>bounds, variance, undeclared type,<br/>missing args, closure conformance<br/>collect, never throw"]
+    Generic --> HasErr{"errors, or --no-phpstan?"}
+    HasErr -->|"yes / skip"| Merge["merged DiagnosticCollector"]
+    HasErr -->|no| PhpStan["StaticAnalysisGate<br/>compile to a temp workspace,<br/>run PHPStan over the specialized files"]
+    PhpStan --> Merge
+    Merge --> Done{"hasErrors?"}
+    Done -->|"check"| Render["render text / json / github<br/>exit 1 if errors, else 0"]
+    Done -->|"compile: errors"| Fail["emit nothing -> FAILURE"]
+    Done -->|"compile: clean"| Emit
+```
+
+[`Compiler::check()`](../../../src/Transpiler/Monomorphize/Compiler.php)
+runs every source-level generic validator against a
+`DiagnosticCollector` -- so it **collects** every error in one pass
+instead of throwing on the first (the same validators throw in
+`compile`). It is per-file resilient: a file that fails to parse
+becomes one diagnostic and the rest are still checked. It stops after
+collecting instantiations; it never specializes or emits.
+
+The PHPStan pass runs **only** when the generic checks are clean and
+`--no-phpstan` was not given.
+[`StaticAnalysisGate`](../../../src/StaticAnalysis/StaticAnalysisGate.php)
+compiles the sources into a throwaway temp workspace, picks one
+representative specialized file per instantiation, and runs PHPStan
+over them with the compiled output plus the consumer's `vendor/` on the
+scan path. That real autoloader visibility is what makes the pass sound
+-- a genuine plain-`.php` domain class used as a type argument resolves
+and is never false-rejected. Findings map back to source diagnostics
+and merge into the same collector.
+
+`check` renders the merged diagnostics (`text` / `json` / `github`) and
+exits non-zero if any are errors. `compile` emits nothing when the gate
+reports an error (the gate runs before any file is written, so there is
+nothing to roll back); otherwise it proceeds to the real
+`Compiler::compile()`. `--no-check` skips the gate entirely for a
+fast, trusted iteration build.
+
+---
+
+Prev: [Stage 6 -- Bound validation](06-bound-validation.md) · [Index](../how-it-works.md)
diff --git a/docs/guides/runtime-semantics.md b/docs/guides/runtime-semantics.md
index 8c76efc..9b3c727 100644
--- a/docs/guides/runtime-semantics.md
+++ b/docs/guides/runtime-semantics.md
@@ -167,6 +167,22 @@ args are spelled. Hash-collision detection at recording time fails
 loudly with both colliding instantiations, the current hash length,
 and a re-run command using a longer hash.
 
+### Free functions and constants bind the template's namespace
+
+Because a specialized body moves into `XPHP\Generated\…`, an
+unqualified free-function call or constant read inside it (`helper($x)`,
+`FACTOR`) would, under PHP's normal rules, look in the *generated*
+namespace and then fall back to global — never the template's own
+namespace. The compiler prevents this: every unqualified free-function
+call and constant fetch that the template's compilation unit defines
+(directly, in another file of the same namespace, or via a
+`use function` / `use const` import, single or grouped) is
+fully-qualified to that symbol before the class is emitted. Built-in
+functions, magic constants, and any name the unit does not define are
+left untouched, so PHP's global resolution still applies to them. A
+specialization therefore calls exactly the free functions and constants
+its template did.
+
 ## What monomorphization costs
 
 One class file per unique instantiation. A codebase instantiating
diff --git a/docs/syntax/classes-and-interfaces.md b/docs/syntax/classes-and-interfaces.md
index 3417c01..3c2997a 100644
--- a/docs/syntax/classes-and-interfaces.md
+++ b/docs/syntax/classes-and-interfaces.md
@@ -73,6 +73,13 @@ implementation detail.
 - **Traits don't get markers** — `instanceof SomeTrait` doesn't work
   in PHP, so generic traits are dropped from the emit after
   specialization.
+- **Generic traits work with `insteadof` / `as`** — a conflict
+  resolution block (`use A<int>, B<int> { A::m insteadof B; B::m as
+  bm; }`) rewrites its operand names to the same specializations as
+  the `use` list, so the adapted class loads and runs. A bare operand
+  that matches two different specializations of one trait (`use
+  A<int>, A<string>`) can't be disambiguated in an adaptation clause
+  and is rejected.
 - **Variance edges** — when `out T` or `in T` is declared, specializations
   get real `extends` chains. See [variance](variance.md).
 
@@ -81,5 +88,6 @@ implementation detail.
 - Test fixture: `test/fixture/compile/box_generic/`
 - Test fixture: `test/fixture/compile/generic_interface/`
 - Test fixture: `test/fixture/compile/nested_instantiation/`
+- Test fixture: `test/fixture/compile/generic_trait_adaptation/`
 - Related: [methods and functions](methods-and-functions.md),
   [turbofish](turbofish.md)
diff --git a/docs/syntax/closure-types.md b/docs/syntax/closure-types.md
new file mode 100644
index 0000000..08776f6
--- /dev/null
+++ b/docs/syntax/closure-types.md
@@ -0,0 +1,214 @@
+# `Closure(...)` signature types
+
+xphp accepts a **closure signature type** — `Closure(int $x, string $y):
+bool` — anywhere a type hint is allowed (a parameter, a return, a
+property). It documents the shape of the callable a slot expects, then
+**erases to a bare `\Closure`** at compile time, so the emitted PHP is
+ordinary code that any PHP runtime accepts.
+
+```php
+<?php
+declare(strict_types=1);
+
+namespace App;
+
+// A factory that returns an int-to-int closure.
+function adder(int $by): Closure(int $x): int {
+    return fn(int $x): int => $x + $by;
+}
+```
+
+compiles to:
+
+```php
+<?php
+declare(strict_types=1);
+
+namespace App;
+
+function adder(int $by): \Closure {
+    return fn(int $x): int => $x + $by;
+}
+```
+
+The parameter names inside the signature are documentation only (exactly
+like a real closure's parameter names); only the types, order, by-reference
+markers, and arity carry meaning.
+
+A signature may be nullable (`?Closure(int): int`), may omit the return
+(`Closure(int $x)` — any return accepted), and may nest
+(`Closure(Closure(int): int $f): int`).
+
+## Conformance checking
+
+Where a closure **literal** is returned against a `Closure(...)` return
+type, xphp checks that the literal actually conforms, using the same
+variance PHP enforces when an inherited method overrides its prototype:
+
+- **Parameters are contravariant** — each parameter of the literal must be
+  the same as or **wider** than the target's.
+- **The return is covariant** — the literal's return must be the same as or
+  **narrower** than the target's.
+- **By-reference-ness is exact**, and **arity must be compatible** (the
+  literal must accept every argument the target guarantees, and require no
+  more than the target guarantees).
+
+```php
+function makeAdder(): Closure(int $x): int {
+    return fn(int $x): int => $x + 1;      // ✓ conforms
+}
+
+function makeBroken(): Closure(int $x): int {
+    return fn(string $x): int => 0;        // ✗ compile error:
+                                           //   parameter 1 is not wider than int
+}
+```
+
+A mismatch is a compile error (`xphp compile` fails; `xphp check` reports
+`xphp.closure_conformance`). See [errors](../errors.md).
+
+### Contravariance and covariance, concretely
+
+Scalars can't show *why* the rules point the way they do — `int` and `string`
+are unrelated, so neither is "wider" than the other. A class hierarchy makes it
+visible. Take:
+
+```php
+class LivingThing {}
+class Animal extends LivingThing {}
+class Dog extends Animal {}
+class Cat extends Animal {}
+```
+
+and a slot that wants **a function taking a `Dog` and returning some `Animal`**:
+
+```php
+function pipeline(): Closure(Dog $d): Animal {
+    return /* one of the literals in the table below */;
+}
+```
+
+The insight is that the slot *owns both ends of the call*: it will only ever
+**hand the closure a `Dog`**, and it promises its own caller **an `Animal`
+back**.
+
+- **Parameters are contravariant — a *wider* parameter is safe.** The closure is
+  only ever called with a `Dog`, so a closure that accepts any `Animal` (or even
+  any `LivingThing`) copes fine — a `Dog` *is* an `Animal`. A closure that
+  demands a *narrower* or *sibling* type can't: it would be handed a `Dog` it
+  refuses.
+- **The return is covariant — a *narrower* return is safe.** The caller only
+  relies on getting *some* `Animal` back, so a closure returning a `Dog` (a kind
+  of `Animal`) satisfies it. One returning a mere `LivingThing` doesn't — the
+  caller could get a `LivingThing` that isn't an `Animal`.
+
+| Returned literal        | Parameter                | Return                     | Verdict |
+|-------------------------|--------------------------|----------------------------|---------|
+| `fn(Dog $d): Animal`    | exact                    | exact                      | ✓ accepted |
+| `fn(Animal $a): Animal` | **wider** (contravariant)| exact                      | ✓ accepted |
+| `fn(Dog $d): Dog`       | exact                    | **narrower** (covariant)   | ✓ accepted |
+| `fn(Animal $a): Dog`    | wider                    | narrower                   | ✓ accepted |
+| `fn(Cat $c): Animal`    | sibling — not wider      | —                          | ✗ `parameter 1: Cat is not wider than Dog` |
+| `fn(Dog $d): LivingThing` | exact                  | wider — not narrower       | ✗ `return type: LivingThing is not a subtype of Animal` |
+
+(The real diagnostics name the classes fully-qualified; short names are used
+here for readability.)
+
+If your instinct says *"if I expect a `Dog`, I shouldn't have to handle a
+`Cat`"* — that's exactly right, and it's *why* `fn(Cat $c)` is rejected: the slot
+will pass a `Dog`, and a `Cat`-handler can't take it. The very same instinct is
+what makes the *wider* `fn(Animal $a)` **safe**, not unsafe: a handler for any
+`Animal` never chokes on the `Dog` it's given. Contravariance widens what's
+accepted on the way *in*; covariance narrows what's promised on the way *out*.
+
+> This is the **same** variance PHP already enforces when a subclass overrides a
+> method — a wider parameter and a narrower return are exactly what PHP permits
+> in an override. It's a *structural, per-signature* check, and it is distinct
+> from the *declaration-site* `out T` / `in T` class variance in
+> [Variance](variance.md), which instead wires real `extends` edges between whole
+> specializations. Same underlying principle — subtyping flows one way through
+> inputs and the other through outputs — different mechanism.
+
+### It only rejects a *provable* mismatch
+
+The check is deliberately one-directional: it never rejects code it cannot
+prove wrong. A parameter or return that is untyped (⇒ `mixed`), a class the
+source set doesn't declare, a still-abstract generic type parameter, a
+`self`/`static`/`parent`/`object`/`iterable`/`callable` leaf, or a nullable /
+union / intersection type is **accepted**. A built-in supertype (a
+`Closure(): \Throwable` target) is accepted whenever the candidate could
+genuinely satisfy it — a subclass of a built-in (`\Exception`), an enum against
+an interface it implements, a `__toString` class against `\Stringable`, or any
+class with an unknown ancestor. Only a candidate whose **entire declared
+ancestry is user code with no built-in anywhere** is provably unrelated to a
+built-in target, and only that is rejected. This mirrors the RFC's runtime
+leniency — lenient while unresolved, decide only when provable.
+
+Only the return-position "factory" pattern above is checked, because that is
+the one place a closure literal statically meets a `Closure(...)` target: a
+default value cannot be a closure (PHP requires a constant expression), and a
+closure passed through a variable or a call argument is checked gradually
+(accepted).
+
+## Generic signatures
+
+A closure signature may reference the enclosing type parameters, and each is
+**grounded** against the concrete type argument when the class specializes:
+
+```php
+class Registry<T> {
+    public function factory(): Closure(T $value): bool {
+        return fn(int $value): bool => $value > 0;
+    }
+}
+
+new Registry::<int>();     // target grounds to Closure(int): bool — the literal conforms
+new Registry::<string>();  // target grounds to Closure(string): bool — the same literal
+                           //   is now rejected: int is not wider than string
+```
+
+## Union, intersection, and nullable members
+
+A flat union `A|B`, intersection `A&B`, or nullable `?A` inside a signature is
+variance-checked member by member, following PHP's own subtyping:
+
+- a union in a **return** conforms when the literal's return fits **some** member
+  (`Closure(): int|string` accepts a `fn(): int`);
+- a union in a **parameter** requires the literal to accept **every** member
+  (`Closure(int|string $x)` handed `fn(int $x)` fails — the literal can't take a
+  string);
+- an intersection is checked where it is the expected (super) type — a value must
+  satisfy **every** member.
+
+As everywhere, an unprovable member keeps the whole leaf gradual: a union or
+intersection that mentions an unresolved class, a type parameter, or a
+pseudo-type is accepted rather than falsely rejected.
+
+An intersection used as an incoming (parameter) type also stays gradual
+(accepted): an intersection of unrelated types is uninhabited, so rejecting it
+would be unsound.
+
+A **DNF** signature type (a parenthesised mix such as `(A&B)|C`) is accepted in
+every position — parameter, return, nested — and behaves like any other
+unresolvable leaf: it erases with the rest of the signature and stays
+**gradual** (never variance-checked member by member, never the cause of a
+rejection). Arity, by-ref-ness, and the other structured slots around a DNF
+leaf are still checked as usual. Structuring a DNF into variance-checked
+members is a possible future refinement.
+
+An **array-sugar** leaf (`Closure(Item[] $items): int`, `Closure(): int[]`)
+lowers to `array` inside a signature — the same lowering `T[]` gets everywhere
+else in xphp — and participates in conformance as `array` (a gradual leaf, so
+it can only ever widen acceptance; the arity around it is still checked). The
+`Name<Args>[]` combination remains unsupported, in signatures as elsewhere.
+
+## See also
+
+- [Variance](variance.md) — declaration-site `out T` / `in T` class variance:
+  the same "inputs one way, outputs the other" principle, applied to whole
+  specializations via real `extends` edges rather than per-signature.
+- [Closures and arrows](closures-and-arrows.md) — the generic
+  `function<T>(...)` / `fn<T>(...)` forms these signatures describe.
+- [Errors](../errors.md) — the `xphp.closure_conformance` diagnostic.
+- Test fixtures: `test/fixture/check/closure_conformance/`,
+  `test/fixture/compile/closure_conformance_grounded_reject/`.
diff --git a/docs/syntax/closures-and-arrows.md b/docs/syntax/closures-and-arrows.md
index c0ee6d0..f0eb251 100644
--- a/docs/syntax/closures-and-arrows.md
+++ b/docs/syntax/closures-and-arrows.md
@@ -76,6 +76,12 @@ ref-ness is preserved end-to-end.
   dispatcher, including `&` byref captures.
 - The variable receiver stays unchanged at call sites — `$f::<int>(...)`
   becomes `$f('T_<hash>', ...)`, not a renamed call.
+- A **first-class callable** of a specialization (`$g = $f::<int>(...)`)
+  becomes a forwarding closure `fn(...$a) => $f('T_<hash>', ...$a)` that
+  routes through the dispatcher, so `$g` stays a callable with the
+  specialization bound (positional, variadic, and named arguments and the
+  closure's captures are all preserved). Empty-turbofish all-defaults FCCs
+  (`$f::<>(...)`) work the same way.
 
 ## Caveats
 
@@ -87,10 +93,18 @@ ref-ness is preserved end-to-end.
 
 - > ⚠️ **`static` closures rejected** — `static function<T>(...)` is
   rejected because generic static closures can't yet be specialized at
-  the call site (a capability gap, not a binding one). Use a named
-  generic function at file scope instead. See
+  the call site (a capability gap, not a binding one). A `static`
+  **arrow** (`static fn<T>(...)`) specializes like a plain arrow. Use
+  an arrow or a named generic function at file scope instead. See
   [caveats](../caveats.md#static-closures-not-supported).
 
+- > ⚠️ **Declared-but-never-called rejected** — a generic closure that no
+  `$var::<...>(...)` call grounds is a compile error
+  (`xphp.unspecialized_generic_closure`): specialization is call-site
+  driven, so the value would otherwise keep raw type-parameter hints and
+  fatal on first invocation — including when handed away as a plain
+  callable. Call it with a turbofish, or drop the `<...>` clause.
+
 - > ⚠️ **Variance markers not allowed** — `out T` / `in T` are rejected on
   anonymous templates. They have no stable identity for an `extends`
   chain. See [caveats](../caveats.md#variance-markers-are-class-level-only).
diff --git a/docs/syntax/index.md b/docs/syntax/index.md
index 9eec30c..b16e61e 100644
--- a/docs/syntax/index.md
+++ b/docs/syntax/index.md
@@ -15,6 +15,7 @@ first.
 | [Classes and interfaces](classes-and-interfaces.md) | `class Box<T> {}`, generic interfaces and traits, marker-interface runtime behavior |
 | [Methods and functions](methods-and-functions.md) | Generic methods (static + instance), generic free functions, bare top-level |
 | [Closures and arrows](closures-and-arrows.md) | `function<T>(...)`, `fn<T>(...) => ...`, captures incl. by-ref |
+| [Closure types](closure-types.md) | `Closure(int $x): bool` signature types, erasure to `\Closure`, return-position conformance |
 | [Type bounds](type-bounds.md) | `T : Stringable`, `T : A & B`, `T : (A & B) \| C`, F-bounded `T : Box<T>` |
 | [Variance](variance.md) | `out T`, `in T`, position rules, subtype edges between specializations |
 | [Defaults](defaults.md) | `T = int`, forward refs `Pair<A, B = A>`, empty turbofish `$f::<>()` |
diff --git a/docs/syntax/turbofish.md b/docs/syntax/turbofish.md
index b7b3c46..36f4b6b 100644
--- a/docs/syntax/turbofish.md
+++ b/docs/syntax/turbofish.md
@@ -70,6 +70,15 @@ $id('T_<hash-of-int>', 42);
   scanner requires `::<` to be adjacent.
 - **Anchored to a name**: `Foo<T>(...)` (no `::`) is a PHP-side
   ambiguity (`Foo < T` could be comparison) and is rejected.
+- **The method name must be a literal.** A turbofish on a
+  *dynamically-named* method or static call — `$o->$m::<int>()`, the
+  nullsafe `$o?->$m::<int>()`, the static `Foo::$m::<int>()`, or a
+  variable-variable `$$g::<int>()` — is **rejected** with a diagnostic:
+  the specialized method name cannot be resolved from a value known only
+  at runtime. The name may be any literal identifier, **including a PHP
+  keyword** — `$o->list::<int>()`, `Foo::print::<int>()`, and the
+  matching declaration `public function list<T>(...)` all work, since PHP
+  permits keywords as method names.
 - All call-site shapes can carry empty turbofish `::<>` when the
   template is all-defaulted.
 - Bare `new Foo;` (no `(` or `::<>`) also works for all-defaulted
diff --git a/infection.json5 b/infection.json5
index 64ad07e..d693e6f 100644
--- a/infection.json5
+++ b/infection.json5
@@ -45,7 +45,11 @@
                 "XPHP\\FileSystem\\FilepathArray::__construct",
                 "XPHP\\FileSystem\\FilepathArray::filter",
                 "XPHP\\Transpiler\\Monomorphize\\BoundIntersection::__construct",
-                "XPHP\\Transpiler\\Monomorphize\\BoundUnion::__construct"
+                "XPHP\\Transpiler\\Monomorphize\\BoundUnion::__construct",
+                // ClosureLiteralSignature::extract: array_map over php-parser's
+                // already-0-indexed params list — the wrapper exists purely to
+                // prove list-ness to PHPStan; unwrapping it is a no-op.
+                "XPHP\\Transpiler\\Monomorphize\\ClosureLiteralSignature::extract"
             ]
         },
 
diff --git a/src/Transpiler/Monomorphize/CallSiteRewriter.php b/src/Transpiler/Monomorphize/CallSiteRewriter.php
index 8528512..01d5a79 100644
--- a/src/Transpiler/Monomorphize/CallSiteRewriter.php
+++ b/src/Transpiler/Monomorphize/CallSiteRewriter.php
@@ -46,7 +46,11 @@ public function __construct(private Registry $registry)
 
             public function leaveNode(Node $node): Node|int|null
             {
-                if ($node instanceof Name && !$node instanceof FullyQualified) {
+                // Fully-qualified names are admitted too: `new \App\Box::<int>` /
+                // `\App\Box<int>` carry the same attributes and must rewrite to the
+                // specialization — skipping them would silently leave the call site
+                // pointing at the stripped marker interface.
+                if ($node instanceof Name) {
                     $args = $node->getAttribute(XphpSourceParser::ATTR_GENERIC_ARGS);
                     $fqn = $node->getAttribute(XphpSourceParser::ATTR_TEMPLATE_FQN);
                     // Empty `$args` is the call-site shape that asks the registry to pad
@@ -57,7 +61,16 @@ public function leaveNode(Node $node): Node|int|null
                         /** @var list<TypeRef> $args — set as a list by XphpSourceParser::resolveAndAttach. */
                         if (is_string($fqn) && self::allConcrete($args)) {
                             $instantiation = $this->registry->recordInstantiation($fqn, $args);
-                            return new FullyQualified($instantiation->generatedFqn, $node->getAttributes());
+                            // Drop the generic attributes from the replacement: the
+                            // FullyQualified result re-enters this branch on the
+                            // Phase-3.5 re-rewrite of specialized ASTs, so the
+                            // rewrite must be idempotent by construction.
+                            $attributes = $node->getAttributes();
+                            unset(
+                                $attributes[XphpSourceParser::ATTR_GENERIC_ARGS],
+                                $attributes[XphpSourceParser::ATTR_TEMPLATE_FQN],
+                            );
+                            return new FullyQualified($instantiation->generatedFqn, $attributes);
                         }
                     }
                 }
diff --git a/src/Transpiler/Monomorphize/ClosureConformanceValidator.php b/src/Transpiler/Monomorphize/ClosureConformanceValidator.php
new file mode 100644
index 0000000..f83de35
--- /dev/null
+++ b/src/Transpiler/Monomorphize/ClosureConformanceValidator.php
@@ -0,0 +1,203 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+use PhpParser\Node;
+use PhpParser\Node\Expr\ArrowFunction;
+use PhpParser\Node\Expr\Closure;
+use PhpParser\Node\Name;
+use PhpParser\Node\NullableType;
+use PhpParser\Node\Stmt\ClassMethod;
+use PhpParser\Node\Stmt\Function_;
+use PhpParser\Node\Stmt\Namespace_;
+use PhpParser\Node\Stmt\Return_;
+use PhpParser\Node\Stmt\Use_;
+use PhpParser\NodeTraverser;
+use PhpParser\NodeVisitorAbstract;
+use RuntimeException;
+use XPHP\Diagnostics\Diagnostic;
+use XPHP\Diagnostics\DiagnosticCollector;
+use XPHP\Diagnostics\Severity;
+use XPHP\Diagnostics\SourceLocation;
+
+/**
+ * Wires {@see ClosureSignatureConformance} to the source site where a closure
+ * LITERAL statically meets a `Closure(...)` target type, and turns a returned
+ * {@see ClosureConformanceViolation} into a diagnostic (collect) or a
+ * {@see RuntimeException} (throw). Nothing runtime is emitted — the check is a
+ * compile-time gate; the `Closure(...)` type has already been erased to
+ * `\Closure` by the parser.
+ *
+ * The one statically decidable site is the **return position** (a factory that
+ * declares a `Closure(...)` return and hands back a closure literal):
+ *
+ *  - `return <literal>;` inside a function / method / closure whose return type
+ *    is `Closure(...)` — paired with the innermost enclosing function-like.
+ *  - an arrow function `fn(...): Closure(...) => <literal>` whose body IS the
+ *    literal (arrows have no `Return_` node).
+ *
+ * A parameter/property *default* is deliberately NOT a site: PHP requires a
+ * default to be a constant expression, and a closure literal is not one, so a
+ * `Closure(...)`-typed default can never hold a literal candidate. Other value
+ * flows (a variable assigned then passed, a call argument, a property assignment)
+ * leave the candidate non-literal at the target, so the model stays gradual
+ * (accept). A target that references an enclosing type parameter is checked with
+ * those leaves still abstract here (⇒ gradual); the grounded per-specialization
+ * re-check happens later in the pipeline.
+ */
+final class ClosureConformanceValidator
+{
+    /** Diagnostic code for a closure literal that provably violates its `Closure(...)` target. */
+    public const CODE = 'xphp.closure_conformance';
+
+    private readonly ClosureSignatureConformance $engine;
+
+    public function __construct(TypeHierarchy $hierarchy)
+    {
+        $this->engine = new ClosureSignatureConformance($hierarchy);
+    }
+
+    /**
+     * Validate one source file's AST. With a {@see DiagnosticCollector} every
+     * violation is collected (the `xphp check` path); without one the first
+     * violation throws (the fail-fast `compile` path).
+     *
+     * @param list<Node\Stmt> $ast
+     */
+    public function validateFile(array $ast, string $file, ?DiagnosticCollector $diagnostics): void
+    {
+        // A fresh context is already global-scope (no namespace, no uses); a
+        // `namespace` node encountered during the walk re-scopes it.
+        $ctx = new NamespaceContext();
+        $traverser = new NodeTraverser();
+        $traverser->addVisitor($this->buildVisitor($ctx, $file, $diagnostics));
+        $traverser->traverse($ast);
+    }
+
+    /**
+     * The resolved {@see ClosureSignature} a type node carries as its target, or
+     * null when the node is not a `Closure(...)` type. A `?Closure(...)` tags the
+     * inner {@see Name}, so a nullable wrapper is unwrapped first.
+     */
+    public static function closureSigOf(?Node $type): ?ClosureSignature
+    {
+        if ($type instanceof NullableType) {
+            $type = $type->type;
+        }
+        if ($type instanceof Name) {
+            $sig = $type->getAttribute(XphpSourceParser::ATTR_CLOSURE_SIG);
+            return $sig instanceof ClosureSignature ? $sig : null;
+        }
+        return null;
+    }
+
+    /**
+     * Whether an expression is a closure literal — the only candidate shape this
+     * validator can extract a signature from. A first-class callable
+     * (`foo(...)`) is a `*Call` node, not a {@see Closure}, so it is not a literal.
+     *
+     * @phpstan-assert-if-true Closure|ArrowFunction $node
+     */
+    private static function isLiteral(?Node $node): bool
+    {
+        return $node instanceof Closure || $node instanceof ArrowFunction;
+    }
+
+    /**
+     * Check the returned expression against its `Closure(...)` return target and
+     * report the first violation (throw or collect). A non-literal expression is
+     * not a candidate (a variable, a call, a property fetch) — it stays gradual
+     * and is silently skipped here.
+     */
+    public function checkLiteral(
+        ClosureSignature $target,
+        Node\Expr $literal,
+        NamespaceContext $ctx,
+        string $file,
+        ?DiagnosticCollector $diagnostics,
+    ): void {
+        if (!self::isLiteral($literal)) {
+            return;
+        }
+        $candidate = ClosureLiteralSignature::extract($literal, $ctx);
+        $violation = $this->engine->check($candidate, $target);
+        if ($violation === null) {
+            return;
+        }
+
+        $message = self::message($violation);
+        if ($diagnostics === null) {
+            throw new RuntimeException($message);
+        }
+        $diagnostics->add(new Diagnostic(
+            Severity::Error,
+            self::CODE,
+            $message,
+            new SourceLocation($file, $literal->getStartLine()),
+        ));
+    }
+
+    private static function message(ClosureConformanceViolation $violation): string
+    {
+        return 'Closure literal does not conform to the declared `Closure(...)` type: ' . $violation->detail;
+    }
+
+    private function buildVisitor(NamespaceContext $ctx, string $file, ?DiagnosticCollector $diagnostics): NodeVisitorAbstract
+    {
+        return new class($this, $ctx, $file, $diagnostics) extends NodeVisitorAbstract {
+            /**
+             * The `Closure(...)` return target of each enclosing function-like that
+             * can hold `return` statements, innermost last. An arrow function has no
+             * `return` body, so it never pushes a frame.
+             *
+             * @var list<?ClosureSignature>
+             */
+            private array $returnTargets = [];
+
+            public function __construct(
+                private readonly ClosureConformanceValidator $validator,
+                private readonly NamespaceContext $ctx,
+                private readonly string $file,
+                private readonly ?DiagnosticCollector $diagnostics,
+            ) {
+            }
+
+            public function enterNode(Node $node): null
+            {
+                if ($node instanceof Namespace_) {
+                    $this->ctx->enterNamespace($node->name?->toString());
+                } elseif ($node instanceof Use_) {
+                    $this->ctx->indexUse($node);
+                } elseif ($node instanceof Function_ || $node instanceof ClassMethod || $node instanceof Closure) {
+                    $this->returnTargets[] = ClosureConformanceValidator::closureSigOf($node->returnType);
+                } elseif ($node instanceof ArrowFunction) {
+                    // Arrow body: the body expression IS the returned value.
+                    $target = ClosureConformanceValidator::closureSigOf($node->returnType);
+                    if ($target !== null) {
+                        $this->validator->checkLiteral($target, $node->expr, $this->ctx, $this->file, $this->diagnostics);
+                    }
+                } elseif ($node instanceof Return_) {
+                    // Return position: the literal is the returned value of the
+                    // innermost enclosing function-like.
+                    $target = $this->returnTargets === [] ? null : $this->returnTargets[count($this->returnTargets) - 1];
+                    if ($target !== null && $node->expr !== null) {
+                        $this->validator->checkLiteral($target, $node->expr, $this->ctx, $this->file, $this->diagnostics);
+                    }
+                }
+
+                return null;
+            }
+
+            public function leaveNode(Node $node): null
+            {
+                if ($node instanceof Function_ || $node instanceof ClassMethod || $node instanceof Closure) {
+                    array_pop($this->returnTargets);
+                }
+
+                return null;
+            }
+        };
+    }
+}
diff --git a/src/Transpiler/Monomorphize/ClosureConformanceViolation.php b/src/Transpiler/Monomorphize/ClosureConformanceViolation.php
new file mode 100644
index 0000000..1e1f3ab
--- /dev/null
+++ b/src/Transpiler/Monomorphize/ClosureConformanceViolation.php
@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+/**
+ * A single, provable way a candidate closure signature fails to conform to a
+ * target `Closure(...)` type — the result of {@see ClosureSignatureConformance}.
+ *
+ * The engine returns one of these (or null, meaning "conforms, or the mismatch
+ * is not provable and is therefore gradually accepted") purely as data; the
+ * {@see ClosureConformanceValidator} turns it into a diagnostic message with the
+ * source-site context prepended. `$detail` is the reason clause only.
+ */
+final readonly class ClosureConformanceViolation
+{
+    public const KIND_ARITY_TOO_FEW = 'arity_too_few';
+    public const KIND_ARITY_REQUIRES_MORE = 'arity_requires_more';
+    public const KIND_VARIADIC_REQUIRED = 'variadic_required';
+    public const KIND_BYREF = 'byref';
+    public const KIND_PARAM_TYPE = 'param_type';
+    public const KIND_RETURN_TYPE = 'return_type';
+
+    public function __construct(
+        public string $kind,
+        public string $detail,
+    ) {
+    }
+}
diff --git a/src/Transpiler/Monomorphize/ClosureLiteralSignature.php b/src/Transpiler/Monomorphize/ClosureLiteralSignature.php
new file mode 100644
index 0000000..8c3fb85
--- /dev/null
+++ b/src/Transpiler/Monomorphize/ClosureLiteralSignature.php
@@ -0,0 +1,183 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+use PhpParser\Node;
+use PhpParser\Node\Expr\ArrowFunction;
+use PhpParser\Node\Expr\Closure;
+use PhpParser\Node\Identifier;
+use PhpParser\Node\IntersectionType;
+use PhpParser\Node\Name;
+use PhpParser\Node\NullableType;
+use PhpParser\Node\Param;
+use PhpParser\Node\UnionType;
+
+/**
+ * Extracts the {@see ClosureSignature} a closure LITERAL (`fn` / `function`)
+ * actually declares, so {@see ClosureSignatureConformance} can check it against a
+ * `Closure(...)` target. The candidate types are resolved to the same FQN /
+ * scalar space the parser resolved the target's types into, using the enclosing
+ * file's {@see NamespaceContext}.
+ *
+ * Gradual by construction: an untyped parameter becomes `mixed` (the top type,
+ * always conforms), an absent return stays absent (gradual), and a leaf the
+ * splitter can't structure is carried as {@see SigRaw} (gradual) — so
+ * extraction never manufactures a false mismatch.
+ */
+final class ClosureLiteralSignature
+{
+    public static function extract(Closure|ArrowFunction $literal, NamespaceContext $ctx): ClosureSignature
+    {
+        $params = array_values(array_map(
+            static fn (Param $p): ClosureSignatureParam => new ClosureSignatureParam(
+                self::resolveParamType($p->type, $ctx),
+                $p->byRef,
+                $p->variadic,
+                $p->default !== null,
+            ),
+            $literal->params,
+        ));
+
+        // Candidate closures are never nullable (a `?Closure` is a target concept);
+        // the flag defaults false and is not read for a candidate.
+        return new ClosureSignature($params, self::resolveType($literal->returnType, $ctx));
+    }
+
+    /**
+     * A parameter always has a type slot: an untyped parameter is `mixed` (the
+     * top type — always conforms under contravariance).
+     */
+    private static function resolveParamType(?Node $type, NamespaceContext $ctx): SigType
+    {
+        // No isScalar flag: the engine classifies `mixed` by name (as gradual),
+        // so the flag would be dead here.
+        return self::resolveType($type, $ctx) ?? new SigTypeRef(new TypeRef('mixed'));
+    }
+
+    /**
+     * Resolve a nikic type node to a {@see SigType}, or null when the slot is
+     * absent (an untyped return ⇒ gradual). A compound type (`?X`, union,
+     * intersection) is carried raw.
+     */
+    private static function resolveType(?Node $type, NamespaceContext $ctx): ?SigType
+    {
+        // @infection-ignore-all — removing this early return is equivalent: a null
+        // node matches none of the branches below and falls through to the same
+        // bottom `return null`.
+        if ($type === null) {
+            return null;
+        }
+        // `?A` ≡ `A|null`: a union of the inner type and the `null` leaf.
+        if ($type instanceof NullableType) {
+            $inner = self::resolveType($type->type, $ctx);
+            if ($inner === null) {
+                return new SigRaw(self::rawText($type));
+            }
+            return new SigUnion([$inner, new SigTypeRef(new TypeRef('null', [], isScalar: true))]);
+        }
+        if ($type instanceof UnionType) {
+            return self::resolveUnion($type, $ctx);
+        }
+        if ($type instanceof IntersectionType) {
+            return self::resolveIntersection($type, $ctx);
+        }
+        // @infection-ignore-all — a param/return type node is only ever null, a
+        // compound (handled above), or a simple Identifier/Name, so the negated
+        // predicate is unreachable-different: nothing else reaches this line.
+        if ($type instanceof Identifier || $type instanceof Name) {
+            // A relative `namespace\Foo` binds to the CURRENT namespace by PHP's
+            // rules — never to a `use` alias. toString() erases the `namespace\`
+            // prefix, so routing it through the alias-aware resolver would let a
+            // colliding `use Other\Foo` capture it and FALSE-REJECT a conforming
+            // literal. Resolve it against the namespace directly.
+            if ($type instanceof Name && $type->isRelative()) {
+                $ns = $ctx->currentNamespace();
+                return new SigTypeRef(new TypeRef(
+                    $ns === '' ? $type->toString() : $ns . '\\' . $type->toString(),
+                ));
+            }
+            // A fully-qualified `\App\Foo` must keep its leading `\` so the
+            // resolver treats it as absolute — toString() strips it, and the
+            // name would mis-resolve relative to the current namespace (a
+            // silent over-accept via the undeclared-class gradual path).
+            $name = $type instanceof Name && $type->isFullyQualified()
+                ? $type->toCodeString()
+                : $type->toString();
+            // @infection-ignore-all UnwrapStrToLower is killed by a capital-cased
+            // scalar test; the case-fold is load-bearing (`Int` ⇒ `int`).
+            $lower = strtolower($name);
+            if (in_array($lower, XphpSourceParser::SCALAR_TYPES, true)) {
+                return new SigTypeRef(new TypeRef($lower, [], isScalar: true));
+            }
+            return new SigTypeRef(new TypeRef($ctx->resolveAgainstContext($name)));
+        }
+        // An unrecognized type-node shape (should not occur for a well-formed
+        // literal) is treated as absent ⇒ gradual, never a false mismatch.
+        return null;
+    }
+
+    /**
+     * Structure a `A|B` (possibly with a DNF `(A&B)` member, which nikic nests as
+     * an `IntersectionType` inside the union) into a {@see SigUnion}. If any member
+     * fails to resolve, the whole leaf falls back to a gradual {@see SigRaw} — never
+     * a partially-structured union that could false-decide.
+     */
+    private static function resolveUnion(UnionType $type, NamespaceContext $ctx): SigType
+    {
+        $members = [];
+        foreach ($type->types as $member) {
+            $resolved = self::resolveType($member, $ctx);
+            if ($resolved === null) {
+                return new SigRaw(self::rawText($type));
+            }
+            $members[] = $resolved;
+        }
+        return new SigUnion($members);
+    }
+
+    /**
+     * Structure an `A&B` into a {@see SigIntersection}. A member that fails to
+     * resolve, or a **scalar** member (PHP forbids scalars in an intersection, so it
+     * can only come from already-invalid source), falls the whole leaf back to a
+     * gradual {@see SigRaw}.
+     */
+    private static function resolveIntersection(IntersectionType $type, NamespaceContext $ctx): SigType
+    {
+        $members = [];
+        foreach ($type->types as $member) {
+            $resolved = self::resolveType($member, $ctx);
+            if ($resolved === null || ($resolved instanceof SigTypeRef && $resolved->type->isScalar)) {
+                return new SigRaw(self::rawText($type));
+            }
+            $members[] = $resolved;
+        }
+        return new SigIntersection($members);
+    }
+
+    /**
+     * A readable rendering of a compound type for the raw leaf.
+     *
+     * @infection-ignore-all — display-only: a SigRaw leaf is always accepted
+     * gradually, so this text never surfaces in a diagnostic; and each
+     * union/intersection member is a plain Name/Identifier that renders as itself,
+     * so the array_map is equivalent to a direct implode.
+     */
+    private static function rawText(Node $type): string
+    {
+        if ($type instanceof NullableType) {
+            return '?' . self::rawText($type->type);
+        }
+        if ($type instanceof UnionType) {
+            return implode('|', array_map(self::rawText(...), $type->types));
+        }
+        if ($type instanceof IntersectionType) {
+            return implode('&', array_map(self::rawText(...), $type->types));
+        }
+        if ($type instanceof Identifier || $type instanceof Name) {
+            return $type->toString();
+        }
+        return '?';
+    }
+}
diff --git a/src/Transpiler/Monomorphize/ClosureSignature.php b/src/Transpiler/Monomorphize/ClosureSignature.php
new file mode 100644
index 0000000..598785b
--- /dev/null
+++ b/src/Transpiler/Monomorphize/ClosureSignature.php
@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+/**
+ * A parsed closure signature type — `Closure(int $x, string ...$rest): bool` — as
+ * it appears in a parameter, return, or property type position. Erased to a bare
+ * `\Closure` in the emitted PHP; the parsed shape is carried as an AST attribute
+ * ({@see XphpSourceParser::ATTR_CLOSURE_SIG}) purely so the compile-time
+ * conformance validator can read it.
+ *
+ * A `?Closure(...)` sets {@see $nullable}. An ABSENT return type is represented as
+ * `$return === null`, kept distinct from an explicit `: mixed`: both accept any
+ * candidate return, but the distinction (absent = gradual on the candidate side)
+ * matters to the conformance rules.
+ */
+final readonly class ClosureSignature
+{
+    /**
+     * @param list<ClosureSignatureParam> $params In source order. A variadic
+     *        parameter, if present, is always the last (enforced at parse time).
+     */
+    public function __construct(
+        public array $params,
+        public ?SigType $return,
+        public bool $nullable = false,
+    ) {
+    }
+}
diff --git a/src/Transpiler/Monomorphize/ClosureSignatureConformance.php b/src/Transpiler/Monomorphize/ClosureSignatureConformance.php
new file mode 100644
index 0000000..037a45c
--- /dev/null
+++ b/src/Transpiler/Monomorphize/ClosureSignatureConformance.php
@@ -0,0 +1,409 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+/**
+ * Decides whether a candidate closure signature conforms to a target
+ * `Closure(...)` type, using the same variance the engine enforces for an
+ * inherited method against its prototype (RFC §2.4): parameters contravariant,
+ * return covariant, by-reference exact, arity compatible.
+ *
+ * The check is one-directional: it only ever reports a *provable* violation.
+ * Anything unproven — an unresolved class, a still-abstract type parameter, an
+ * untyped (⇒ `mixed`) leaf, a not-yet-structured union/intersection ({@see
+ * SigRaw}), a pseudo-type the leaf table does not decide — is accepted. This
+ * mirrors the RFC's runtime leniency ("lenient while unresolved, decide when
+ * provable, never falsely reject") and, for the static model, keeps a build from
+ * failing on code a stricter analyzer could not prove wrong.
+ *
+ * Pure: no I/O, no diagnostics. {@see ClosureConformanceValidator} wires it to
+ * source sites and turns a returned {@see ClosureConformanceViolation} into a
+ * diagnostic.
+ */
+final readonly class ClosureSignatureConformance
+{
+    /**
+     * The four *true* scalar type names. `true`/`false` are normalized to `bool`
+     * before comparison. These are the only leaves whose mismatch (by name) is a
+     * provable violation on its own.
+     */
+    private const TRUE_SCALARS = ['int', 'string', 'float', 'bool'];
+
+    /**
+     * Reserved-word leaves that are `isScalar`-flagged (they live in
+     * {@see XphpSourceParser::SCALAR_TYPES}) but are NOT true scalars — tops,
+     * bottoms, pseudo-types, and late-static leaves. `TypeHierarchy::isSubtype`
+     * returns a hard `false` for these against a non-equal bound, so routing them
+     * through it would false-reject; the engine treats them as gradual (accept).
+     */
+    private const GRADUAL_LEAVES = [
+        'mixed', 'object', 'void', 'never', 'null',
+        'array', 'iterable', 'callable', 'self', 'static', 'parent',
+    ];
+
+    public function __construct(private TypeHierarchy $hierarchy)
+    {
+    }
+
+    /**
+     * Structural conformance only — arity and by-reference. These rules are
+     * independent of how any type parameter grounds, so they can be checked once
+     * at an abstract generic template. Returns the first violation or null.
+     */
+    public function checkStructural(ClosureSignature $candidate, ClosureSignature $target): ?ClosureConformanceViolation
+    {
+        return $this->structural($candidate, $target);
+    }
+
+    /**
+     * Full conformance — structural plus the contravariant-parameter /
+     * covariant-return leaf relations. Returns the first violation or null
+     * (conforms, or the mismatch is not provable ⇒ gradually accepted).
+     */
+    public function check(ClosureSignature $candidate, ClosureSignature $target): ?ClosureConformanceViolation
+    {
+        $structural = $this->structural($candidate, $target);
+        if ($structural !== null) {
+            return $structural;
+        }
+
+        // Parameters: contravariant. Each candidate parameter must be the same as
+        // or WIDER than the target's — i.e. the target's type must be a subtype of
+        // the candidate's. Only positions the target defines are constrained.
+        $targetParams = $target->params;
+        $candidateParams = $candidate->params;
+        foreach ($targetParams as $i => $targetParam) {
+            $candidateParam = $candidateParams[$i]
+                ?? $this->variadicTailOf($candidateParams);
+            if ($candidateParam === null) {
+                continue;
+            }
+            if ($this->provablyNotSubtype($targetParam->type, $candidateParam->type)) {
+                return new ClosureConformanceViolation(
+                    ClosureConformanceViolation::KIND_PARAM_TYPE,
+                    sprintf(
+                        'parameter %d: %s is not wider than %s',
+                        $i + 1,
+                        self::display($candidateParam->type),
+                        self::display($targetParam->type),
+                    ),
+                );
+            }
+        }
+
+        // Return: covariant. The candidate's return must be the same as or
+        // NARROWER than the target's — candidate return must be a subtype of the
+        // target return. An absent return on either side is gradual (top).
+        if ($candidate->return !== null && $target->return !== null
+            && $this->provablyNotSubtype($candidate->return, $target->return)
+        ) {
+            return new ClosureConformanceViolation(
+                ClosureConformanceViolation::KIND_RETURN_TYPE,
+                sprintf(
+                    'return type: %s is not a subtype of %s',
+                    self::display($candidate->return),
+                    self::display($target->return),
+                ),
+            );
+        }
+
+        return null;
+    }
+
+    private function structural(ClosureSignature $candidate, ClosureSignature $target): ?ClosureConformanceViolation
+    {
+        $targetRequired = self::requiredArity($target);
+        $candidateHasVariadic = self::hasVariadic($candidate);
+        $candidateMax = $candidateHasVariadic ? PHP_INT_MAX : count($candidate->params);
+        $candidateRequired = self::requiredArity($candidate);
+
+        // Too few: the candidate cannot accept every argument the target requires.
+        if ($candidateMax < $targetRequired) {
+            return new ClosureConformanceViolation(
+                ClosureConformanceViolation::KIND_ARITY_TOO_FEW,
+                sprintf('expects at least %d parameter(s), candidate accepts at most %d', $targetRequired, $candidateMax),
+            );
+        }
+
+        // Requires too many: the candidate demands arguments the target does not
+        // guarantee (a legal minimal call on the target would under-supply it).
+        if ($candidateRequired > $targetRequired) {
+            return new ClosureConformanceViolation(
+                ClosureConformanceViolation::KIND_ARITY_REQUIRES_MORE,
+                sprintf('requires %d parameter(s) but the target guarantees only %d', $candidateRequired, $targetRequired),
+            );
+        }
+
+        // A variadic target may pass unboundedly many arguments; only a variadic
+        // candidate can absorb them.
+        if (self::hasVariadic($target) && !$candidateHasVariadic) {
+            return new ClosureConformanceViolation(
+                ClosureConformanceViolation::KIND_VARIADIC_REQUIRED,
+                'target is variadic; candidate must declare a variadic parameter to absorb the tail',
+            );
+        }
+
+        // By-reference: exact, per position the target defines.
+        foreach ($target->params as $i => $targetParam) {
+            $candidateParam = $candidate->params[$i] ?? self::variadicTailOf($candidate->params);
+            if ($candidateParam === null) {
+                continue;
+            }
+            if ($candidateParam->byRef !== $targetParam->byRef) {
+                return new ClosureConformanceViolation(
+                    ClosureConformanceViolation::KIND_BYREF,
+                    sprintf(
+                        'parameter %d: by-reference-ness must match exactly (target %s, candidate %s)',
+                        $i + 1,
+                        $targetParam->byRef ? 'by-ref' : 'by-value',
+                        $candidateParam->byRef ? 'by-ref' : 'by-value',
+                    ),
+                );
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * True only when it is *provable* that `$sub` is not a subtype of `$super`
+     * (⇒ a violation). Every unproven or gradual case returns false (accept).
+     *
+     * A nested closure leaf ({@see SigClosure}) recurses: `$sub`'s params must be
+     * contravariant and its return covariant relative to `$super` — i.e. `$sub`
+     * conforms as a candidate to `$super` as a target.
+     */
+    private function provablyNotSubtype(SigType $sub, SigType $super): bool
+    {
+        // A raw (unstructured) leaf on either side stays gradual — a target-side DNF
+        // `(A&B)|C`, an unresolved member, or an intersection carrying a scalar all
+        // fall back to SigRaw and are accepted here.
+        // @infection-ignore-all LogicalOr ReturnRemoval — equivalent: a SigRaw on
+        // either side yields false down EVERY downstream path anyway (the compound
+        // arms recurse to leaf pairings; a raw against a leaf bottoms out at the
+        // defensive non-SigTypeRef guard, against a closure super at the
+        // closure-vs-leaf mismatch — all false). The early return only states the
+        // gradual rule directly; the accept BEHAVIOUR is pinned by the DNF-group
+        // and raw-leaf accept tests.
+        if ($sub instanceof SigRaw || $super instanceof SigRaw) {
+            return false;
+        }
+
+        // ---- Compound leaves. Decompose the SUB side FIRST: doing the super side
+        // first would false-reject `int|string <: string|int` (the resulting
+        // `∧ᵥ∨ᵤ` over-approximates the sound `∨ᵤ∧ᵥ`). ----
+
+        // sub = union: `A|B <: Y` ⟺ EVERY member <: Y ⇒ provably-not iff SOME member is.
+        if ($sub instanceof SigUnion) {
+            foreach ($sub->members as $member) {
+                if ($this->provablyNotSubtype($member, $super)) {
+                    return true;
+                }
+            }
+            return false;
+        }
+
+        // sub = intersection: soundly `A&B <: Y` ⟺ `A<:Y ∨ B<:Y`, but an intersection
+        // of incompatible members is uninhabited (`never`, a subtype of everything)
+        // and there is no inhabitation check here — decomposing would false-reject.
+        // Kept gradual; the inhabited-intersection reject is a tracked follow-up.
+        // @infection-ignore-all — equivalent: a SigIntersection sub yields false down
+        // EVERY downstream path anyway. A leaf super reaches the defensive non-SigTypeRef
+        // guard below (false); a closure super resolves false at the closure-vs-leaf branch
+        // (the intersection sub is no SigClosure); a compound super's arms recurse on this
+        // same SigIntersection sub against each leaf member, and each of those recursions
+        // bottoms out at one of those false results, so the union AND / intersection OR both
+        // resolve to false too. The explicit early return only states the rule directly.
+        // The accept BEHAVIOUR is pinned by the sub-intersection accept tests.
+        if ($sub instanceof SigIntersection) {
+            return false;
+        }
+
+        // super = union: `X <: A|B` ⟺ X <: SOME member ⇒ provably-not iff vs EVERY member.
+        if ($super instanceof SigUnion) {
+            foreach ($super->members as $member) {
+                if (!$this->provablyNotSubtype($sub, $member)) {
+                    return false;
+                }
+            }
+            return true;
+        }
+
+        // super = intersection: `X <: A&B` ⟺ X <: EVERY member ⇒ provably-not iff vs SOME.
+        if ($super instanceof SigIntersection) {
+            foreach ($super->members as $member) {
+                if ($this->provablyNotSubtype($sub, $member)) {
+                    return true;
+                }
+            }
+            // @infection-ignore-all — no member proved a violation; the defensive
+            // non-SigTypeRef guard below returns the same false for this SigIntersection
+            // super, so removing this explicit gradual return is equivalent.
+            return false;
+        }
+
+        if ($sub instanceof SigClosure && $super instanceof SigClosure) {
+            return $this->check($sub->signature, $super->signature) !== null;
+        }
+
+        // A closure vs. a plain leaf: a closure value is provably not a true
+        // scalar; anything else (object / callable / Closure / a class / gradual)
+        // is accepted.
+        if ($sub instanceof SigClosure || $super instanceof SigClosure) {
+            $leaf = $sub instanceof SigTypeRef ? $sub : ($super instanceof SigTypeRef ? $super : null);
+            return $leaf !== null && $this->classify($leaf->type) === 'scalar';
+        }
+
+        // @infection-ignore-all — defensive: SigRaw, every compound (union/
+        // intersection), and both SigClosure cases are handled above, so by here
+        // both operands are always SigTypeRef; this guard never fires.
+        if (!$sub instanceof SigTypeRef || !$super instanceof SigTypeRef) {
+            return false;
+        }
+
+        $subKind = $this->classify($sub->type);
+        $superKind = $this->classify($super->type);
+
+        if ($subKind === 'gradual' || $superKind === 'gradual') {
+            return false;
+        }
+        // @infection-ignore-all — the `&& scalar` second operand is equivalent: a
+        // scalar-vs-class pair falls through to the mixed-kind `return true` below
+        // with the identical verdict, so weakening this conjunction changes nothing.
+        if ($subKind === 'scalar' && $superKind === 'scalar') {
+            return self::normalizeScalar($sub->type->name) !== self::normalizeScalar($super->type->name);
+        }
+        if ($subKind === 'class' && $superKind === 'class') {
+            // Provable only when BOTH classes are known to the hierarchy:
+            //  - An undeclared class on either side leaves the relation unprovable;
+            //    `isSubtype(knownChild, undeclaredParent)` returns a hard `false`
+            //    (the BFS never reaches the unknown), which must NOT read as a
+            //    proven non-subtype or out-of-source code would be false-rejected.
+            if (!$this->hierarchy->isDeclared($sub->type->name)
+                || !$this->hierarchy->isDeclared($super->type->name)
+            ) {
+                return false;
+            }
+            // A BUILT-IN target is normally unprovable-as-`false`: the hierarchy
+            // models only ancestor edges scanned from source, so `isSubtype`
+            // returns `false` for a real relation like `Exception <: Throwable`
+            // (or any user class whose ancestry passes through a built-in).
+            // EXCEPTION — a candidate whose ENTIRE ancestry is closed-world user
+            // code cannot reach any built-in over unmodeled edges, so `false` IS
+            // a proof there... unless PHP adds the edge implicitly at runtime:
+            //  - `Stringable` is auto-implemented by any class with __toString()
+            //    (methods are not modeled — stay gradual);
+            //  - `UnitEnum` / `BackedEnum` are enum-implicit (enums carry these
+            //    edges explicitly since the collector models them, so their chain
+            //    is never built-in-free — this arm is a safety net).
+            if ($this->hierarchy->isBuiltin($super->type->name)) {
+                // @infection-ignore-all UnwrapLtrim — resolved TypeRef names arrive
+                // backslash-free from resolveAgainstContext on both sides; the trim
+                // is defensive parity with isBuiltin's own normalization.
+                $superName = ltrim($super->type->name, '\\');
+                if (in_array($superName, ['Stringable', 'UnitEnum', 'BackedEnum'], true)
+                    || !$this->hierarchy->hasClosedUserAncestry($sub->type->name)
+                ) {
+                    return false;
+                }
+            }
+            return $this->hierarchy->isSubtype($sub->type->name, $super->type->name) === false;
+        }
+
+        // Mixed scalar-vs-class: a true scalar is provably not a class, and a class
+        // is provably not a scalar.
+        return true;
+    }
+
+    /**
+     * `scalar` (a true scalar), `class` (a resolved user/builtin class name), or
+     * `gradual` (a top/bottom/pseudo/late-static leaf, or a still-abstract type
+     * parameter) — for which no mismatch is ever provable.
+     */
+    private function classify(TypeRef $ref): string
+    {
+        if ($ref->isTypeParam) {
+            return 'gradual';
+        }
+        $name = self::normalizeScalar($ref->name);
+        if (in_array($name, self::TRUE_SCALARS, true)) {
+            return 'scalar';
+        }
+        if (in_array($name, self::GRADUAL_LEAVES, true)) {
+            return 'gradual';
+        }
+        return 'class';
+    }
+
+    private static function normalizeScalar(string $name): string
+    {
+        // @infection-ignore-all — ltrim/strtolower are defensive: closure-sig leaf
+        // TypeRefs arrive already unqualified and lowercased from the resolver, so
+        // dropping either normalization is unobservable for real inputs.
+        $name = strtolower(ltrim($name, '\\'));
+        return $name === 'true' || $name === 'false' ? 'bool' : $name;
+    }
+
+    /**
+     * The number of parameters a signature *requires* — the leading run of
+     * parameters that are neither optional (a candidate literal's defaulted
+     * parameter) nor variadic. A `Closure(...)` type has no defaults, so for a
+     * target this is simply its non-variadic parameter count.
+     */
+    private static function requiredArity(ClosureSignature $sig): int
+    {
+        $count = 0;
+        foreach ($sig->params as $param) {
+            if ($param->variadic || $param->optional) {
+                break;
+            }
+            $count++;
+        }
+        return $count;
+    }
+
+    private static function hasVariadic(ClosureSignature $sig): bool
+    {
+        foreach ($sig->params as $param) {
+            if ($param->variadic) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * The variadic parameter of a list, if the position being matched runs past
+     * the fixed parameters into a variadic tail (which absorbs the rest).
+     *
+     * @param list<ClosureSignatureParam> $params
+     */
+    private static function variadicTailOf(array $params): ?ClosureSignatureParam
+    {
+        foreach ($params as $param) {
+            if ($param->variadic) {
+                return $param;
+            }
+        }
+        return null;
+    }
+
+    private static function display(SigType $type): string
+    {
+        if ($type instanceof SigTypeRef) {
+            return $type->type->toDisplayString();
+        }
+        if ($type instanceof SigClosure) {
+            return 'Closure(...)';
+        }
+        if ($type instanceof SigUnion) {
+            return implode('|', array_map(self::display(...), $type->members));
+        }
+        if ($type instanceof SigIntersection) {
+            return implode('&', array_map(self::display(...), $type->members));
+        }
+        return $type instanceof SigRaw ? $type->raw : '?';
+    }
+}
diff --git a/src/Transpiler/Monomorphize/ClosureSignatureParam.php b/src/Transpiler/Monomorphize/ClosureSignatureParam.php
new file mode 100644
index 0000000..6aa55d8
--- /dev/null
+++ b/src/Transpiler/Monomorphize/ClosureSignatureParam.php
@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+/**
+ * One parameter of a closure signature (see {@see ClosureSignature}).
+ *
+ * The parameter NAME is deliberately not stored: names are insignificant to
+ * conformance and may be omitted; only the structural `&` (by-reference) and
+ * `...` (variadic) markers matter, so those are captured as flags while the name
+ * — if any — is discarded at parse time.
+ *
+ * `$optional` is only ever set on a *candidate* signature extracted from a
+ * closure literal whose parameter has a default (`fn($x = 1) => …`); it lowers
+ * the required arity. A `Closure(...)` TYPE has no defaults, so a target
+ * signature always leaves it false.
+ */
+final readonly class ClosureSignatureParam
+{
+    public function __construct(
+        public SigType $type,
+        public bool $byRef = false,
+        public bool $variadic = false,
+        public bool $optional = false,
+    ) {
+    }
+}
diff --git a/src/Transpiler/Monomorphize/Compiler.php b/src/Transpiler/Monomorphize/Compiler.php
index 8f33b64..15bc427 100644
--- a/src/Transpiler/Monomorphize/Compiler.php
+++ b/src/Transpiler/Monomorphize/Compiler.php
@@ -119,6 +119,16 @@ public function compile(
         // Container's slot is invariant) fail here BEFORE instantiations
         // amplify the error.
         $registry->validateInnerVariance();
+        // Closure-signature conformance at the statically-visible literal site (a
+        // `return`/arrow body whose declared return type is `Closure(...)`).
+        // Fail-fast in compile mode (null collector ⇒ throw on the first provable
+        // mismatch), matching the other source-level gates. A target that
+        // references an enclosing type parameter is checked with those leaves
+        // still abstract here (⇒ gradually accepted).
+        $closureValidator = new ClosureConformanceValidator($hierarchy);
+        foreach ($astPerFile as $filepath => $ast) {
+            $closureValidator->validateFile($ast, $filepath, null);
+        }
         foreach ($astPerFile as $filepath => $ast) {
             $collector->collectInstantiations($ast, $filepath);
         }
@@ -178,6 +188,28 @@ public function compile(
             }
         }
 
+        // Phase 2.3: re-qualify free-function calls and const fetches in every specialization
+        // produced by the fixed-point loop. Each body was relocated out of its origin namespace
+        // into XPHP\Generated\…, where an unqualified `helper()` / `FOO` would otherwise rebind
+        // against the generated namespace and fatal. The guard only qualifies symbols the unit
+        // defines. (Members appended later by the covariant-upcast gap-fill are swept in Phase 3.5,
+        // since they don't exist yet here.)
+        foreach ($specializedAsts as $classAst) {
+            Specializer::requalifyFreeSymbols($classAst, $registry);
+        }
+
+        // Phase 2.4: grounded closure-signature conformance. Each specialization's
+        // `Closure(...)` target now has its type parameters substituted, and the
+        // returned literal's types were substituted alongside it, so a mismatch
+        // that was gradual while the type parameter was abstract (e.g. a `string`
+        // literal parameter against a `Closure(T $x)` target grounded to `int`)
+        // becomes provable here. Fail-fast, like the pre-loop gate. Structural
+        // mismatches (arity / by-ref) don't depend on grounding and were already
+        // caught at the template pre-loop, which threw before reaching this point.
+        foreach ($specializedAsts as $generatedFqn => $classAst) {
+            $closureValidator->validateFile([$classAst], "<specialized:{$generatedFqn}>", null);
+        }
+
         // Phase 2.5: emit subtype edges between specializations whose template
         // declares variance markers. Runs once after the fixed-point loop
         // (Phase 2) finishes -- pairwise variance comparisons can't run until
@@ -203,6 +235,10 @@ public function compile(
         // never emitted as a class-load fatal. Re-rewrite the specs it appended a member to so the new
         // member's type references are fully qualified like the rest.
         foreach ($closer->supplyUnmetMembers($registry, $specializedAsts) as $generatedFqn) {
+            // The gap-fill member's body is a relocated template body too, so re-qualify its
+            // free-function/const references (Phase 2.3 ran before this member existed). Idempotent
+            // on the spec's pre-existing members — their callees are already fully qualified.
+            Specializer::requalifyFreeSymbols($specializedAsts[$generatedFqn], $registry);
             $rewritten = $rewriter->rewrite([$specializedAsts[$generatedFqn]]);
             $first = $rewritten[0];
             assert($first instanceof \PhpParser\Node\Stmt\ClassLike);
@@ -305,9 +341,27 @@ public function check(FilepathArray $sources): DiagnosticCollector
                     // (Broken.xphp -> line 11).
                     new SourceLocation($filepath, $line > 0 ? $line : 1),
                 ));
+            } catch (XphpParseException $e) {
+                // xphp-specific parse-time rejections from the scanner (e.g. variance markers
+                // on methods, malformed generic defaults) — these carry the offending token's
+                // original-source line so the diagnostic points at the real site.
+                $line = $e->sourceLine();
+                $diagnostics->add(new Diagnostic(
+                    Severity::Error,
+                    self::CODE_PARSE_ERROR,
+                    $e->getMessage(),
+                    // @infection-ignore-all GreaterThan/IncrementInteger/DecrementInteger -- every
+                    // current throw site supplies a real token line (>= 1), so this `> 0` guard is
+                    // a defensive floor for the exception's documented 0 ("no position") contract.
+                    // The fallback value equals the boundary (1), so shifting or flipping the `> 0`
+                    // test routes to the same result — the mutants are equivalent. The real-line
+                    // path is pinned by CheckPassIntegrationTest's testParseTime* cases.
+                    new SourceLocation($filepath, $line > 0 ? $line : 1),
+                ));
             } catch (RuntimeException $e) {
-                // xphp-specific parse-time rejections from the parser (e.g. variance markers on
-                // methods) — these carry no line, so the diagnostic points at the file (line 1).
+                // Remaining xphp parse-time rejections that carry no token position (e.g.
+                // structural checks over parsed entries) — the diagnostic points at the file
+                // (line 1).
                 $diagnostics->add(new Diagnostic(
                     Severity::Error,
                     self::CODE_PARSE_ERROR,
@@ -329,6 +383,14 @@ public function check(FilepathArray $sources): DiagnosticCollector
         UndeclaredTypeParameterValidator::assertMethodLevel($astPerFile, $hierarchy, $diagnostics);
         $registry->validateDefaultsAgainstBounds();
         $registry->validateInnerVariance();
+        // Closure-signature conformance at the statically-visible literal site
+        // (a `Closure(...)` return handing back a closure literal). In
+        // validate-only mode every violation is collected (parse-failed files were
+        // already skipped from $astPerFile above).
+        $closureValidator = new ClosureConformanceValidator($hierarchy);
+        foreach ($astPerFile as $filepath => $ast) {
+            $closureValidator->validateFile($ast, $filepath, $diagnostics);
+        }
         foreach ($astPerFile as $filepath => $ast) {
             $collector->collectInstantiations($ast, $filepath);
         }
diff --git a/src/Transpiler/Monomorphize/GenericMethodCompiler.php b/src/Transpiler/Monomorphize/GenericMethodCompiler.php
index 7237d68..bd1db8f 100644
--- a/src/Transpiler/Monomorphize/GenericMethodCompiler.php
+++ b/src/Transpiler/Monomorphize/GenericMethodCompiler.php
@@ -22,6 +22,7 @@
 use PhpParser\Node\Name;
 use PhpParser\Node\Name\FullyQualified;
 use PhpParser\Node\NullableType;
+use PhpParser\Node\Param;
 use PhpParser\Node\Scalar\String_;
 use PhpParser\Node\Stmt\Case_;
 use PhpParser\Node\Stmt\Catch_;
@@ -91,6 +92,7 @@ final class GenericMethodCompiler
     public const CODE_BOUND_UNPROVABLE = 'xphp.bound_unprovable';
     public const CODE_UNDETERMINED_RECEIVER = 'xphp.undetermined_receiver';
     public const CODE_UNSPECIALIZABLE_SELF_CALL = 'xphp.unspecializable_self_call';
+    public const CODE_UNSPECIALIZED_GENERIC_CLOSURE = 'xphp.unspecialized_generic_closure';
 
     /**
      * @param ?DiagnosticCollector $diagnostics When null (the default — `xphp compile`), every
@@ -479,6 +481,17 @@ private function rewriteCallSites(
              * }>
              */
             public array $closureDispatchPlan = [];
+            /**
+             * spl_object_id set of closure/arrow templates some call site
+             * ATTEMPTED to specialize (turbofish lookup or bare-call
+             * resolution) — even when that call then drew its own reject
+             * (static closure, `$this` capture, missing turbofish). Read
+             * after the walk: a generic template never attempted anywhere
+             * is an orphan that would emit raw type-param hints.
+             *
+             * @var array<int, true>
+             */
+            public array $attemptedClosureTemplates = [];
             /**
              * Snapshot stack for scope isolation across nested
              * Function_/ClassMethod/Closure/ArrowFunction boundaries. On enter we push the
@@ -2058,6 +2071,17 @@ private function rewriteFuncCall(FuncCall $node): ?Node
                     return null;
                 }
                 if ($isVarTurbofish && $args !== [] && !self::allConcrete($args)) {
+                    // The author DID write a turbofish for this template — its
+                    // args just aren't concrete at this point (`$f::<T>($v)`
+                    // inside a still-abstract enclosing template). Mark it
+                    // attempted so the unspecialized-closure orphan check does
+                    // not misdiagnose it as never-called; how such a call
+                    // grounds when the enclosing template specializes is that
+                    // pipeline's own (tracked, pre-existing) concern.
+                    $template = $this->currentScopeClosureTemplates[$node->name->name] ?? null;
+                    if ($template !== null) {
+                        $this->attemptedClosureTemplates[spl_object_id($template)] = true;
+                    }
                     return null;
                 }
                 // Variable turbofish `$var::<T>(...)` / `$var::<>(...)`:
@@ -2152,7 +2176,7 @@ private function rewriteFuncCall(FuncCall $node): ?Node
              *
              * @param list<TypeRef> $args
              */
-            private function rewriteVariableTurbofishCall(FuncCall $node, array $args): null
+            private function rewriteVariableTurbofishCall(FuncCall $node, array $args): ?Node
             {
                 assert($node->name instanceof Variable && is_string($node->name->name));
                 $varName = $node->name->name;
@@ -2160,6 +2184,10 @@ private function rewriteVariableTurbofishCall(FuncCall $node, array $args): null
                 if ($template === null) {
                     return null;
                 }
+                // Attempted — even if this call draws one of the eager rejects
+                // below, the template is not an ORPHAN and must not draw a
+                // second (unspecialized-closure) error for the same root cause.
+                $this->attemptedClosureTemplates[spl_object_id($template)] = true;
 
                 // Eager rejections -- preserved from pre-P5.4 behavior so the
                 // throw fires at the first offending call site, before the
@@ -2275,6 +2303,21 @@ private function rewriteVariableTurbofishCall(FuncCall $node, array $args): null
                     $entry['seenTagSet'][$tag] = true;
                     $entry['argSets'][] = $args;
                 }
+                unset($entry);
+
+                // First-class callable of a turbofish specialization (`$g = $f::<int>(...)`).
+                // The call site's args are just the `...` placeholder, so prepending the tag arg
+                // (the direct-call path below) would emit `$f('T_…', ...)` — illegal PHP that does
+                // not parse. Instead return a forwarding closure that binds the tag and forwards
+                // through the dispatcher `$varName` (materialized by finalize from the argSet just
+                // recorded), preserving callable semantics (arity, variadics, named args, and the
+                // captures the dispatcher already carries). It is NOT added to `callSites`, so
+                // finalize leaves it alone.
+                if ($node->isFirstClassCallable()) {
+                    return $this->buildForwardingFccClosure($varName, $tag, $node);
+                }
+
+                $entry = &$this->closureDispatchPlan[$planKey];
                 // Pair each call site with its PADDED tag so finalize doesn't
                 // recompute from the original `ATTR_METHOD_GENERIC_ARGS` (which
                 // may be empty for the `$f::<>()` default-padding shape).
@@ -2285,6 +2328,35 @@ private function rewriteVariableTurbofishCall(FuncCall $node, array $args): null
                 return null;
             }
 
+            /**
+             * Build the forwarding closure that replaces a first-class-callable turbofish
+             * (`$f::<int>(...)`): `fn(...$p) => $f('<tag>', ...$p)`. Calling it routes through the
+             * dispatcher `$varName` (which finalize installs in that variable) to the specialization
+             * named by `$tag`. The variadic param name is guaranteed distinct from `$varName` so it
+             * never shadows the captured dispatcher inside the body.
+             */
+            private function buildForwardingFccClosure(string $varName, string $tag, FuncCall $node): ArrowFunction
+            {
+                $paramName = '__xphp_fcc_args';
+                while ($paramName === $varName) {
+                    $paramName .= '_';
+                }
+                $forward = new FuncCall(
+                    new Variable($varName),
+                    [
+                        new Arg(new String_($tag)),
+                        new Arg(new Variable($paramName), false, true),
+                    ],
+                );
+                return new ArrowFunction(
+                    [
+                        'params' => [new Param(new Variable($paramName), null, null, false, true)],
+                        'expr'   => $forward,
+                    ],
+                    $node->getAttributes(),
+                );
+            }
+
             private function resolveClassName(Name $name): string
             {
                 $raw = $name->toString();
@@ -2308,6 +2380,15 @@ private function resolveClassName(Name $name): string
                 if (str_starts_with($raw, '\\')) {
                     return ltrim($raw, '\\');
                 }
+                // `namespace\Svc` binds to the current namespace — never to a
+                // `use` alias (toString() erased the prefix, so ask the node).
+                // Alias capture here made the receiver's method-template lookup
+                // land on the wrong class.
+                if ($name->isRelative()) {
+                    return $this->currentNamespace !== ''
+                        ? $this->currentNamespace . '\\' . $raw
+                        : $raw;
+                }
                 $first = self::firstSegment($raw);
                 if (isset($this->useMap[$first])) {
                     $rest = substr($raw, strlen($first));
@@ -2343,6 +2424,10 @@ private function resolveBareGenericCall(FuncCall $node): ?array
                     if ($template === null) {
                         return null;
                     }
+                    // A bare call to a generic closure draws the loud
+                    // missing-turbofish reject — that already covers the
+                    // template, so it is not an orphan too.
+                    $this->attemptedClosureTemplates[spl_object_id($template)] = true;
                     $params = $template->getAttribute(XphpSourceParser::ATTR_METHOD_GENERIC_PARAMS);
                     /** @var list<TypeParam>|null $params */
                     return is_array($params) ? [$params, '$' . $node->name->name] : null;
@@ -2428,6 +2513,10 @@ private static function lastSegment(string $name): string
         $traverser->addVisitor($visitor);
         $traverser->traverse($ast);
 
+        // Runs BEFORE the emit gate: check mode must collect the orphan
+        // diagnostics too (this is a validation, not an emission side-effect).
+        $this->rejectUnspecializedClosureTemplates($ast, $visitor->attemptedClosureTemplates, $currentFile);
+
         // Validate-only (check) skips all emission: no dispatcher materialization, no buffered
         // appends. The traversal above already produced the diagnostics via the call-site checks.
         if (!$emit) {
@@ -2447,12 +2536,61 @@ private static function lastSegment(string $name): string
         }
     }
 
+    /**
+     * Reject every generic closure/arrow template no call site attempted to
+     * specialize. Specialization is call-site-driven: with no in-scope
+     * `$var::<...>(...)` grounding its type parameters, the template's
+     * type-parameter hints survive into the emitted output as references to
+     * non-existent classes (`App\T`) — a guaranteed TypeError behind a clean
+     * gate the moment the value is invoked. Handing the closure away as a
+     * plain callable cannot ground it (the dispatcher rewrite only exists for
+     * turbofish sites), so declared-but-never-specialized is always an error
+     * — including when the type parameters are referenced nowhere: the
+     * clause is dead syntax, and the remedy is deleting it.
+     *
+     * Runs in BOTH modes (compile throws at the first orphan; check collects
+     * one diagnostic per orphan).
+     *
+     * @param list<Node\Stmt> $ast
+     * @param array<int, true> $attemptedTemplateIds spl_object_id set of
+     *        templates some call site looked up (successfully or into one of
+     *        the eager rejects — those already carry their own error).
+     */
+    private function rejectUnspecializedClosureTemplates(array $ast, array $attemptedTemplateIds, string $currentFile): void
+    {
+        $finder = new \PhpParser\NodeFinder();
+        foreach ($finder->find($ast, static fn (Node $n): bool => ($n instanceof Closure || $n instanceof ArrowFunction)
+            && is_array($n->getAttribute(XphpSourceParser::ATTR_METHOD_GENERIC_PARAMS))) as $template) {
+            if (isset($attemptedTemplateIds[spl_object_id($template)])) {
+                continue;
+            }
+            $message = sprintf(
+                'Generic %s is declared with type parameters but never specialized: no '
+                . '`$var::<...>(...)` call grounds them, so its type-parameter hints would reach '
+                . 'the emitted code as references to non-existent classes. Call it with an '
+                . 'explicit turbofish, or remove the `<...>` clause.',
+                $template instanceof ArrowFunction ? 'arrow function' : 'closure',
+            );
+            if ($this->diagnostics !== null) {
+                $this->diagnostics->add(new Diagnostic(
+                    Severity::Error,
+                    self::CODE_UNSPECIALIZED_GENERIC_CLOSURE,
+                    $message,
+                    new SourceLocation($currentFile, $template->getStartLine()),
+                ));
+                continue;
+            }
+            throw new RuntimeException($message);
+        }
+    }
+
     /**
      * Pass 2: turn each collected dispatch-plan entry into a dispatcher
      * closure plus specialized top-level functions. Skips entries whose
-     * argSets are empty -- a generic closure template that was declared
-     * but never called via turbofish keeps its original Assign untouched,
-     * so reflection on unused templates stays faithful.
+     * argSets are empty -- every reachable declared-but-never-called template
+     * was already rejected by rejectUnspecializedClosureTemplates before this
+     * pass runs, so an empty argSet here means the template's only call sites
+     * drew their own (eager) rejects.
      *
      */
     private function finalizeClosureDispatchers(object $visitor, int $hashLength): void
@@ -2576,10 +2714,11 @@ public function __construct(private bool &$found)
             /**
              * @infection-ignore-all -- this pre-scan keeps the rewrite pass alive for files that have no
              * NAMED generic templates but do use anonymous generics. It fires on a variable turbofish
-             * call (`$f::<…>()`) AND on a generic closure/arrow TEMPLATE assignment — the latter so a
-             * BARE call to that closure (`$f('x')`, no turbofish) is still traversed and diagnosed rather
-             * than silently skipped. (Inner anonymous visitor: Infection's blind spot — the closure-call
-             * diagnosis is covered behaviorally by the bare-closure-call accept/reject tests.)
+             * call (`$f::<…>()`) AND on ANY generic closure/arrow TEMPLATE — not just assigned ones —
+             * so a bare call (`$f('x')`), a return-position or argument-position template, and the
+             * never-called orphan are all traversed and diagnosed rather than silently skipped.
+             * (Inner anonymous visitor: Infection's blind spot — covered behaviorally by the
+             * bare-closure-call and unspecialized-closure accept/reject tests.)
              */
             public function enterNode(Node $node): null
             {
@@ -2592,9 +2731,8 @@ public function enterNode(Node $node): null
                 ) {
                     $this->found = true;
                 }
-                if ($node instanceof Assign
-                    && ($node->expr instanceof Closure || $node->expr instanceof ArrowFunction)
-                    && is_array($node->expr->getAttribute(XphpSourceParser::ATTR_METHOD_GENERIC_PARAMS))
+                if (($node instanceof Closure || $node instanceof ArrowFunction)
+                    && is_array($node->getAttribute(XphpSourceParser::ATTR_METHOD_GENERIC_PARAMS))
                 ) {
                     $this->found = true;
                 }
diff --git a/src/Transpiler/Monomorphize/NamespaceContext.php b/src/Transpiler/Monomorphize/NamespaceContext.php
index 3c09f3c..0d6f34d 100644
--- a/src/Transpiler/Monomorphize/NamespaceContext.php
+++ b/src/Transpiler/Monomorphize/NamespaceContext.php
@@ -4,6 +4,9 @@
 
 namespace XPHP\Transpiler\Monomorphize;
 
+use PhpParser\Node\Identifier;
+use PhpParser\Node\Name;
+use PhpParser\Node\Stmt\GroupUse;
 use PhpParser\Node\Stmt\Use_;
 use PhpParser\Node\UseItem;
 
@@ -18,8 +21,12 @@
 final class NamespaceContext
 {
     private string $currentNamespace = '';
-    /** @var array<string, string> alias → FQN */
+    /** @var array<string, string> alias → FQN (class/namespace `use` imports) */
     private array $useMap = [];
+    /** @var array<string, string> alias → FQN (`use function` imports) */
+    private array $functionUseMap = [];
+    /** @var array<string, string> alias → FQN (`use const` imports) */
+    private array $constUseMap = [];
 
     /**
      * Push a new enclosing namespace. `$name` is the namespace string
@@ -33,6 +40,8 @@ public function enterNamespace(?string $name): void
         // never observably differs from '' in the test suite.
         $this->currentNamespace = $name ?? '';
         $this->useMap = [];
+        $this->functionUseMap = [];
+        $this->constUseMap = [];
     }
 
     /**
@@ -48,10 +57,126 @@ public function indexUse(Use_ $use): void
             }
             $fqn = $u->name->toString();
             $alias = $u->alias?->toString() ?? self::lastSegment($fqn);
+            // The class/namespace map keeps EVERY import (including function/const,
+            // as it always has) so class resolution and isImported() are unchanged.
             $this->useMap[$alias] = $fqn;
+            // Additionally route `use function` / `use const` into their own maps so
+            // function/const resolution honours PHP's separate symbol namespaces — a
+            // class `use App\Helper;` must never capture a `helper()` call. The item's
+            // own type wins when set (mixed groups), else the statement's type.
+            $type = $u->type !== Use_::TYPE_UNKNOWN ? $u->type : $use->type;
+            $this->routeSymbolImport($type, $alias, $fqn);
         }
     }
 
+    /**
+     * Index a `GroupUse` (`use N\{a, function b, const C}`). Each member is stored in the
+     * class/namespace useMap (as {@see indexUse} does for every single import), so a
+     * group-imported CLASS or namespace resolves identically to its single-import form —
+     * a relocated generic body that references it re-qualifies to the import target instead
+     * of falling back to the current namespace (and fatalling). `use function` / `use const`
+     * members are ADDITIONALLY routed into their own symbol maps, honouring PHP's separate
+     * symbol namespaces. Each member FQN is the group prefix joined with the member name;
+     * the alias is the member's `as` name, else the last segment of the member name.
+     */
+    public function indexGroupUse(GroupUse $use): void
+    {
+        $prefix = $use->prefix->toString();
+        foreach ($use->uses as $u) {
+            // @phpstan-ignore-next-line instanceof.alwaysTrue — mirrors indexUse's defensive guard against php-parser's PHPDoc-narrowed use-item type.
+            if (!$u instanceof UseItem) {
+                continue;
+            }
+            $member = $u->name->toString();
+            $fqn = $prefix . '\\' . $member;
+            $alias = $u->alias?->toString() ?? self::lastSegment($member);
+            // The class/namespace map keeps EVERY member, exactly as indexUse does for a
+            // single import — this is what a relocated body's class-name resolution reads.
+            $this->useMap[$alias] = $fqn;
+            // The item's own type wins when set (mixed `use N\{function a, const B}`),
+            // else the group statement's type (`use function N\{a, b}`).
+            $type = $u->type !== Use_::TYPE_UNKNOWN ? $u->type : $use->type;
+            $this->routeSymbolImport($type, $alias, $fqn);
+        }
+    }
+
+    /**
+     * Route a single import into the callable/const symbol maps by its resolved type.
+     * A class/namespace import (any other type) contributes to neither.
+     */
+    private function routeSymbolImport(int $type, string $alias, string $fqn): void
+    {
+        if ($type === Use_::TYPE_FUNCTION) {
+            $this->functionUseMap[$alias] = $fqn;
+        } elseif ($type === Use_::TYPE_CONSTANT) {
+            $this->constUseMap[$alias] = $fqn;
+        }
+    }
+
+    /**
+     * Resolve a php-parser Name used as a FREE-FUNCTION callee to its FQN,
+     * honouring PHP's function-resolution rules: an unqualified name binds a
+     * `use function` import first, else the current namespace (with a global
+     * fallback the caller preserves by NOT rewriting when the FQN is unknown);
+     * a qualified name's leading segment is a NAMESPACE, resolved via the
+     * class/namespace `use` map — never the function-import map.
+     */
+    public function resolveFunctionName(Name $name): string
+    {
+        return $this->resolveCallable($name->toCodeString(), $this->functionUseMap);
+    }
+
+    /**
+     * Resolve a php-parser Name used as a CONST fetch to its FQN, the same way
+     * as {@see resolveFunctionName} but against the `use const` map.
+     */
+    public function resolveConstName(Name $name): string
+    {
+        return $this->resolveCallable($name->toCodeString(), $this->constUseMap);
+    }
+
+    /**
+     * Shared function/const resolution. `$symbolUseMap` is the `use function`
+     * or `use const` alias map consulted for UNqualified names only; qualified
+     * names resolve their leading namespace segment via the class/namespace map.
+     *
+     * @param array<string, string> $symbolUseMap
+     */
+    private function resolveCallable(string $code, array $symbolUseMap): string
+    {
+        if (str_starts_with($code, '\\')) {
+            return ltrim($code, '\\');
+        }
+        if (strncasecmp($code, 'namespace\\', 10) === 0) {
+            $rest = substr($code, 10);
+            return $this->currentNamespace !== ''
+                ? $this->currentNamespace . '\\' . $rest
+                : $rest;
+        }
+        if (!str_contains($code, '\\')) {
+            // Unqualified: a `use function` / `use const` import binds it; else the
+            // current namespace. (No leading backslash is added — the caller's
+            // in-set guard decides whether to fully-qualify, so PHP's global
+            // fallback survives for names the unit does not define.)
+            if (isset($symbolUseMap[$code])) {
+                return $symbolUseMap[$code];
+            }
+            return $this->currentNamespace !== ''
+                ? $this->currentNamespace . '\\' . $code
+                : $code;
+        }
+        // Qualified `A\b`: the leading segment is a namespace, brought into scope
+        // by a class/namespace `use` (never a function/const import), else it is
+        // relative to the current namespace.
+        $first = self::firstSegment($code);
+        if (isset($this->useMap[$first])) {
+            return $this->useMap[$first] . substr($code, strlen($first));
+        }
+        return $this->currentNamespace !== ''
+            ? $this->currentNamespace . '\\' . $code
+            : $code;
+    }
+
     /**
      * Resolve a single name against the current namespace + use map. Returns
      * the FQN (without a leading backslash).
@@ -69,6 +194,16 @@ public function resolveAgainstContext(string $name): string
         if (str_starts_with($name, '\\')) {
             return ltrim($name, '\\');
         }
+        // `namespace\Foo` binds to the CURRENT namespace by PHP's rules — never
+        // to a `use` alias, and never as a literal first segment (`namespace`
+        // is a reserved word, so no real class name can start with it). The
+        // keyword is case-insensitive.
+        if (strncasecmp($name, 'namespace\\', 10) === 0) {
+            $rest = substr($name, 10);
+            return $this->currentNamespace !== ''
+                ? $this->currentNamespace . '\\' . $rest
+                : $rest;
+        }
         $first = self::firstSegment($name);
         if (isset($this->useMap[$first])) {
             $rest = substr($name, strlen($first));
@@ -79,6 +214,23 @@ public function resolveAgainstContext(string $name): string
             : $name;
     }
 
+    /**
+     * Resolve a php-parser Name (or Identifier) honoring the node's own
+     * qualification: `toCodeString()` yields `\App\Box` for a fully-qualified
+     * name (the leading-backslash branch), `namespace\Box` for a relative name
+     * (the relative-binding branch — a `use` alias NEVER applies to either,
+     * per PHP's rules), and the plain spelling otherwise. Flattening a Name
+     * with `toString()` before resolving is exactly the bug this seam removes:
+     * it drops both prefixes, doubling the namespace on fully-qualified names
+     * and letting the alias map capture relative ones.
+     */
+    public function resolveName(Name|Identifier $name): string
+    {
+        return $this->resolveAgainstContext(
+            $name instanceof Name ? $name->toCodeString() : $name->toString(),
+        );
+    }
+
     public function currentNamespace(): string
     {
         return $this->currentNamespace;
diff --git a/src/Transpiler/Monomorphize/Registry.php b/src/Transpiler/Monomorphize/Registry.php
index b375807..6044658 100644
--- a/src/Transpiler/Monomorphize/Registry.php
+++ b/src/Transpiler/Monomorphize/Registry.php
@@ -48,6 +48,36 @@ final class Registry
     /** @var array<string, GenericDefinition> Keyed by template FQN. */
     private array $definitions = [];
 
+    /**
+     * FQNs that also have a NON-generic class/interface/trait declaration (a plain `class B {}`
+     * alongside a generic `class B<T> {}`, e.g. in mutually exclusive conditional branches). A
+     * bare `new B` on such a name resolves to the plain class at runtime, so the bare-new guard
+     * must NOT reject it. Keyed by the namespace-normalized FQN (no leading `\`); value always true.
+     *
+     * @var array<string, true>
+     */
+    private array $nonGenericClassNames = [];
+
+    /**
+     * FQNs of free functions defined in the compilation unit, keyed by the FULLY lowercased
+     * FQN (PHP function names — and namespace segments — are case-insensitive). Drives the
+     * re-qualification of unqualified free-function calls in relocated generic template bodies:
+     * a call is fully-qualified only when its resolved target is known here, so builtins and any
+     * name the unit does not define keep PHP's global fallback. Value always true.
+     *
+     * @var array<string, true>
+     */
+    private array $functionNames = [];
+
+    /**
+     * FQNs of free constants defined in the compilation unit, keyed with the namespace portion
+     * lowercased and the const short-name preserved (const names are case-sensitive; namespaces
+     * are not). Same role as {@see $functionNames} for `ConstFetch` names. Value always true.
+     *
+     * @var array<string, true>
+     */
+    private array $constNames = [];
+
     /** @var array<string, GenericInstantiation> Keyed by full generated FQCN. */
     private array $instantiations = [];
 
@@ -183,6 +213,99 @@ private function padWithDefaults(string $templateFqn, array $args, ?SourceLocati
         );
     }
 
+    /**
+     * Record that `$fqn` has a non-generic class/interface/trait declaration. See
+     * {@see $nonGenericClassNames}. `$fqn` is already namespace-normalized (no leading `\`) by
+     * every caller, and is looked up verbatim in {@see reportMissingTypeArgumentsForBareNew}.
+     */
+    public function recordNonGenericClass(string $fqn): void
+    {
+        $this->nonGenericClassNames[$fqn] = true;
+    }
+
+    /**
+     * Record a free function defined in the compilation unit. `$fqn` is namespace-normalized
+     * (no leading `\`). Keyed case-insensitively (function + namespace names).
+     */
+    public function recordFunction(string $fqn): void
+    {
+        $this->functionNames[strtolower($fqn)] = true;
+    }
+
+    /** Whether the unit defines a free function with this (namespace-normalized) FQN. */
+    public function hasFunction(string $fqn): bool
+    {
+        // Value-check (not isset): so a mutated `recordFunction` storing a non-true value is caught.
+        return ($this->functionNames[strtolower($fqn)] ?? false) === true;
+    }
+
+    /**
+     * Record a free constant defined in the compilation unit. `$fqn` is namespace-normalized
+     * (no leading `\`). Keyed with a case-insensitive namespace and a case-sensitive short name.
+     */
+    public function recordConst(string $fqn): void
+    {
+        $this->constNames[self::constKey($fqn)] = true;
+    }
+
+    /** Whether the unit defines a free constant with this (namespace-normalized) FQN. */
+    public function hasConst(string $fqn): bool
+    {
+        // Value-check (not isset): so a mutated `recordConst` storing a non-true value is caught.
+        return ($this->constNames[self::constKey($fqn)] ?? false) === true;
+    }
+
+    /**
+     * @infection-ignore-all — constKey is a symmetric key-derivation used by BOTH recordConst and
+     * hasConst, so any structural mutation (substr bounds, concat order/removal) transforms every
+     * key uniformly and preserves the exact membership + case relationships the behavioral tests
+     * assert (namespace-insensitive, short-name-sensitive) — the mutants are equivalent. The
+     * SEMANTIC contract is pinned by RegistryTest::testConstMembershipHasCaseInsensitiveNamespace…
+     * (the `strtolower` itself is a plain call, not mutated here).
+     */
+    private static function constKey(string $fqn): string
+    {
+        $pos = strrpos($fqn, '\\');
+        // A global const (no namespace) is keyed by its case-sensitive short name alone.
+        return $pos === false
+            ? $fqn
+            : strtolower(substr($fqn, 0, $pos)) . substr($fqn, $pos);
+    }
+
+    /**
+     * Report a bare `new` of a generic template that supplies no type arguments and cannot pad
+     * entirely from defaults (some parameter is required). Routes through the canonical
+     * `padArgsWithDefaults`, so the code (`xphp.missing_type_argument`), message, and
+     * throw-vs-collect duality match the function/method call path exactly. The padded result is
+     * discarded — a bare `new` of a non-all-defaults generic is a hard error, not an instantiation,
+     * so nothing is recorded (recording the partial tuple would store a bogus specialization and
+     * draw spurious secondary diagnostics). A no-op when the template isn't recorded, or when a
+     * non-generic class of the same name also exists (the bare `new` resolves to that at runtime).
+     *
+     * `$templateFqn` is the resolveName-normalized name (no leading `\`), matching the keys of both
+     * `$definitions` and `$nonGenericClassNames`.
+     */
+    public function reportMissingTypeArgumentsForBareNew(string $templateFqn, ?SourceLocation $callSite): void
+    {
+        $definition = $this->definitions[$templateFqn] ?? null;
+        if ($definition === null) {
+            return;
+        }
+        // A plain class of the same name also exists (conditional same-name declaration): the bare
+        // `new` resolves to the instantiable class at runtime, so rejecting it would be a false
+        // reject. The generic twin is emitted as a marker interface; the plain class is what runs.
+        if (($this->nonGenericClassNames[$templateFqn] ?? false) === true) {
+            return;
+        }
+        self::padArgsWithDefaults(
+            $definition->typeParams,
+            [],
+            $templateFqn,
+            $this->diagnostics,
+            $callSite,
+        );
+    }
+
     /**
      * Pad an arg list with defaults declared on `$params`, substituting
      * already-positional concretes into any type-param references in the
diff --git a/src/Transpiler/Monomorphize/RegistryCollector.php b/src/Transpiler/Monomorphize/RegistryCollector.php
index 205730f..a87b531 100644
--- a/src/Transpiler/Monomorphize/RegistryCollector.php
+++ b/src/Transpiler/Monomorphize/RegistryCollector.php
@@ -7,8 +7,10 @@
 use PhpParser\Node;
 use PhpParser\Node\Expr\New_;
 use PhpParser\Node\Name;
-use PhpParser\Node\Name\FullyQualified;
 use PhpParser\Node\Stmt\ClassLike;
+use PhpParser\Node\Stmt\Const_;
+use PhpParser\Node\Stmt\Function_;
+use PhpParser\Node\Stmt\GroupUse;
 use PhpParser\Node\Stmt\Namespace_;
 use PhpParser\Node\Stmt\Use_;
 use PhpParser\NodeTraverser;
@@ -97,10 +99,12 @@ public function enterNode(Node $node): null
             // never appears in any fixture, so the null-safe call is observationally
             // identical to the non-null version on every test input.
             $this->ctx->enterNamespace($node->name?->toString());
-            // @infection-ignore-all — dual-handled by the standalone Use_ branch below; dead loop.
+            // @infection-ignore-all — dual-handled by the standalone Use_/GroupUse branches below; dead loop.
             foreach ($node->stmts as $inner) {
                 if ($inner instanceof Use_) {
                     $this->ctx->indexUse($inner);
+                } elseif ($inner instanceof GroupUse) {
+                    $this->ctx->indexGroupUse($inner);
                 }
             }
         }
@@ -108,15 +112,37 @@ public function enterNode(Node $node): null
         if ($node instanceof Use_) {
             // @infection-ignore-all — dual-handled by the inner foreach above.
             $this->ctx->indexUse($node);
+        } elseif ($node instanceof GroupUse) {
+            // @infection-ignore-all — dual-handled by the inner foreach above.
+            $this->ctx->indexGroupUse($node);
+        }
+
+        if ($this->mode !== self::MODE_INSTANTIATIONS) {
+            // Free functions and constants defined in the unit. Recorded so the Specializer can
+            // re-qualify an unqualified `helper()` / `FOO` in a relocated template body to the
+            // ORIGINAL namespace only when the target is known here — leaving builtins and any
+            // undefined name to PHP's global fallback. (Class methods are ClassMethod and class
+            // constants are ClassConst — different node types — so this never sees a member.)
+            $ns = $this->ctx->currentNamespace();
+            if ($node instanceof Function_) {
+                $name = $node->name->toString();
+                $this->registry->recordFunction($ns !== '' ? $ns . '\\' . $name : $name);
+            } elseif ($node instanceof Const_) {
+                foreach ($node->consts as $const) {
+                    $name = $const->name->toString();
+                    $this->registry->recordConst($ns !== '' ? $ns . '\\' . $name : $name);
+                }
+            }
         }
 
         if ($this->mode !== self::MODE_INSTANTIATIONS
             && $node instanceof ClassLike && $node->name !== null) {
             $params = $node->getAttribute(XphpSourceParser::ATTR_GENERIC_PARAMS);
             $fqn = $node->getAttribute(XphpSourceParser::ATTR_TEMPLATE_FQN);
-            if (is_array($params)) {
+            $isGenericTemplate = is_array($params) && $params !== [] && is_string($fqn);
+            if ($isGenericTemplate) {
                 /** @var list<TypeParam> $params — set as a list by XphpSourceParser::resolveAndAttach. */
-                if ($params !== [] && is_string($fqn) && !$this->isAlreadyRecorded($fqn)) {
+                if (!$this->isAlreadyRecorded($fqn)) {
                     $this->registry->recordDefinition(
                         $fqn,
                         $node->name->toString(),
@@ -125,6 +151,14 @@ public function enterNode(Node $node): null
                         $this->currentFile,
                     );
                 }
+            } else {
+                // A NON-generic class/interface/trait. Record its FQN so the bare-new guard does
+                // not reject a `new B` when a plain `class B` coexists with a generic `class B<T>`
+                // (conditional same-name declarations). ATTR_TEMPLATE_FQN is only attached to
+                // generic templates, so compute the declaration FQN from the namespace context.
+                $ns = $this->ctx->currentNamespace();
+                $plainFqn = $ns !== '' ? $ns . '\\' . $node->name->toString() : $node->name->toString();
+                $this->registry->recordNonGenericClass($plainFqn);
             }
         }
 
@@ -143,10 +177,13 @@ public function enterNode(Node $node): null
             }
         }
 
+        // Fully-qualified bare news are included: `new \App\Box("hi")` on an
+        // all-defaults generic used to be skipped here, so compile emitted the
+        // stripped `interface Box {}` and KEPT the call site — a guaranteed
+        // runtime fatal behind a clean gate.
         if ($this->mode !== self::MODE_DEFINITIONS
             && $node instanceof New_
             && $node->class instanceof Name
-            && !$node->class instanceof FullyQualified
             && $node->class->getAttribute(XphpSourceParser::ATTR_GENERIC_ARGS) === null
         ) {
             $this->synthesizeBareNewIfAllDefaults($node->class);
@@ -164,13 +201,27 @@ public function enterNode(Node $node): null
      */
     private function synthesizeBareNewIfAllDefaults(Name $name): void
     {
-        $resolved = $this->ctx->resolveAgainstContext($name->toString());
+        // resolveName (not a flattened toString()): the spelling decides the
+        // template — `\App\Box` must not double the namespace, and a relative
+        // `namespace\Box` must bind to the current namespace even when a
+        // colliding `use` alias is in scope (otherwise synthesis targets the
+        // WRONG template, or silently skips).
+        $resolved = $this->ctx->resolveName($name);
         $definition = $this->registry->definition($resolved);
         if ($definition === null || $definition->typeParams === []) {
             return;
         }
         foreach ($definition->typeParams as $param) {
             if ($param->default === null) {
+                // A generic template with a required (non-defaulted) parameter, used as a bare
+                // `new` with no turbofish. It cannot be padded from defaults, so it was silently
+                // skipped -- leaving the call site pointing at the stripped marker `interface`,
+                // a guaranteed runtime fatal behind a clean gate. Report it loudly instead,
+                // matching the function/method call path (`xphp.missing_type_argument`).
+                $this->registry->reportMissingTypeArgumentsForBareNew(
+                    $resolved,
+                    new SourceLocation($this->currentFile, $name->getStartLine()),
+                );
                 return;
             }
         }
diff --git a/src/Transpiler/Monomorphize/SigClosure.php b/src/Transpiler/Monomorphize/SigClosure.php
new file mode 100644
index 0000000..b38229a
--- /dev/null
+++ b/src/Transpiler/Monomorphize/SigClosure.php
@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+/**
+ * A closure-signature leaf that is itself a closure signature — the nested case,
+ * e.g. the parameter type in `Closure(Closure(int): int): int` or the return type
+ * in `Closure(): Closure(int): int`. Conformance recurses through it (inner
+ * parameters contravariant, inner return covariant) in a later work item.
+ */
+final readonly class SigClosure extends SigType
+{
+    public function __construct(
+        public ClosureSignature $signature,
+    ) {
+    }
+}
diff --git a/src/Transpiler/Monomorphize/SigIntersection.php b/src/Transpiler/Monomorphize/SigIntersection.php
new file mode 100644
index 0000000..8c39ffd
--- /dev/null
+++ b/src/Transpiler/Monomorphize/SigIntersection.php
@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+/**
+ * A closure-signature leaf that is an intersection type — `A&B`. Each member is
+ * a {@see SigType} (in practice a {@see SigTypeRef} class leaf; a scalar member
+ * would make the type invalid PHP and is kept as {@see SigRaw} instead).
+ *
+ * Subtyping is checked on the SUPER side only ({@see ClosureSignatureConformance}):
+ *   - as the SUPER (`X <: A&B`): X conforms to *every* member — provably-not iff
+ *     X is provably not a subtype of *some* member.
+ *   - as the SUB (`A&B <: Y`): the sound rule is `A <: Y` OR `B <: Y`, but an
+ *     intersection of mutually-incompatible members is *uninhabited* (`never`),
+ *     and `never` is a subtype of everything — the engine has no inhabitation
+ *     check, so decomposing the sub side would false-reject a valid `never`
+ *     parameter. A sub-position intersection is therefore left GRADUAL (accepted);
+ *     the inhabited-intersection reject is a tracked follow-up.
+ */
+final readonly class SigIntersection extends SigType
+{
+    /**
+     * @param list<SigType> $members Two or more, in source order (order is not
+     *        significant to conformance).
+     */
+    public function __construct(
+        public array $members,
+    ) {
+    }
+}
diff --git a/src/Transpiler/Monomorphize/SigRaw.php b/src/Transpiler/Monomorphize/SigRaw.php
new file mode 100644
index 0000000..a3913d7
--- /dev/null
+++ b/src/Transpiler/Monomorphize/SigRaw.php
@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+/**
+ * A signature leaf that was scanned and erased but could NOT be structured into a
+ * {@see SigUnion} / {@see SigIntersection} / {@see SigTypeRef} — the defensive
+ * fallback. Flat unions/intersections/nullables now structure, so this remains
+ * only for the residual shapes: a target-side DNF `(A&B)|C` (the token scanner
+ * doesn't split nested parens), a member that fails to resolve, or an
+ * intersection carrying a scalar member. The engine treats it as gradual (accept),
+ * so it only has to survive erasure without losing the bytes for the diagnostic.
+ */
+final readonly class SigRaw extends SigType
+{
+    public function __construct(
+        public string $raw,
+    ) {
+    }
+}
diff --git a/src/Transpiler/Monomorphize/SigType.php b/src/Transpiler/Monomorphize/SigType.php
new file mode 100644
index 0000000..7c7eb20
--- /dev/null
+++ b/src/Transpiler/Monomorphize/SigType.php
@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+/**
+ * A type appearing as a leaf inside a closure signature — a closure parameter
+ * type or a closure return type (see {@see ClosureSignature}).
+ *
+ * A signature leaf is a recursive sum because a closure signature can itself be
+ * a parameter or return type: `Closure(Closure(int): int): int`. A plain
+ * `TypeRef` cannot hold that nesting, so the leaf is its own small hierarchy
+ * beside `TypeRef`, mirroring the rationale in {@see BoundExpr} — `TypeRef` is
+ * kept as a single `name + isScalar + isTypeParam` slot that the canonicalisation
+ * and substitution machinery depend on, and the compound/nested shapes live here.
+ *
+ * Concrete arms:
+ *   - `SigTypeRef`      — a scalar / class / type-parameter / pseudo-type leaf,
+ *                         wrapping a `TypeRef` so the existing substitution +
+ *                         `TypeHierarchy` machinery is reused unchanged.
+ *   - `SigClosure`      — a nested `ClosureSignature`.
+ *   - `SigUnion`        — an `A|B` (or nullable `?A` ≡ `A|null`) leaf.
+ *   - `SigIntersection` — an `A&B` leaf.
+ *   - `SigRaw`          — a defensive fallback for a leaf that couldn't be
+ *                         structured (a target-side DNF, an unresolved member, an
+ *                         intersection carrying a scalar); accepted gradually.
+ */
+abstract readonly class SigType
+{
+}
diff --git a/src/Transpiler/Monomorphize/SigTypeRef.php b/src/Transpiler/Monomorphize/SigTypeRef.php
new file mode 100644
index 0000000..632d0e9
--- /dev/null
+++ b/src/Transpiler/Monomorphize/SigTypeRef.php
@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+/**
+ * A closure-signature leaf that is an ordinary type — scalar, class, interface,
+ * type parameter, or pseudo-type. Carries a `TypeRef` (not a bare FQN) so the
+ * generic-substitution and `TypeHierarchy` machinery is shared: a `Closure(T): U`
+ * leaf substitutes `T`/`U` through specialization exactly like any other
+ * `TypeRef`.
+ */
+final readonly class SigTypeRef extends SigType
+{
+    public function __construct(
+        public TypeRef $type,
+    ) {
+    }
+}
diff --git a/src/Transpiler/Monomorphize/SigUnion.php b/src/Transpiler/Monomorphize/SigUnion.php
new file mode 100644
index 0000000..72c5eea
--- /dev/null
+++ b/src/Transpiler/Monomorphize/SigUnion.php
@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+/**
+ * A closure-signature leaf that is a union type — `A|B`, or a nullable `?A`
+ * modelled as `A|null`. Each member is itself a {@see SigType}, so a member may
+ * be a plain {@see SigTypeRef}, a nested {@see SigClosure}, or (on the candidate
+ * side, from nikic's already-nested AST) a {@see SigIntersection} for a DNF
+ * member like the `A&B` in `(A&B)|C`.
+ *
+ * Subtyping (both arms sound — {@see ClosureSignatureConformance}):
+ *   - as the SUPER (`X <: A|B`): X conforms to some member — provably-not iff X
+ *     is provably not a subtype of *every* member.
+ *   - as the SUB (`A|B <: Y`): every member conforms to Y — provably-not iff
+ *     *some* member is provably not a subtype of Y.
+ */
+final readonly class SigUnion extends SigType
+{
+    /**
+     * @param list<SigType> $members Two or more, in source order. Order is not
+     *        significant to conformance (the rules quantify over the set).
+     */
+    public function __construct(
+        public array $members,
+    ) {
+    }
+}
diff --git a/src/Transpiler/Monomorphize/Specializer.php b/src/Transpiler/Monomorphize/Specializer.php
index d6a5e6e..5b181f4 100644
--- a/src/Transpiler/Monomorphize/Specializer.php
+++ b/src/Transpiler/Monomorphize/Specializer.php
@@ -5,6 +5,8 @@
 namespace XPHP\Transpiler\Monomorphize;
 
 use PhpParser\Node;
+use PhpParser\Node\Expr\ConstFetch;
+use PhpParser\Node\Expr\FuncCall;
 use PhpParser\Node\Expr\MethodCall;
 use PhpParser\Node\Expr\NullsafeMethodCall;
 use PhpParser\Node\Expr\Variable;
@@ -94,6 +96,47 @@ public function specialize(ClassLike $template, array $substitution, int $hashLe
         return $cloned;
     }
 
+    /**
+     * Fully-qualify unqualified free-function callees and const fetches in a relocated
+     * class body, keyed on the resolver-recorded ATTR_RESOLVED_FUNC_FQN / _CONST_FQN and
+     * gated by the unit's collected symbol sets. An already fully-qualified name is left
+     * alone (namespace-invariant); an unknown name is left bare (global fallback).
+     *
+     * A relocated body has moved out of its origin namespace into XPHP\Generated\…, so an
+     * unqualified `helper()` / `FOO` would rebind against the generated namespace (then the
+     * global fallback) instead of the origin. The Compiler runs this over every specialization
+     * from the fixed-point loop, and again over each spec the covariant-upcast gap-fill appends
+     * a member to (that member is created after the first sweep). Idempotent: an already
+     * fully-qualified name is skipped.
+     */
+    public static function requalifyFreeSymbols(ClassLike $specialized, Registry $registry): void
+    {
+        $traverser = new NodeTraverser();
+        $traverser->addVisitor(new class ($registry) extends NodeVisitorAbstract {
+            public function __construct(private Registry $registry)
+            {
+            }
+
+            public function leaveNode(Node $node): null
+            {
+                if ($node instanceof FuncCall && $node->name instanceof Name && !$node->name->isFullyQualified()) {
+                    $fqn = $node->name->getAttribute(XphpSourceParser::ATTR_RESOLVED_FUNC_FQN);
+                    if (is_string($fqn) && $this->registry->hasFunction($fqn)) {
+                        $node->name = new FullyQualified($fqn, $node->name->getAttributes());
+                    }
+                } elseif ($node instanceof ConstFetch && !$node->name->isFullyQualified()) {
+                    $fqn = $node->name->getAttribute(XphpSourceParser::ATTR_RESOLVED_CONST_FQN);
+                    if (is_string($fqn) && $this->registry->hasConst($fqn)) {
+                        $node->name = new FullyQualified($fqn, $node->name->getAttributes());
+                    }
+                }
+
+                return null;
+            }
+        });
+        $traverser->traverse([$specialized]);
+    }
+
     /**
      * Replace each erasable generic method with its E-erased concrete form; non-erasable methods and
      * non-method statements pass through unchanged.
@@ -287,13 +330,58 @@ public function __construct(private array $substitution)
 
             public function leaveNode(Node $node): ?Node
             {
-                if ($node instanceof Name && !$node->isFullyQualified()) {
-                    $parts = $node->getParts();
-                    if (count($parts) === 1 && isset($this->substitution[$parts[0]])) {
-                        $concrete = $this->substitution[$parts[0]];
-                        return Specializer::typeRefToNode($concrete, $node->getAttributes());
+                // Ground a variable-turbofish call's type arguments in place. An inner
+                // `$inner::<S>(...)` inside a generic template body parses as a FuncCall on
+                // a Variable whose type args live in ATTR_METHOD_GENERIC_ARGS; when the
+                // enclosing generic specializes (`S → int`) those args must ground too, so
+                // the per-specialization closure-grounding pass sees `$inner::<int>` and can
+                // dispatch it. Left un-substituted the closure keeps a raw `I` hint and
+                // fatals at runtime. (This substitution is e2e-inert until that grounding
+                // pass runs — it only rewrites the recorded type args, never emits.)
+                if ($node instanceof FuncCall) {
+                    $methodArgs = $node->getAttribute(XphpSourceParser::ATTR_METHOD_GENERIC_ARGS);
+                    if (is_array($methodArgs) && $methodArgs !== []) {
+                        /** @var list<TypeRef> $methodArgs — ATTR_METHOD_GENERIC_ARGS is a TypeRef list (set by XphpSourceParser). */
+                        $node->setAttribute(
+                            XphpSourceParser::ATTR_METHOD_GENERIC_ARGS,
+                            array_map(
+                                fn (TypeRef $a): TypeRef => Specializer::substituteTypeRef($a, $this->substitution),
+                                $methodArgs,
+                            ),
+                        );
+                    }
+                }
+
+                // Ground a closure-signature target in place. The erased `\Closure`
+                // head that carries it is fully-qualified, so it never reaches the
+                // type-param swap below; substitute its type-parameter leaves here.
+                if ($node instanceof Name) {
+                    $sig = $node->getAttribute(XphpSourceParser::ATTR_CLOSURE_SIG);
+                    if ($sig instanceof ClosureSignature) {
+                        $node->setAttribute(
+                            XphpSourceParser::ATTR_CLOSURE_SIG,
+                            Specializer::substituteClosureSignature($sig, $this->substitution),
+                        );
+                    }
+                }
+
+                if ($node instanceof Name) {
+                    // The type-param swap applies only to a PLAIN single-segment
+                    // name: `\T` and `namespace\T` are explicit class references
+                    // by spelling — substituting a type param into them emitted
+                    // wrong signatures (`namespace\Thing $x` becoming `int $x`).
+                    if (!$node->isFullyQualified() && !$node->isRelative()) {
+                        $parts = $node->getParts();
+                        if (count($parts) === 1 && isset($this->substitution[$parts[0]])) {
+                            $concrete = $this->substitution[$parts[0]];
+                            return Specializer::typeRefToNode($concrete, $node->getAttributes());
+                        }
                     }
 
+                    // Generic-args substitution runs for FULLY-QUALIFIED names
+                    // too: `\App\Box<T>` inside a template body carries the same
+                    // attributes as the bare form and its `T` must ground when
+                    // the class specializes.
                     $args = $node->getAttribute(XphpSourceParser::ATTR_GENERIC_ARGS);
                     if (is_array($args) && $args !== []) {
                         /** @var list<TypeRef> $args — ATTR_GENERIC_ARGS is a TypeRef list (set by XphpSourceParser); the type-hint lets array_map infer the callback's parameter as TypeRef. */
@@ -303,9 +391,20 @@ public function leaveNode(Node $node): ?Node
                         );
                         $node->setAttribute(XphpSourceParser::ATTR_GENERIC_ARGS, $substituted);
 
+                        // @infection-ignore-all ReturnRemoval — falling through is
+                        // observationally equivalent, but NOT because the attributes are
+                        // exclusive: markName runs from the PARENT node's enterNode before
+                        // the child Name's own attach sets ATTR_GENERIC_ARGS, so a generic
+                        // reference in a marked position carries BOTH. Equivalence holds
+                        // because the fallen-through swap yields a FullyQualified that still
+                        // carries the (substituted, concrete) generic attributes, which the
+                        // call-site rewriter now admits and rewrites to the same
+                        // specialization the normal path reaches.
                         return null;
                     }
+                }
 
+                if ($node instanceof Name && !$node->isFullyQualified()) {
                     // Bare, non-generic class/interface name carried over from the
                     // template (extends Countable, new ArrayIterator, ...). The parser
                     // tagged it with the FQN resolved against the source file's
@@ -372,6 +471,63 @@ public static function substituteTypeRef(TypeRef $ref, array $subst): TypeRef
         return new TypeRef($ref->name, $newArgs, $ref->isScalar, $ref->isTypeParam);
     }
 
+    /**
+     * Ground a closure-signature target ({@see XphpSourceParser::ATTR_CLOSURE_SIG})
+     * by substituting its type-parameter leaves with their concrete types, so the
+     * conformance validator's post-specialization pass checks `Closure(int): int`
+     * (not `Closure(T): T`) against the likewise-substituted returned literal.
+     * Mirrors the parser's own signature-resolution walk.
+     *
+     * Public for the same reason as {@see substituteTypeRef} — the shared
+     * anonymous-class visitor calls back into Specializer.
+     *
+     * @param array<string, TypeRef> $subst
+     */
+    public static function substituteClosureSignature(ClosureSignature $sig, array $subst): ClosureSignature
+    {
+        $params = array_map(
+            static fn (ClosureSignatureParam $p): ClosureSignatureParam => new ClosureSignatureParam(
+                self::substituteSigType($p->type, $subst),
+                $p->byRef,
+                $p->variadic,
+                $p->optional,
+            ),
+            $sig->params,
+        );
+        $return = $sig->return === null ? null : self::substituteSigType($sig->return, $subst);
+
+        return new ClosureSignature($params, $return, $sig->nullable);
+    }
+
+    /**
+     * @param array<string, TypeRef> $subst
+     */
+    private static function substituteSigType(SigType $type, array $subst): SigType
+    {
+        if ($type instanceof SigTypeRef) {
+            return new SigTypeRef(self::substituteTypeRef($type->type, $subst));
+        }
+        if ($type instanceof SigClosure) {
+            return new SigClosure(self::substituteClosureSignature($type->signature, $subst));
+        }
+        if ($type instanceof SigUnion) {
+            return new SigUnion(array_map(
+                static fn (SigType $m): SigType => self::substituteSigType($m, $subst),
+                $type->members,
+            ));
+        }
+        if ($type instanceof SigIntersection) {
+            return new SigIntersection(array_map(
+                static fn (SigType $m): SigType => self::substituteSigType($m, $subst),
+                $type->members,
+            ));
+        }
+
+        // SigRaw (an unstructured DNF / scalar-bearing intersection) is gradual;
+        // there is nothing to ground.
+        return $type;
+    }
+
     /**
      * Deep-clone an AST subtree. nikic/php-parser's __clone is shallow; we need
      * a recursive clone so mutations to the specialized copy don't bleed back
diff --git a/src/Transpiler/Monomorphize/TypeHierarchy.php b/src/Transpiler/Monomorphize/TypeHierarchy.php
index ad250bc..48146e9 100644
--- a/src/Transpiler/Monomorphize/TypeHierarchy.php
+++ b/src/Transpiler/Monomorphize/TypeHierarchy.php
@@ -8,6 +8,7 @@
 use PhpParser\Node\Name;
 use PhpParser\Node\Stmt\Class_;
 use PhpParser\Node\Stmt\ClassLike;
+use PhpParser\Node\Stmt\Enum_;
 use PhpParser\Node\Stmt\Interface_;
 use PhpParser\Node\Stmt\Namespace_;
 use PhpParser\Node\Stmt\Trait_;
@@ -153,6 +154,42 @@ public function isDeclared(string $fqn): bool
         return isset($this->ancestors[$fqn]) || in_array($fqn, self::BUILTIN_TYPES, true);
     }
 
+    /**
+     * Whether $fqn names a built-in PHP interface/class ({@see BUILTIN_TYPES}).
+     * These are `isDeclared`, but the hierarchy models none of their ancestor
+     * edges (it seeds edges only from scanned source), so an `isSubtype` verdict
+     * of `false` against a built-in target is unprovable — callers that treat a
+     * `false` as a proof must exclude a built-in target first.
+     */
+    public function isBuiltin(string $fqn): bool
+    {
+        return in_array(ltrim($fqn, '\\'), self::BUILTIN_TYPES, true);
+    }
+
+    /**
+     * True when $fqn's ENTIRE ancestry is modeled from scanned source and is
+     * built-in-free: $fqn itself and every member of its ancestor chain is a
+     * user type declared in the source set. Under such a CLOSED WORLD an
+     * {@see isSubtype} verdict of `false` is a real proof even against a
+     * built-in target — no unmodeled built-in edge can exist, because every
+     * edge of the chain was collected from source and none leads outside it.
+     * An unknown ancestor (chain member that is no map key) or ANY built-in in
+     * the chain opens the world and returns false.
+     */
+    public function hasClosedUserAncestry(string $fqn): bool
+    {
+        $fqn = ltrim($fqn, '\\');
+        if (!isset($this->ancestors[$fqn]) || $this->isBuiltin($fqn)) {
+            return false;
+        }
+        foreach ($this->ancestorChain($fqn) as $ancestor) {
+            if (!isset($this->ancestors[$ancestor]) || $this->isBuiltin($ancestor)) {
+                return false;
+            }
+        }
+        return true;
+    }
+
     /**
      * Transitive ancestors of $fqn, nearest-first and de-duplicated, excluding
      * $fqn itself. Breadth-first over the direct-ancestor map, so the closest
@@ -331,10 +368,26 @@ public function enterNode(Node $node): null
                         foreach ($node->extends as $interface) {
                             $clauses[] = $interface;
                         }
+                    } elseif ($node instanceof Enum_) {
+                        // Enums carry their `implements` clauses like classes do, PLUS
+                        // PHP's implicit built-in edges: every enum is a UnitEnum, and a
+                        // backed enum is also a BackedEnum. Without these an enum looks
+                        // like a parentless plain class — a "closed world" it is not —
+                        // and closed-world reasoning would falsely prove it unrelated
+                        // to built-in interfaces it genuinely implements at runtime.
+                        foreach ($node->implements as $interface) {
+                            $clauses[] = $interface;
+                        }
                     }
                     // Trait_ has no formal ancestors — uses-of-traits are statements inside the body
                     // and would only matter for shared-method bounds, which we don't model.
                     $directAncestors = [];
+                    if ($node instanceof Enum_) {
+                        $directAncestors[] = 'UnitEnum';
+                        if ($node->scalarType !== null) {
+                            $directAncestors[] = 'BackedEnum';
+                        }
+                    }
                     $parameterized = [];
                     foreach ($clauses as $clause) {
                         $fqn = $this->resolveName($clause);
@@ -379,6 +432,13 @@ private function resolveName(Name $name): string
                 if ($name->isFullyQualified() || str_starts_with($raw, '\\')) {
                     return ltrim($raw, '\\');
                 }
+                // `namespace\Base` binds to the current namespace — never to a
+                // `use` alias. An alias-captured hierarchy edge here recorded
+                // the wrong parent, which conformance then treated as a
+                // PROVABLE mismatch — a false reject of valid code.
+                if ($name->isRelative()) {
+                    return $this->qualify($raw);
+                }
                 $first = self::firstSegment($raw);
                 if (isset($this->useMap[$first])) {
                     $rest = substr($raw, strlen($first));
diff --git a/src/Transpiler/Monomorphize/XphpParseException.php b/src/Transpiler/Monomorphize/XphpParseException.php
new file mode 100644
index 0000000..e22152e
--- /dev/null
+++ b/src/Transpiler/Monomorphize/XphpParseException.php
@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+use RuntimeException;
+
+/**
+ * A source-level rejection raised while scanning .xphp generic syntax, carrying
+ * the original-source line the offending token sits on.
+ *
+ * It extends {@see RuntimeException} so compile-mode callers that already catch
+ * `RuntimeException` keep catching it unchanged — only the line is added. Check
+ * mode catches it specifically to report the real line in its diagnostic instead
+ * of the line-1 fallback used for position-less parse failures.
+ */
+final class XphpParseException extends RuntimeException
+{
+    public function __construct(string $message, private readonly int $sourceLine)
+    {
+        parent::__construct($message);
+    }
+
+    /**
+     * The 1-based original-source line of the offending token, or 0 when no
+     * token position was available at the throw site.
+     */
+    public function sourceLine(): int
+    {
+        return $this->sourceLine;
+    }
+}
diff --git a/src/Transpiler/Monomorphize/XphpSourceParser.php b/src/Transpiler/Monomorphize/XphpSourceParser.php
index 5e24f34..fcad6cf 100644
--- a/src/Transpiler/Monomorphize/XphpSourceParser.php
+++ b/src/Transpiler/Monomorphize/XphpSourceParser.php
@@ -7,6 +7,7 @@
 use PhpParser\Node;
 use PhpParser\Node\Name;
 use PhpParser\Node\Stmt\ClassLike;
+use PhpParser\Node\Stmt\GroupUse;
 use PhpParser\Node\Stmt\Namespace_;
 use PhpParser\Node\Stmt\Use_;
 use PhpParser\NodeTraverser;
@@ -72,10 +73,24 @@ final class XphpSourceParser
     // apply and a bare name would otherwise resolve into XPHP\Generated\...).
     public const ATTR_RESOLVED_FQN = 'xphp:resolvedFqn';
 
+    // Resolved FQN for a FREE-FUNCTION callee Name / a CONST-fetch Name. Like
+    // ATTR_RESOLVED_FQN but for the function/const symbol namespaces (which have a
+    // global fallback classes lack): recorded at parse time honoring the file's
+    // `use function` / `use const` imports + namespace, and read by the Specializer
+    // to fully-qualify the reference on a relocated clone ONLY when the compilation
+    // unit defines that symbol — so builtins and unknown names keep the fallback.
+    public const ATTR_RESOLVED_FUNC_FQN = 'xphp:resolvedFuncFqn';
+    public const ATTR_RESOLVED_CONST_FQN = 'xphp:resolvedConstFqn';
+
     // Method-scoped generics (one type-param set per method, distinct from any class-level set).
     public const ATTR_METHOD_GENERIC_PARAMS = 'xphp:methodGenericParams';
     public const ATTR_METHOD_GENERIC_ARGS = 'xphp:methodGenericArgs';
 
+    // A parsed closure signature type (`Closure(int $x): bool`) attached to the
+    // surviving `\Closure` type-hint Name after the `(…)[: ret]` span is erased.
+    // Carries a ClosureSignature; read by the compile-time conformance validator.
+    public const ATTR_CLOSURE_SIG = 'xphp:closureSig';
+
     // A bare, single-segment, non-imported class-name used inside a generic context
     // (a template or generic method/function/closure) that is NOT a declared type
     // parameter. Carries the resolved FQN. The undeclared-type-parameter validator
@@ -125,7 +140,7 @@ public function parse(string $source): array
      */
     public function parseWithMap(string $source): array
     {
-        [$classMarkers, $nameMarkers, $methodMarkers, $cleanedSource, $byteOffsetMap] = $this->scanAndStrip($source);
+        [$classMarkers, $nameMarkers, $methodMarkers, $cleanedSource, $byteOffsetMap, $closureMarkers] = $this->scanAndStrip($source);
 
         $ast = $this->parser->parse($cleanedSource);
         if ($ast === null) {
@@ -133,7 +148,15 @@ public function parseWithMap(string $source): array
         }
         /** @var list<Node\Stmt> $ast — nikic's parse() returns array<Stmt>; runtime keys are always 0..N-1. */
 
-        $this->resolveAndAttach($ast, $classMarkers, $nameMarkers, $methodMarkers);
+        $unbound = $this->resolveAndAttach($ast, $classMarkers, $nameMarkers, $methodMarkers, $closureMarkers, $byteOffsetMap);
+        // @infection-ignore-all — defensive backstop, unreachable from valid input by
+        // construction (see unboundDeclarationMarkerMessage): no test can reach a
+        // mutant here. The message builder is pinned by direct unit tests; this
+        // wiring exists to turn any FUTURE marker-alignment bug into a loud compile
+        // error instead of a silent de-generification of the declaration.
+        if ($unbound !== null) {
+            throw new RuntimeException($unbound);
+        }
 
         return [$ast, $byteOffsetMap];
     }
@@ -163,7 +186,7 @@ public function parseTolerant(string $source): ?array
      */
     public function parseTolerantWithMap(string $source): ?ParseWithMapResult
     {
-        [$classMarkers, $nameMarkers, $methodMarkers, $cleanedSource, $byteOffsetMap] = $this->scanAndStrip($source);
+        [$classMarkers, $nameMarkers, $methodMarkers, $cleanedSource, $byteOffsetMap, $closureMarkers] = $this->scanAndStrip($source);
 
         $errorHandler = new \PhpParser\ErrorHandler\Collecting();
         $ast = $this->parser->parse($cleanedSource, $errorHandler);
@@ -172,7 +195,7 @@ public function parseTolerantWithMap(string $source): ?ParseWithMapResult
         }
         /** @var list<Node\Stmt> $ast — nikic's parse() returns array<Stmt>; runtime keys are always 0..N-1. */
 
-        $this->resolveAndAttach($ast, $classMarkers, $nameMarkers, $methodMarkers);
+        $this->resolveAndAttach($ast, $classMarkers, $nameMarkers, $methodMarkers, $closureMarkers, $byteOffsetMap);
 
         return new ParseWithMapResult($ast, $byteOffsetMap);
     }
@@ -197,7 +220,7 @@ public function strip(string $source): string
     }
 
     /**
-     * @return array{0: list<array{line:int, name:string, kind:string, bytePosition:int, params:list<array{name:string, bound:?BoundDict, default:?TypeRef, variance:Variance}>}>, 1: list<array{line:int, anchorLine:int, name:string, kind:string, bytePosition:int, args:list<TypeRef>}>, 2: list<array{line:int, name:string, kind:string, bytePosition:int, params:list<array{name:string, bound:?BoundDict, default:?TypeRef, variance:Variance}>}>, 3: string, 4: ByteOffsetMap}
+     * @return array{0: list<array{line:int, name:string, kind:string, bytePosition:int, params:list<array{name:string, bound:?BoundDict, default:?TypeRef, variance:Variance}>}>, 1: list<array{line:int, anchorLine:int, name:string, kind:string, bytePosition:int, args:list<TypeRef>}>, 2: list<array{line:int, name:string, kind:string, bytePosition:int, params:list<array{name:string, bound:?BoundDict, default:?TypeRef, variance:Variance}>}>, 3: string, 4: ByteOffsetMap, 5: list<array{bytePosition:int, signature:ClosureSignature}>}
      */
     private function scanAndStrip(string $source): array
     {
@@ -209,6 +232,8 @@ private function scanAndStrip(string $source): array
         $classMarkers = [];
         $nameMarkers = [];
         $methodMarkers = [];
+        /** @var list<array{bytePosition:int, signature:ClosureSignature}> $closureMarkers */
+        $closureMarkers = [];
         /** @var list<array{int, int, string}> $replacements [byte offset, original length, replacement text] */
         $replacements = [];
 
@@ -216,14 +241,17 @@ private function scanAndStrip(string $source): array
         while ($i < $n) {
             $tok = $tokens[$i];
 
-            // Anonymous closure: `function<T>(...){}` or
-            // `static function<T>(...){}`. Recognized by T_FUNCTION followed
-            // immediately by `<` (no T_STRING name). For `static function<T>`
-            // the leading T_STATIC was consumed in the same arm.
+            // Anonymous closure: `function<T>(...){}` / `fn<T>(...)`.
+            // Recognized by T_FUNCTION/T_FN followed immediately by `<` (no
+            // T_STRING name). `static`-prefixed shapes are consumed by the
+            // T_STATIC arm below before the loop ever reaches the keyword.
             if ($tok->id === T_FUNCTION || $tok->id === T_FN) {
                 $isArrow = $tok->id === T_FN;
-                $anchorByte = $tok->pos;
-                $anchorLine = $tok->line;
+                // An attributed closure's node starts at its first `#[`, not at
+                // the keyword — anchor the (byte-matched) marker there.
+                $anchorIdx = self::anchorPastAttributeGroups($tokens, $i);
+                $anchorByte = $tokens[$anchorIdx]->pos;
+                $anchorLine = $tokens[$anchorIdx]->line;
                 $j = self::skipWs($tokens, $i + 1);
                 if ($j < $n && $tokens[$j]->text === '<') {
                     // P5.7: defaults allowed on anonymous closures + arrows
@@ -248,7 +276,7 @@ private function scanAndStrip(string $source): array
                         $startByte = $tokens[$j]->pos;
                         $endByte = $tokens[$endIdx]->pos + strlen($tokens[$endIdx]->text);
                         $length = $endByte - $startByte;
-                        $replacements[] = [$startByte, $length, str_repeat(' ', $length)];
+                        $replacements[] = [$startByte, $length, self::blank(substr($source, $startByte, $length))];
                         $i = $endIdx + 1;
                         continue;
                     }
@@ -257,32 +285,43 @@ private function scanAndStrip(string $source): array
                 // named-function path (T_FUNCTION) or skip the token (T_FN).
             }
 
-            // `static function<T>(...)` -- the leading T_STATIC must be
-            // recognized so we can include it in the anchor byte position.
+            // `static function<T>(...)` / `static fn<T>(...)` -- the leading
+            // T_STATIC must be recognized so the anchor covers it (the node
+            // starts at `static`, or at a preceding attribute group). A static
+            // ARROW takes the ordinary arrow specialization path — it cannot
+            // bind `$this` by construction, which is the only thing the
+            // dispatcher rewrite cannot carry; static CLOSURES stay gated
+            // (kind `staticClosure` hard-fails at the call-site rewrite).
+            // Known drift: the emitted dispatcher closure is non-static, so
+            // `Closure::bind` succeeds and `ReflectionFunction::isStatic()`
+            // is false where PHP's own static arrow would refuse/report —
+            // invisible to normal calls, which never carry a `$this`.
             if ($tok->id === T_STATIC) {
                 $j = self::skipWs($tokens, $i + 1);
-                if ($j < $n && $tokens[$j]->id === T_FUNCTION) {
+                if ($j < $n && ($tokens[$j]->id === T_FUNCTION || $tokens[$j]->id === T_FN)) {
+                    $isArrow = $tokens[$j]->id === T_FN;
                     $k = self::skipWs($tokens, $j + 1);
                     if ($k < $n && $tokens[$k]->text === '<') {
                         $parsed = self::parseTypeParamList(
                             $tokens,
                             $k,
-                            allowDefaults: false,
+                            allowDefaults: $isArrow,
                             allowVariance: false,
                         );
                         if ($parsed !== null) {
                             [$paramEntries, $endIdx] = $parsed;
+                            $anchorIdx = self::anchorPastAttributeGroups($tokens, $i);
                             $methodMarkers[] = [
-                                'line' => $tok->line,
+                                'line' => $tokens[$anchorIdx]->line,
                                 'name' => '',
-                                'kind' => 'staticClosure',
-                                'bytePosition' => $tok->pos,
+                                'kind' => $isArrow ? 'arrow' : 'staticClosure',
+                                'bytePosition' => $tokens[$anchorIdx]->pos,
                                 'params' => $paramEntries,
                             ];
                             $startByte = $tokens[$k]->pos;
                             $endByte = $tokens[$endIdx]->pos + strlen($tokens[$endIdx]->text);
                             $length = $endByte - $startByte;
-                            $replacements[] = [$startByte, $length, str_repeat(' ', $length)];
+                            $replacements[] = [$startByte, $length, self::blank(substr($source, $startByte, $length))];
                             $i = $endIdx + 1;
                             continue;
                         }
@@ -293,7 +332,10 @@ private function scanAndStrip(string $source): array
 
             if ($tok->id === T_FUNCTION) {
                 $j = self::skipWs($tokens, $i + 1);
-                if ($j < $n && $tokens[$j]->id === T_STRING) {
+                // The method name is a real name (T_STRING) OR a semi-reserved keyword PHP
+                // permits as a method name (`function list<T>`) — the keyword id would otherwise
+                // fail the gate, leaving the `<T>` clause to reach php-parser as a raw error.
+                if ($j < $n && ($tokens[$j]->id === T_STRING || self::isSemiReservedName($tokens[$j]))) {
                     $methodName = $tokens[$j]->text;
                     $methodLine = $tokens[$j]->line;
                     $methodAnchorByte = $tokens[$j]->pos;
@@ -307,19 +349,31 @@ private function scanAndStrip(string $source): array
                         );
                         if ($parsed !== null) {
                             [$paramEntries, $endIdx] = $parsed;
-                            $methodMarkers[] = [
-                                'line' => $methodLine,
-                                'name' => $methodName,
-                                'kind' => 'named',
-                                'bytePosition' => $methodAnchorByte,
-                                'params' => $paramEntries,
-                            ];
-                            $startByte = $tokens[$k]->pos;
-                            $endByte = $tokens[$endIdx]->pos + strlen($tokens[$endIdx]->text);
-                            $length = $endByte - $startByte;
-                            $replacements[] = [$startByte, $length, str_repeat(' ', $length)];
-                            $i = $endIdx + 1;
-                            continue;
+                            // A function/method DECLARATION always opens its
+                            // param list right after the clause; a
+                            // `use function b<T>;` import does not. Without
+                            // this check the import's clause was recorded and
+                            // stripped, leaving a marker no AST node can ever
+                            // bind — misreported as a transpiler bug by the
+                            // unbound-marker backstop. Left unstripped, PHP
+                            // reports its own syntax error on the `<`, blaming
+                            // the right party.
+                            $afterClause = self::skipWs($tokens, $endIdx + 1);
+                            if ($afterClause < $n && $tokens[$afterClause]->text === '(') {
+                                $methodMarkers[] = [
+                                    'line' => $methodLine,
+                                    'name' => $methodName,
+                                    'kind' => 'named',
+                                    'bytePosition' => $methodAnchorByte,
+                                    'params' => $paramEntries,
+                                ];
+                                $startByte = $tokens[$k]->pos;
+                                $endByte = $tokens[$endIdx]->pos + strlen($tokens[$endIdx]->text);
+                                $length = $endByte - $startByte;
+                                $replacements[] = [$startByte, $length, self::blank(substr($source, $startByte, $length))];
+                                $i = $endIdx + 1;
+                                continue;
+                            }
                         }
                     }
                 }
@@ -353,7 +407,7 @@ private function scanAndStrip(string $source): array
                             $startByte = $tokens[$k]->pos;
                             $endByte = $tokens[$endIdx]->pos + strlen($tokens[$endIdx]->text);
                             $length = $endByte - $startByte;
-                            $replacements[] = [$startByte, $length, str_repeat(' ', $length)];
+                            $replacements[] = [$startByte, $length, self::blank(substr($source, $startByte, $length))];
                             $i = $endIdx + 1;
                             continue;
                         }
@@ -387,6 +441,36 @@ private function scanAndStrip(string $source): array
                     }
                     if ($parsed !== null) {
                         [$args, $endIdx] = $parsed;
+                        // A `variableTurbofish` marker only ever binds a standalone
+                        // `$f::<…>(…)` call (nikic parses that as FuncCall(name: Variable)).
+                        // When this T_VARIABLE is instead a DYNAMIC MEMBER NAME (`$o->$m`,
+                        // `$o?->$m`, `Foo::$m`) or a VARIABLE-VARIABLE (`$$g`), the node is a
+                        // MethodCall/StaticCall/dynamic-name FuncCall the marker can never
+                        // bind — so it was silently dropped while the `::<…>` was stripped,
+                        // leaving a bare dynamic call against a method that now exists only
+                        // in its `_T_<hash>` form: a runtime fatal behind a clean gate.
+                        // The name is a runtime value, so the turbofish is unmonomorphizable;
+                        // reject it loudly (at its real line) instead. A standalone receiver
+                        // (any other preceding token) is untouched — closure turbofish works.
+                        // Defensive bounds only: skipWsBack can't actually walk off the front here
+                        // (index 0 is always the T_OPEN_TAG, never whitespace), and even if it did,
+                        // T_OPEN_TAG is none of the reject tokens — so this guard never changes the
+                        // outcome and is left un-annotated, keeping the reject discriminator below
+                        // fully exposed to mutation testing (each clause is killed by its own fixture).
+                        $prev = $tokens[self::skipWsBack($tokens, $i - 1)] ?? null;
+                        if ($prev !== null
+                            && ($prev->id === T_OBJECT_OPERATOR
+                                || $prev->id === T_NULLSAFE_OBJECT_OPERATOR
+                                || $prev->id === T_DOUBLE_COLON
+                                || $prev->text === '$')
+                        ) {
+                            throw new XphpParseException(
+                                'A turbofish (`::<…>`) on a dynamically-named method or static '
+                                . 'call cannot be monomorphized; the method name must be a '
+                                . 'literal identifier, not a variable',
+                                $tok->line,
+                            );
+                        }
                         $varName = substr($tok->text, 1); // strip the leading `$`
                         $nameMarkers[] = [
                             'line' => $tok->line,
@@ -399,7 +483,7 @@ private function scanAndStrip(string $source): array
                         $startByte = $dcTok->pos;
                         $endByte = $tokens[$endIdx]->pos + strlen($tokens[$endIdx]->text);
                         $length = $endByte - $startByte;
-                        $replacements[] = [$startByte, $length, str_repeat(' ', $length)];
+                        $replacements[] = [$startByte, $length, self::blank(substr($source, $startByte, $length))];
                         $i = $endIdx + 1;
                         continue;
                     }
@@ -408,6 +492,56 @@ private function scanAndStrip(string $source): array
                 continue;
             }
 
+            // Keyword-named STATIC method turbofish: `Recv::list::<…>()`. A keyword method
+            // name stays a keyword token after `::` (unlike after `->`, where PHP re-tokenizes
+            // it to T_STRING so the name-token branch below already handles the instance form),
+            // so the name-token gate misses it and the `::<…>` clause used to reach php-parser
+            // raw. Match exactly this shape — a semi-reserved keyword, preceded by `::`, followed
+            // by its own `::<…>` — and record a plain `named` marker; the resolver's StaticCall
+            // arm binds it like any other. Kept as a dedicated branch (not folded into the
+            // name-token gate) so keyword tokens never reach that gate's bare-`<`, closure-
+            // signature, or array-sugar sub-branches, where they would mis-parse constructs like
+            // `list($a, $b) = …`.
+            if (self::isSemiReservedName($tok)) {
+                $prevSig = self::skipWsBack($tokens, $i - 1);
+                if ($prevSig >= 0 && $tokens[$prevSig]->id === T_DOUBLE_COLON) {
+                    $j = self::skipWs($tokens, $i + 1);
+                    if ($j < $n && $tokens[$j]->id === T_DOUBLE_COLON) {
+                        $dcTok = $tokens[$j];
+                        $afterDc = $j + 1;
+                        $isEmptyTurbofish = $afterDc < $n
+                            && $tokens[$afterDc]->id === T_IS_NOT_EQUAL
+                            && $tokens[$afterDc]->pos === $dcTok->pos + 2;
+                        $parsed = null;
+                        if ($isEmptyTurbofish) {
+                            $parsed = [[], $afterDc];
+                        } elseif ($afterDc < $n
+                            && $tokens[$afterDc]->text === '<'
+                            && $tokens[$afterDc]->pos === $dcTok->pos + 2
+                        ) {
+                            $parsed = self::parseTypeArgList($tokens, $afterDc);
+                        }
+                        if ($parsed !== null) {
+                            [$args, $endIdx] = $parsed;
+                            $nameMarkers[] = [
+                                'line' => $tok->line,
+                                'anchorLine' => self::memberAccessReceiverLine($tokens, $i) ?? $tok->line,
+                                'name' => self::markerNameSpelling($tok->text),
+                                'kind' => 'named',
+                                'bytePosition' => $tok->pos,
+                                'args' => $args,
+                            ];
+                            $startByte = $dcTok->pos;
+                            $endByte = $tokens[$endIdx]->pos + strlen($tokens[$endIdx]->text);
+                            $length = $endByte - $startByte;
+                            $replacements[] = [$startByte, $length, self::blank(substr($source, $startByte, $length))];
+                            $i = $endIdx + 1;
+                            continue;
+                        }
+                    }
+                }
+            }
+
             // `static` is a PHP keyword (T_STATIC), not a name token, but the
             // RFC treats `static<T>` (and the sibling `self<T>` / `parent<T>`
             // pseudo-types) as valid type-hint positions. `self` / `parent` are
@@ -418,11 +552,9 @@ private function scanAndStrip(string $source): array
                 $nameLine = $tok->line;
                 // For member-access call sites (`Foo::method::<…>`, `$x->method::<…>`,
                 // `$x?->method::<…>`), walk back past the operator to the receiver and
-                // record its line as the marker's anchor. nikic sets a MethodCall /
-                // StaticCall's getStartLine() to the leftmost token in the chain — so
-                // matching against just the identifier's line breaks the moment the
-                // operator+name are split across lines, e.g. `Foo::\n    method::<int>`.
-                // The resolver matches if startLine ∈ [anchorLine, line].
+                // record its line as the marker's anchor. Matching is byte-exact
+                // against the method-name Identifier, so anchorLine is
+                // informational (diagnostics/debugging) rather than a match key.
                 $anchorLine = self::memberAccessReceiverLine($tokens, $i) ?? $nameLine;
                 $j = self::skipWs($tokens, $i + 1);
 
@@ -478,7 +610,7 @@ private function scanAndStrip(string $source): array
                             $nameMarkers[] = [
                                 'line' => $nameLine,
                                 'anchorLine' => $anchorLine,
-                                'name' => ltrim($nameText, '\\'),
+                                'name' => self::markerNameSpelling($nameText),
                                 'kind' => 'named',
                                 'bytePosition' => $tok->pos,
                                 'args' => $args,
@@ -490,7 +622,7 @@ private function scanAndStrip(string $source): array
                         $startByte = $dcTok->pos;
                         $endByte = $tokens[$endIdx]->pos + strlen($tokens[$endIdx]->text);
                         $length = $endByte - $startByte;
-                        $replacements[] = [$startByte, $length, str_repeat(' ', $length)];
+                        $replacements[] = [$startByte, $length, self::blank(substr($source, $startByte, $length))];
                         $i = $endIdx + 1;
                         continue;
                     }
@@ -504,7 +636,14 @@ private function scanAndStrip(string $source): array
                 // the Name is preceded by `new` (catches the parenless `new Foo<T>;`
                 // and `new Foo<T>` shapes that PHP accepts but the RFC turbofish
                 // requirement refuses). Type-hint sites match neither check.
-                if ($j < $n && $tokens[$j]->text === '<') {
+                // A name directly after the `function` keyword is a DECLARATION
+                // name, never a type hint — when the declaration arm declined it
+                // (a `use function b<T>;` import has no param list), the clause
+                // must survive so PHP reports its own syntax error instead of the
+                // import being silently swallowed.
+                $prevSig = self::skipWsBack($tokens, $i - 1);
+                $isDeclarationName = $prevSig >= 0 && $tokens[$prevSig]->id === T_FUNCTION;
+                if (!$isDeclarationName && $j < $n && $tokens[$j]->text === '<') {
                     $parsed = self::parseTypeArgList($tokens, $j);
                     if ($parsed !== null) {
                         [$args, $endIdx] = $parsed;
@@ -528,7 +667,7 @@ private function scanAndStrip(string $source): array
                                 $nameMarkers[] = [
                                     'line' => $nameLine,
                                     'anchorLine' => $anchorLine,
-                                    'name' => ltrim($nameText, '\\'),
+                                    'name' => self::markerNameSpelling($nameText),
                                     'kind' => 'named',
                                     'bytePosition' => $tok->pos,
                                     'args' => $args,
@@ -537,37 +676,1029 @@ private function scanAndStrip(string $source): array
                             $startByte = $tokens[$j]->pos;
                             $endByte = $tokens[$endIdx]->pos + strlen($tokens[$endIdx]->text);
                             $length = $endByte - $startByte;
-                            $replacements[] = [$startByte, $length, str_repeat(' ', $length)];
+                            $replacements[] = [$startByte, $length, self::blank(substr($source, $startByte, $length))];
                             $i = $endIdx + 1;
                             continue;
                         }
                     }
                 }
 
-                // Skip the array-type sugar in member-access context (`$x->prop[]`,
-                // `$x?->prop[]`, `Foo::bar[]`) — there the trailing `[]` is array-append
-                // or array-deref syntax, never a type-hint.
-                if (!self::isMemberAccessContext($tokens, $i)) {
-                    $arraySuffixEnd = self::parseArraySuffix($tokens, $j);
-                    if ($arraySuffixEnd !== null) {
-                        $startByte = $tok->pos;
-                        $endByte = $tokens[$arraySuffixEnd]->pos + strlen($tokens[$arraySuffixEnd]->text);
-                        $replacements[] = [$startByte, $endByte - $startByte, 'array'];
-                        $i = $arraySuffixEnd + 1;
-                        continue;
-                    }
+                // Closure signature type `Closure(params): return` in a type slot.
+                // Fires for any `Name(` not in a member-access / `new` context;
+                // `tryParseClosureSignature`'s position gate distinguishes a genuine
+                // type slot from an expression-context call (which falls through
+                // untouched), and throws the two structural errors. A signature-shaped
+                // production on a non-`Closure` name is the only-`Closure` compile error.
+                // @infection-ignore-all — the `(`/cast opener test is a fast-path guard:
+                // findClosureSigEnd re-validates the opener and returns null for anything
+                // that is not a `(` or a cast token, so negating this sub-expression only
+                // adds calls that bail to null — observably equivalent.
+                if ($j < $n && ($tokens[$j]->text === '(' || self::isCastToken($tokens[$j]))
+                    && !self::isMemberAccessContext($tokens, $i)
+                    && !self::isPrecededByNew($tokens, $i)
+                ) {
+                    $sig = self::tryParseClosureSignature($tokens, $i, $j, $source);
+                    if ($sig !== null) {
+                        [$signature, $endIdx, $spanStart, $spanLen, $replacement] = $sig;
+                        $closureMarkers[] = [
+                            'bytePosition' => $tok->pos,
+                            'signature' => $signature,
+                        ];
+                        $replacements[] = [$spanStart, $spanLen, $replacement];
+                        $i = $endIdx + 1;
+                        continue;
+                    }
+                }
+
+                // Skip the array-type sugar in member-access context (`$x->prop[]`,
+                // `$x?->prop[]`, `Foo::bar[]`) — there the trailing `[]` is array-append
+                // or array-deref syntax, never a type-hint.
+                if (!self::isMemberAccessContext($tokens, $i)) {
+                    $arraySuffixEnd = self::parseArraySuffix($tokens, $j);
+                    if ($arraySuffixEnd !== null) {
+                        $startByte = $tok->pos;
+                        $endByte = $tokens[$arraySuffixEnd]->pos + strlen($tokens[$arraySuffixEnd]->text);
+                        // `array` is shorter than most sugar spans, so byte length
+                        // can't be preserved here — but the span's newlines must be
+                        // (line-keyed markers after it depend on the line count).
+                        // ByteOffsetMap::fromReplacements absorbs the length delta.
+                        $replacements[] = [
+                            $startByte,
+                            $endByte - $startByte,
+                            'array' . self::newlinesOf(substr($source, $startByte, $endByte - $startByte)),
+                        ];
+                        $i = $arraySuffixEnd + 1;
+                        continue;
+                    }
+                }
+                $i++;
+                continue;
+            }
+
+            $i++;
+        }
+
+        $cleaned = self::applyReplacements($source, $replacements);
+        $byteOffsetMap = ByteOffsetMap::fromReplacements($replacements);
+
+        return [$classMarkers, $nameMarkers, $methodMarkers, $cleaned, $byteOffsetMap, $closureMarkers];
+    }
+
+    /**
+     * Recognize + parse a closure signature type `Closure(params): return` that
+     * begins at the `Closure`/`\Closure` name token index `$i`, where `$j` is the
+     * index of the `(` immediately following the name (past whitespace).
+     *
+     * Returns `[ClosureSignature, spanEndIdx, spanStartByte, spanLen, replacement]`
+     * when the position is a genuine type slot, or `null` when it is an ordinary
+     * expression (e.g. a call to a user function named `Closure`) that must be left
+     * untouched. Throws for the two structural errors (only-`Closure`, variadic-last).
+     *
+     * @infection-ignore-all — the accept/reject behavior (type-slot vs. call, the two
+     * structural throws) and the newline-preserving erasure math are pinned by
+     * behavioral tests; the sole residual mutant is the defensive
+     * `findClosureSigEnd() === null` guard, unreachable once the pre-filter has matched
+     * a balanced `(…)` at a genuine type slot.
+     *
+     * @param list<PhpToken> $tokens
+     * @return array{0: ClosureSignature, 1: int, 2: int, 3: int, 4: string}|null
+     */
+    private static function tryParseClosureSignature(array $tokens, int $i, int $j, string $source): ?array
+    {
+        $n = count($tokens);
+
+        // Cheap pre-filter: a signature's first inner token is type-ish, never a
+        // `$var` or literal (which a real call `Closure($x)` / `Closure(5)` has).
+        // A cast token (`Closure(int)`) is itself the whole one-scalar param list.
+        if (!self::isCastToken($tokens[$j])) {
+            $firstInner = self::skipWs($tokens, $j + 1);
+            if ($firstInner >= $n) {
+                return null;
+            }
+            $ft = $tokens[$firstInner];
+            $firstOk = self::isSigTypeToken($ft)
+                || $ft->id === T_ELLIPSIS
+                || in_array($ft->text, ['?', '(', ')', '&'], true);
+            if (!$firstOk) {
+                return null;
+            }
+        }
+
+        // Balanced end of `( … )` plus an optional `: return`.
+        $spanEnd = self::findClosureSigEnd($tokens, $j);
+        if ($spanEnd === null) {
+            return null;
+        }
+
+        // Position gate: a type slot is a param/property (a `$var` follows the whole
+        // signature) or a return type (the name follows the `:` of a `function`/`fn`
+        // declaration header — see isClosureReturnSlot). Anything else is
+        // expression-context `Closure(` — leave it.
+        $afterSpan = self::skipWs($tokens, $spanEnd + 1);
+        $isParamOrProp = $afterSpan < $n && $tokens[$afterSpan]->id === T_VARIABLE;
+        $isReturn = self::isClosureReturnSlot($tokens, $i);
+        if (!$isParamOrProp && !$isReturn) {
+            return null;
+        }
+
+        $name = ltrim($tokens[$i]->text, '\\');
+        if ($name !== 'Closure') {
+            throw new XphpParseException(sprintf(
+                'Only "Closure" may carry a call signature, "%s" may not',
+                $name,
+            ), $tokens[$i]->line);
+        }
+
+        $nullable = self::isNullablePrefixed($tokens, $i);
+        $signature = self::buildClosureSignature($tokens, $j, $source, $nullable);
+
+        // Erase to `\Closure`, preserving both the newline count (line-keyed
+        // markers depend on it) and the total byte length (byte-keyed markers —
+        // e.g. anonymous-closure generics — depend on positions after the span not
+        // shifting). `\Closure` is 8 bytes; a bare `Closure` name is only 7, so the
+        // extra `\` reclaims one blank byte from the tail (which always begins with
+        // `(`, never a newline). A fully-qualified `\Closure` name is already 8.
+        $spanStart = $tokens[$i]->pos;
+        $nameLen = strlen($tokens[$i]->text);
+        $spanEndByte = $tokens[$spanEnd]->pos + strlen($tokens[$spanEnd]->text);
+        $drop = strlen('\\Closure') - $nameLen;
+        $tail = substr($source, $spanStart + $nameLen + $drop, $spanEndByte - ($spanStart + $nameLen + $drop));
+        $replacement = '\\Closure' . self::blank($tail);
+
+        return [$signature, $spanEnd, $spanStart, $spanEndByte - $spanStart, $replacement];
+    }
+
+    /**
+     * The scalar-cast token ids (`(int)`, `(bool)`, `(float)`, `(string)`,
+     * `(array)`, `(object)`, `(unset)`). A bare single-scalar signature parameter
+     * — `Closure(int)` — is lexed by PHP as one cast token rather than
+     * `(` `int` `)`, so the scanner must accept a cast token where it expects the
+     * parameter-list parens (the same collision the engine RFC handles).
+     *
+     * @return array<int, string> token-id → canonical scalar name
+     */
+    private static function castTokenScalars(): array
+    {
+        return [
+            T_INT_CAST => 'int',
+            T_BOOL_CAST => 'bool',
+            T_DOUBLE_CAST => 'float',
+            T_STRING_CAST => 'string',
+            T_ARRAY_CAST => 'array',
+            T_OBJECT_CAST => 'object',
+            T_UNSET_CAST => 'void',
+        ];
+    }
+
+    private static function isCastToken(PhpToken $tok): bool
+    {
+        return array_key_exists($tok->id, self::castTokenScalars());
+    }
+
+    /**
+     * True for a token that can lead a signature type leaf: an ordinary name
+     * ({@see isNameToken}) plus the reserved-word type keywords `array`,
+     * `callable`, and `static`, which PHP lexes as their own tokens
+     * (T_ARRAY / T_CALLABLE / T_STATIC) rather than T_STRING — so `isNameToken`
+     * alone would miss them and a signature like `Closure(array $a): callable`
+     * would fail to erase.
+     */
+    private static function isSigTypeToken(PhpToken $tok): bool
+    {
+        return self::isNameToken($tok)
+            || $tok->id === T_ARRAY
+            || $tok->id === T_CALLABLE
+            || $tok->id === T_STATIC;
+    }
+
+    /**
+     * Index of the last token of a closure signature whose parameter list opens at
+     * `$openIdx` (a `(` OR a single cast token like `(int)`): the matching `)` (or
+     * the cast token itself), extended over an optional `: <returnType>`. `null` if
+     * the parens are unbalanced.
+     *
+     * @param list<PhpToken> $tokens
+     */
+    private static function findClosureSigEnd(array $tokens, int $openIdx): ?int
+    {
+        $n = count($tokens);
+        // @infection-ignore-all GreaterThanOrEqualTo — every caller derives $openIdx
+        // from an existing token's lookahead, so $openIdx === $n is unreachable;
+        // the guard is defensive.
+        if ($openIdx >= $n) {
+            return null;
+        }
+        if (self::isCastToken($tokens[$openIdx])) {
+            $closeIdx = $openIdx;
+        } elseif ($tokens[$openIdx]->text === '(') {
+            $depth = 0;
+            $closeIdx = null;
+            for ($i = $openIdx; $i < $n; $i++) {
+                $t = $tokens[$i]->text;
+                if ($t === '(') {
+                    $depth++;
+                } elseif ($t === ')') {
+                    $depth--;
+                    if ($depth === 0) {
+                        $closeIdx = $i;
+                        break;
+                    }
+                }
+            }
+            if ($closeIdx === null) {
+                // @infection-ignore-all ReturnRemoval — removing this early return
+                // sends `null + 1` into the skipWs below; the token near the file
+                // start it lands on is never a `:`, so the function still returns
+                // the null $closeIdx — equivalent, just accidental.
+                return null;
+            }
+        } else {
+            return null;
+        }
+        $k = self::skipWs($tokens, $closeIdx + 1);
+        if ($k < $n && $tokens[$k]->text === ':') {
+            $retStart = self::skipWs($tokens, $k + 1);
+            return self::scanTypeExprEnd($tokens, $retStart);
+        }
+        return $closeIdx;
+    }
+
+    /**
+     * Index of the last token of a type expression starting at `$idx` — a leaf
+     * (scalar / class / `Name<…>` generic / nested `Closure(…)` / nullable /
+     * parenthesised DNF group) plus any `|` / `&` union-or-intersection
+     * continuation. Stops before a top-level `$var` / `{` / `;` / `,` / `)` /
+     * `=`. `null` if nothing type-shaped is there.
+     *
+     * A `(` is a DNF group only where a LEAF may start (scan start, or right
+     * after a `|` / `&` continuation), and only when its interior is itself a
+     * valid type expression ending exactly at the matching `)` — an
+     * expression-context paren (`Closure(int) : ($flag ? …)`) fails that
+     * interior check and terminates the scan as before.
+     *
+     * @param list<PhpToken> $tokens
+     */
+    private static function scanTypeExprEnd(array $tokens, int $idx): ?int
+    {
+        $n = count($tokens);
+        $last = null;
+        $i = $idx;
+        $expectLeaf = true;
+        while ($i < $n) {
+            $t = $tokens[$i];
+            if ($t->id === T_WHITESPACE || $t->id === T_COMMENT || $t->id === T_DOC_COMMENT) {
+                $i++;
+                continue;
+            }
+            if ($t->text === '?') {
+                $last = $i;
+                $i++;
+                continue;
+            }
+            if ($t->text === '(' && $expectLeaf) {
+                $close = self::scanGroupEnd($tokens, $i);
+                if ($close === null) {
+                    break;
+                }
+                $last = $close;
+                $i = $close + 1;
+                $expectLeaf = false;
+                continue;
+            }
+            if (self::isSigTypeToken($t)) {
+                $last = $i;
+                $expectLeaf = false;
+                $la = self::skipWs($tokens, $i + 1);
+                if ($la < $n && ($tokens[$la]->text === '(' || self::isCastToken($tokens[$la])) && ltrim($t->text, '\\') === 'Closure') {
+                    $inner = self::findClosureSigEnd($tokens, $la);
+                    if ($inner === null) {
+                        return null;
+                    }
+                    $last = $inner;
+                    // @infection-ignore-all DecrementInteger — re-entering the walk AT
+                    // the consumed signature's last token (`+ 0`) only revisits a token
+                    // that cannot extend or shrink the span (it is never a name with a
+                    // consumable tail), so `$last` is unchanged. Re-entering BEFORE it
+                    // (`- 1`) is NOT equivalent (it can re-consume the nested signature
+                    // or overwrite `$last`) and is pinned by the nested-no-return test;
+                    // skipping forward (`+ 2`) is pinned by the group-with-nested-
+                    // signature test.
+                    $i = $inner + 1;
+                } elseif ($la < $n && $tokens[$la]->text === '<') {
+                    $inner = self::findAngleEnd($tokens, $la);
+                    if ($inner === null) {
+                        return null;
+                    }
+                    $last = $inner;
+                    $i = $inner + 1;
+                } else {
+                    // `Name[]` array sugar: consume the bracket pair into the
+                    // leaf so it erases with the signature (the global `T[]` →
+                    // `array` rewrite never sees it). `Name<Args>[]` is NOT
+                    // consumed — the generic-sugar combination stays the same
+                    // loud pre-existing gap it is outside signatures.
+                    $suffix = self::arraySuffixEnd($tokens, $i + 1);
+                    if ($suffix !== null) {
+                        $last = $suffix;
+                        $i = $suffix + 1;
+                    } else {
+                        $i++;
+                    }
+                }
+                continue;
+            }
+            if ($t->text === '|' || $t->text === '&') {
+                // `&` before a `$var` / `...` / `)` is a by-ref marker (belongs to
+                // the parameter, not the type) — stop. `&`/`|` before a Name, `?`,
+                // or a `(` group is an intersection / union continuation.
+                $nx = self::skipWs($tokens, $i + 1);
+                $continues = $nx < $n
+                    && (self::isSigTypeToken($tokens[$nx])
+                        || $tokens[$nx]->text === '?'
+                        || $tokens[$nx]->text === '(');
+                if (!$continues) {
+                    break;
+                }
+                $i++;
+                $expectLeaf = true;
+                continue;
+            }
+            break;
+        }
+        return $last;
+    }
+
+    /**
+     * Index of the LAST `]` of one-or-more chained EMPTY `[ ]` bracket pairs
+     * whose first `[` is the first significant token at or after `$idx`
+     * (whitespace/comments tolerated), or `null` when the next tokens are not
+     * array sugar. Chains (`T[][]`) are consumed whole, matching the global
+     * sugar's parseArraySuffix. A non-empty `[expr]` is expression syntax,
+     * never type sugar — the `]` check rejects it.
+     *
+     * @param list<PhpToken> $tokens
+     */
+    private static function arraySuffixEnd(array $tokens, int $idx): ?int
+    {
+        $n = count($tokens);
+        $end = null;
+        while (true) {
+            $open = self::skipWs($tokens, $idx);
+            if ($open >= $n || $tokens[$open]->text !== '[') {
+                return $end;
+            }
+            $close = self::skipWs($tokens, $open + 1);
+            if ($close >= $n || $tokens[$close]->text !== ']') {
+                return $end;
+            }
+            $end = $close;
+            $idx = $close + 1;
+        }
+    }
+
+    /**
+     * Index of the matching `)` for a parenthesised DNF group whose `(` sits at
+     * `$openIdx`, or `null` when the interior is not a complete type expression
+     * ending exactly at that `)`. The interior reuses the full leaf machinery
+     * (names, generics via `findAngleEnd`, nested `Closure(…)` recursion, nested
+     * groups), so an expression paren (`($flag ? a() : b())`, `($x)`) is rejected
+     * and never absorbed into a type span.
+     *
+     * @param list<PhpToken> $tokens
+     */
+    private static function scanGroupEnd(array $tokens, int $openIdx): ?int
+    {
+        $inner = self::scanTypeExprEnd($tokens, self::skipWs($tokens, $openIdx + 1));
+        if ($inner === null) {
+            // @infection-ignore-all ReturnRemoval — removing the early return sends
+            // `null + 1` into skipWs, whose result (a token near the file start) is
+            // never the group's `)`, so the ternary below still yields null.
+            return null;
+        }
+        $close = self::skipWs($tokens, $inner + 1);
+        return $close < count($tokens) && $tokens[$close]->text === ')' ? $close : null;
+    }
+
+    /**
+     * Index of the matching `>` for a `<` at `$openIdx` (generic arg clause).
+     * Assumes `splitMergedAngleTokens` has already split `>>` etc. `null` if
+     * unbalanced.
+     *
+     * @infection-ignore-all — flat balanced-angle scan; the depth logic is pinned by
+     * the nested-generic test (a broken counter leaves a stray `>` that fails to
+     * re-parse), and the sole residual mutant is the `$i < $n` loop-bound guard, which
+     * is defensive: the caller only passes a `<` that has a matching `>`.
+     *
+     * @param list<PhpToken> $tokens
+     */
+    private static function findAngleEnd(array $tokens, int $openIdx): ?int
+    {
+        $n = count($tokens);
+        $depth = 0;
+        for ($i = $openIdx; $i < $n; $i++) {
+            $t = $tokens[$i]->text;
+            if ($t === '<') {
+                $depth++;
+            } elseif ($t === '>') {
+                $depth--;
+                if ($depth === 0) {
+                    return $i;
+                }
+            }
+        }
+        return null;
+    }
+
+    /**
+     * True iff the `Closure` at `$i` sits in a genuine RETURN-TYPE slot: preceded
+     * (past an optional nullable `?` and whitespace) by `:` which closes a
+     * parameter list (or a closure's `use (…)` clause) headed by `function` / `fn`.
+     *
+     * `)`-then-`:` alone is NOT enough — a ternary's else (`$a ? b() : …`), a
+     * `case expr():` label, and every alt-syntax construct (`if/elseif/while/
+     * for/foreach/declare (…):`) produce the same pair; keying on them silently
+     * erased expression-context `Closure(…)` calls and hard-threw the
+     * only-Closure error on ordinary calls (`$a ? b() : g(FOO)`). The walk now
+     * matches the `)` back to its `(` and requires a declaration head, rejecting
+     * `C::fn()` / `$o->fn()` member CALLS whose head token is the semi-reserved
+     * `fn` / `function` after `::` / `->` / `?->`.
+     *
+     * @param list<PhpToken> $tokens
+     */
+    private static function isClosureReturnSlot(array $tokens, int $i): bool
+    {
+        $p = self::skipWsBack($tokens, $i - 1);
+        // @infection-ignore-all GreaterThanOrEqualTo — token 0 (open tag) is never
+        // `?`, so testing index 0 cannot change the outcome.
+        if ($p >= 0 && $tokens[$p]->text === '?') {
+            $p = self::skipWsBack($tokens, $p - 1);
+        }
+        // @infection-ignore-all LessThan — token 0 (open tag) is never `:`, so
+        // testing index 0 cannot change the outcome.
+        if ($p < 0 || $tokens[$p]->text !== ':') {
+            return false;
+        }
+        $q = self::skipWsBack($tokens, $p - 1);
+        // @infection-ignore-all LessThan — token 0 is always the open tag, never
+        // `)`, so testing index 0 cannot change the outcome.
+        if ($q < 0 || $tokens[$q]->text !== ')') {
+            return false;
+        }
+        $open = self::matchParenBack($tokens, $q);
+        if ($open === null) {
+            return false;
+        }
+        $h = self::skipWsBack($tokens, $open - 1);
+        // One `use (…)` layer: `function () use ($a): R` — the `)` before the
+        // `:` closes the use clause; hop to the parameter list it follows.
+        // (Use clauses don't nest, so one layer suffices.)
+        // @infection-ignore-all GreaterThanOrEqualTo — token 0 (open tag) is never
+        // T_USE, so testing index 0 cannot change the outcome.
+        if ($h >= 0 && $tokens[$h]->id === T_USE) {
+            $h = self::skipWsBack($tokens, $h - 1);
+            // @infection-ignore-all LessThan LogicalOr — token 0 is never `)`
+            // (LessThan); and a reached T_USE always has preceding significant
+            // tokens (`use` is never the first token after the open tag), so
+            // h >= 0 always holds and the OR arms cannot disagree. The `)` test
+            // itself is load-bearing: a STATIC member call of a method named
+            // `use` (`C::use($q) : …` — after `->` the name lexes as a
+            // contextual T_STRING and never reaches here) arrives with `::`
+            // before the T_USE and must be rejected — pinned by the
+            // static-use-call provider entry.
+            if ($h < 0 || $tokens[$h]->text !== ')') {
+                return false;
+            }
+            $open = self::matchParenBack($tokens, $h);
+            if ($open === null) {
+                return false;
+            }
+            $h = self::skipWsBack($tokens, $open - 1);
+        }
+        // Optional declaration pieces between the head and the `(`, walked
+        // backwards: a GENERIC clause (`function<T>(…)`, `function m<T : B>(…)`),
+        // then a NAME, then a by-ref `&` (`function &f(…)`, `fn &(…)`).
+        // @infection-ignore-all GreaterThanOrEqualTo — token 0 (open tag) is
+        // never `>`.
+        if ($h >= 0 && $tokens[$h]->text === '>') {
+            $angleOpen = self::matchAngleBack($tokens, $h);
+            if ($angleOpen === null) {
+                return false;
+            }
+            $h = self::skipWsBack($tokens, $angleOpen - 1);
+        }
+        // The name may be ANY single token: PHP allows every semi-reserved
+        // keyword as a METHOD name (`function list()`, `function default()`),
+        // and those lex as their own keyword tokens, not T_STRING — so no
+        // name-token test can enumerate them. The head check below is the real
+        // discriminator; the name slot just skips one token that is neither
+        // the by-ref marker nor the head itself.
+        // @infection-ignore-all GreaterThanOrEqualTo IncrementInteger — token 0
+        // (open tag) is never a name; and starting the back-skip one index
+        // earlier only matters when the skipped token is significant, which for
+        // the name slot is only the by-ref `&` — both routes then land on the
+        // same T_FUNCTION and accept identically.
+        if ($h >= 0 && $tokens[$h]->text !== '&'
+            && $tokens[$h]->id !== T_FUNCTION && $tokens[$h]->id !== T_FN
+        ) {
+            $h = self::skipWsBack($tokens, $h - 1);
+        }
+        // @infection-ignore-all GreaterThanOrEqualTo — token 0 is never `&`.
+        if ($h >= 0 && $tokens[$h]->text === '&') {
+            $h = self::skipWsBack($tokens, $h - 1);
+        }
+        // @infection-ignore-all LessThan — token 0 is never T_FUNCTION/T_FN, so
+        // testing index 0 cannot flip the head check.
+        if ($h < 0 || ($tokens[$h]->id !== T_FUNCTION && $tokens[$h]->id !== T_FN)) {
+            return false;
+        }
+        // `C::fn(…)` / `$o->function(…)` are member CALLS — `fn`/`function` are
+        // semi-reserved and lex as T_FN/T_FUNCTION even after `::`.
+        $before = self::skipWsBack($tokens, $h - 1);
+        // @infection-ignore-all LessThan — token 0 (open tag) is never `::`/`->`/`?->`,
+        // so testing index 0 cannot change the verdict.
+        return $before < 0 || !in_array(
+            $tokens[$before]->id,
+            [T_DOUBLE_COLON, T_OBJECT_OPERATOR, T_NULLSAFE_OBJECT_OPERATOR],
+            true,
+        );
+    }
+
+    /**
+     * Index of the `<` matching the `>` at `$closeIdx`, scanning backwards, or
+     * `null` if unbalanced. Merged `>>` tokens are already split before any
+     * signature scanning, so whole-token text compares suffice.
+     *
+     * @param list<PhpToken> $tokens
+     */
+    private static function matchAngleBack(array $tokens, int $closeIdx): ?int
+    {
+        $depth = 0;
+        // @infection-ignore-all GreaterThanOrEqualTo — token 0 is the open tag, never
+        // `<` or `>`, so excluding it from the walk cannot change the result.
+        for ($i = $closeIdx; $i >= 0; $i--) {
+            $t = $tokens[$i]->text;
+            if ($t === '>') {
+                $depth++;
+            } elseif ($t === '<') {
+                $depth--;
+                if ($depth === 0) {
+                    return $i;
+                }
+            }
+        }
+        return null;
+    }
+
+    /**
+     * Index of the `(` matching the `)` at `$closeIdx`, scanning backwards, or
+     * `null` if unbalanced. Compares whole-token text, so parens INSIDE a
+     * string/comment/cast token never perturb the depth.
+     *
+     * @param list<PhpToken> $tokens
+     */
+    private static function matchParenBack(array $tokens, int $closeIdx): ?int
+    {
+        $depth = 0;
+        // @infection-ignore-all GreaterThanOrEqualTo — token 0 is the open tag, never
+        // `(` or `)`, so excluding it from the walk cannot change the result.
+        for ($i = $closeIdx; $i >= 0; $i--) {
+            $t = $tokens[$i]->text;
+            if ($t === ')') {
+                $depth++;
+            } elseif ($t === '(') {
+                $depth--;
+                if ($depth === 0) {
+                    return $i;
+                }
+            }
+        }
+        return null;
+    }
+
+    /**
+     * True iff a `?` (nullable) immediately precedes the `Closure` at `$i`.
+     *
+     * @infection-ignore-all — flat backward token walk; the nullable/non-nullable
+     * behavior is pinned by the `?Closure` tests, and the residual `$p >= 0` guard is
+     * defensive (index 0 is always T_OPEN_TAG, so a `?` can never sit at index 0).
+     *
+     * @param list<PhpToken> $tokens
+     */
+    private static function isNullablePrefixed(array $tokens, int $i): bool
+    {
+        $p = self::skipWsBack($tokens, $i - 1);
+        return $p >= 0 && $tokens[$p]->text === '?';
+    }
+
+    /**
+     * Skip whitespace/comments walking backwards from `$i`; returns the index of
+     * the first significant token at or before `$i`, or -1.
+     *
+     * @infection-ignore-all GreaterThanOrEqualTo — `>= 0` vs `> 0` differs only in
+     * whether token 0 is tested for whitespace; token 0 is always the open tag
+     * (never T_WHITESPACE), so both stop at 0 with the same result.
+     *
+     * @param list<PhpToken> $tokens
+     */
+    private static function skipWsBack(array $tokens, int $i): int
+    {
+        while ($i >= 0
+            && ($tokens[$i]->id === T_WHITESPACE || $tokens[$i]->id === T_COMMENT || $tokens[$i]->id === T_DOC_COMMENT)) {
+            $i--;
+        }
+        return $i;
+    }
+
+    /**
+     * Canonical marker spelling for a name token: the raw source text with
+     * only the case-insensitive `namespace\` keyword prefix folded to
+     * lowercase, so it compares equal to `Name::toCodeString()` (which always
+     * emits the keyword lowercase). The leading `\` of a fully-qualified name
+     * and the `namespace\` prefix are deliberately KEPT: stripping them
+     * conflated `\App\Box` with a qualified `App\Box`, and let a bare aliased
+     * `Box` on the same line steal a `namespace\Box` marker (or vice versa) —
+     * specializing the wrong site.
+     */
+    private static function markerNameSpelling(string $nameText): string
+    {
+        if (strncasecmp($nameText, 'namespace\\', 10) === 0) {
+            return 'namespace\\' . substr($nameText, 10);
+        }
+        return $nameText;
+    }
+
+    /**
+     * The true start of an anonymous closure/arrow node whose keyword sits at
+     * `$keywordIdx`: php-parser starts the node at its FIRST token — the first
+     * attribute group when the closure is attributed — while the scanner sits
+     * on the `function` / `fn` / `static` keyword. Anonymous markers are
+     * matched byte-exact against the node start, so walk back over any number
+     * of complete `#[ … ]` groups (and the whitespace/comments between them)
+     * to the token the node actually starts at. Anything that is not a
+     * complete attribute group ends the walk.
+     *
+     * @param list<PhpToken> $tokens
+     */
+    private static function anchorPastAttributeGroups(array $tokens, int $keywordIdx): int
+    {
+        $anchor = $keywordIdx;
+        $i = self::skipWsBack($tokens, $keywordIdx - 1);
+        while ($i >= 0 && $tokens[$i]->text === ']') {
+            $open = self::matchAttributeGroupBack($tokens, $i);
+            if ($open === null) {
+                break;
+            }
+            $anchor = $open;
+            $i = self::skipWsBack($tokens, $open - 1);
+        }
+        return $anchor;
+    }
+
+    /**
+     * Match a `]` at `$closeIdx` back to the `#[` (T_ATTRIBUTE) that opens its
+     * attribute group, tracking square-bracket balance so attribute arguments
+     * containing array literals (`#[A([1, 2])]`) don't derail the walk.
+     * Returns null when the balance lands on a plain `[` instead — the `]`
+     * closed ordinary array syntax, not an attribute group.
+     *
+     * @param list<PhpToken> $tokens
+     */
+    private static function matchAttributeGroupBack(array $tokens, int $closeIdx): ?int
+    {
+        $depth = 0;
+        // @infection-ignore-all GreaterThanOrEqualTo — token 0 is the open tag, never
+        // `]`, `[`, or `#[`, so excluding it from the walk cannot change the result.
+        for ($i = $closeIdx; $i >= 0; $i--) {
+            $t = $tokens[$i];
+            if ($t->text === ']') {
+                $depth++;
+            } elseif ($t->id === T_ATTRIBUTE) {
+                $depth--;
+                if ($depth === 0) {
+                    return $i;
+                }
+            } elseif ($t->text === '[') {
+                $depth--;
+                if ($depth === 0) {
+                    return null;
+                }
+            }
+        }
+        return null;
+    }
+
+    /**
+     * Build the structured `ClosureSignature` for a `(` at `$openIdx`. Throws the
+     * variadic-not-last structural error. Nested `Closure(…)` leaves recurse.
+     *
+     * @infection-ignore-all — structural correctness (param arity, the cast-token
+     * single-scalar param, absent-vs-present return, the variadic-not-last throw,
+     * nested recursion) is pinned by behavioral accept/reject tests; the residual
+     * mutants are all `$i < $n` loop/lookahead guards and whitespace-skip offsets,
+     * equivalent because the param loop is terminated by the closing `)` the caller
+     * guarantees and the tightly-packed / spaced fixtures both assert the same shape.
+     *
+     * @param list<PhpToken> $tokens
+     */
+    private static function buildClosureSignature(array $tokens, int $openIdx, string $source, bool $nullable): ClosureSignature
+    {
+        $n = count($tokens);
+
+        // `Closure(int)` — the whole one-scalar param list is a single cast token.
+        if (self::isCastToken($tokens[$openIdx])) {
+            $scalar = self::castTokenScalars()[$tokens[$openIdx]->id];
+            // No isScalar flag here: resolveTypeRef re-derives it from SCALAR_TYPES
+            // during resolution, so setting it at scan time would be dead.
+            $params = [new ClosureSignatureParam(new SigTypeRef(new TypeRef($scalar)))];
+            $return = null;
+            $k = self::skipWs($tokens, $openIdx + 1);
+            if ($k < $n && $tokens[$k]->text === ':') {
+                [$return] = self::parseSigType($tokens, self::skipWs($tokens, $k + 1), $source);
+            }
+            return new ClosureSignature($params, $return, $nullable);
+        }
+
+        $params = [];
+        $i = self::skipWs($tokens, $openIdx + 1);
+        $sawVariadic = false;
+        while ($i < $n && $tokens[$i]->text !== ')') {
+            if ($sawVariadic) {
+                throw new XphpParseException('Only the last parameter of a Closure signature can be variadic', $tokens[$i]->line);
+            }
+            [$param, $i] = self::parseSigParam($tokens, $i, $source);
+            $params[] = $param;
+            $sawVariadic = $param->variadic;
+            $i = self::skipWs($tokens, $i);
+            if ($i < $n && $tokens[$i]->text === ',') {
+                $i = self::skipWs($tokens, $i + 1);
+            }
+        }
+        $return = null;
+        $k = self::skipWs($tokens, min($i, $n - 1) + 1);
+        if ($k < $n && $tokens[$k]->text === ':') {
+            $retStart = self::skipWs($tokens, $k + 1);
+            [$return] = self::parseSigType($tokens, $retStart, $source);
+        }
+        return new ClosureSignature($params, $return, $nullable);
+    }
+
+    /**
+     * Parse one signature parameter `type [&] [...] [$name]` beginning at `$i`.
+     *
+     * @infection-ignore-all — flat token walk reading the optional `&`, `...` and
+     * `$name` markers in order; the by-ref / variadic capture is pinned by the by-ref,
+     * variadic, and by-ref-variadic tests, and the residual mutants are `$i < $n`
+     * lookahead guards and whitespace-skip offsets equivalent under the same inputs.
+     *
+     * @param list<PhpToken> $tokens
+     * @return array{0: ClosureSignatureParam, 1: int}
+     */
+    private static function parseSigParam(array $tokens, int $i, string $source): array
+    {
+        $n = count($tokens);
+        [$type, $i] = self::parseSigType($tokens, $i, $source);
+        $i = self::skipWs($tokens, $i);
+        $byRef = false;
+        $variadic = false;
+        if ($i < $n && $tokens[$i]->text === '&') {
+            $byRef = true;
+            $i = self::skipWs($tokens, $i + 1);
+        }
+        if ($i < $n && $tokens[$i]->id === T_ELLIPSIS) {
+            $variadic = true;
+            $i = self::skipWs($tokens, $i + 1);
+        }
+        if ($i < $n && $tokens[$i]->id === T_VARIABLE) {
+            $i++;
+        }
+        return [new ClosureSignatureParam($type, $byRef, $variadic), $i];
+    }
+
+    /**
+     * Parse one signature leaf type beginning at `$i` → `[SigType, nextIdx]`.
+     * A nested `Closure(…)` becomes a `SigClosure`; a plain scalar / class /
+     * type-parameter / `Name<…>` leaf becomes a `SigTypeRef`; a flat `?A` / `A|B` /
+     * `A&B` is structured into a `SigUnion` / `SigIntersection` (the member-splitting
+     * lives in {@see parseFlatCompound}); a shape the flat splitter does not own (a
+     * DNF group, a mixed `|`/`&`, a scalar in an intersection) falls back to a
+     * gradual `SigRaw`. Members are left unresolved — the resolver walks the tree.
+     *
+     * @infection-ignore-all — leaf-kind DISPATCH (nested `SigClosure`, nullable,
+     * union/intersection, plain `SigTypeRef`) is pinned behaviorally by the parser's
+     * accept/reject fixtures; the member-splitting logic it delegates to lives in
+     * {@see parseFlatCompound} / {@see parseMemberLeaf} (fully mutation-covered), and
+     * the residual mutants here are `$i < $n` lookahead guards and whitespace-skip
+     * offsets, equivalent for the balanced, type-shaped spans the caller passes.
+     *
+     * @param list<PhpToken> $tokens
+     * @return array{0: SigType, 1: int}
+     */
+    private static function parseSigType(array $tokens, int $i, string $source): array
+    {
+        $n = count($tokens);
+        if ($i < $n && self::isNameToken($tokens[$i]) && ltrim($tokens[$i]->text, '\\') === 'Closure') {
+            $la = self::skipWs($tokens, $i + 1);
+            if ($la < $n && ($tokens[$la]->text === '(' || self::isCastToken($tokens[$la]))) {
+                $end = self::findClosureSigEnd($tokens, $la);
+                if ($end !== null) {
+                    return [new SigClosure(self::buildClosureSignature($tokens, $la, $source, false)), $end + 1];
                 }
-                $i++;
-                continue;
             }
+        }
 
-            $i++;
+        // A leading `?` marks a nullable leaf — keep the whole leaf raw for now.
+        $nullableLeaf = $i < $n && $tokens[$i]->text === '?';
+        $start = $i;
+        if ($nullableLeaf) {
+            $i = self::skipWs($tokens, $i + 1);
         }
 
-        $cleaned = self::applyReplacements($source, $replacements);
-        $byteOffsetMap = ByteOffsetMap::fromReplacements($replacements);
+        $parsed = self::parseTypeArg($tokens, $i);
+        if ($parsed === null && $i < $n && self::isSigTypeToken($tokens[$i])) {
+            // `array` / `callable` / `static` — reserved-word type keywords that
+            // parseTypeArg (T_STRING / T_NAME only) does not recognize. Build the
+            // leaf directly; resolveTypeRef treats them as built-ins via SCALAR_TYPES.
+            $parsed = [new TypeRef(strtolower($tokens[$i]->text)), $i + 1];
+        }
+        if ($parsed === null) {
+            $end = self::scanTypeExprEnd($tokens, $start);
+            $end = $end ?? $start;
+            return [new SigRaw(self::sliceTokens($tokens, $source, $start, $end)), $end + 1];
+        }
+        [$typeRef, $afterLeaf] = $parsed;
+
+        // `Name[]` array sugar lowers to `array` — the same lowering the global
+        // rewrite applies outside signatures; as a gradual leaf it can never
+        // false-reject. `Name<Args>[]` is excluded (the pre-existing loud gap).
+        $suffix = self::arraySuffixEnd($tokens, $afterLeaf);
+        if ($suffix !== null && !$typeRef->isGeneric()) {
+            $typeRef = new TypeRef('array');
+            $afterLeaf = $suffix + 1;
+        }
+
+        $peek = self::skipWs($tokens, $afterLeaf);
+        $hasUnion = $peek < $n && $tokens[$peek]->text === '|';
+        $hasIntersection = $peek < $n && $tokens[$peek]->text === '&'
+            && self::sigAmpersandIsIntersection($tokens, $peek);
+
+        // A leading `?` is `A|null`. `?A|B` / `?A&B` are invalid PHP; keep raw.
+        if ($nullableLeaf) {
+            if ($hasUnion || $hasIntersection) {
+                return self::rawSigLeaf($tokens, $source, $start, $afterLeaf);
+            }
+            return [new SigUnion([new SigTypeRef($typeRef), new SigTypeRef(new TypeRef('null'))]), $afterLeaf];
+        }
+
+        // A flat union / intersection continuation → structure it. A DNF paren, a
+        // mixed `|`/`&` at top level, or a scalar in an intersection falls back to a
+        // gradual SigRaw (structured DNF on the token side is a tracked follow-up).
+        if ($hasUnion || $hasIntersection) {
+            $compound = self::parseFlatCompound($tokens, $typeRef, $afterLeaf, $hasUnion ? '|' : '&');
+            return $compound ?? self::rawSigLeaf($tokens, $source, $start, $afterLeaf);
+        }
+
+        return [new SigTypeRef($typeRef), $afterLeaf];
+    }
+
+    /**
+     * Collect the remaining members of a FLAT union / intersection (the first is
+     * already parsed) into a {@see SigUnion} / {@see SigIntersection}. Returns null
+     * to fall back to a gradual {@see SigRaw} for a case the flat splitter does not
+     * own: a DNF group `(…)`, a mixed `|`/`&` at top level, an intersection member
+     * that is a scalar (invalid PHP), or a member that isn't a type leaf.
+     *
+     * @param list<PhpToken> $tokens
+     * @param string $sep '|' or '&'
+     * @return array{0: SigType, 1: int}|null
+     */
+    private static function parseFlatCompound(array $tokens, TypeRef $first, int $afterFirst, string $sep): ?array
+    {
+        $n = count($tokens);
+        $members = [$first];
+        $lastEnd = $afterFirst;
+        $i = self::skipWs($tokens, $afterFirst);
+        // @infection-ignore-all LessThan — `$i < $n` is a defensive bound; a well-formed
+        // signature always has a following `)` / `{`, so `$i` never reaches `$n` here.
+        while ($i < $n && $tokens[$i]->text === $sep) {
+            $j = self::skipWs($tokens, $i + 1);
+            // A member that isn't a type leaf — a DNF group `(…)`, a `?`-prefixed
+            // member, or end-of-input — bails the whole leaf to a gradual SigRaw.
+            $member = self::parseMemberLeaf($tokens, $j);
+            if ($member === null) {
+                return null;
+            }
+            [$ref, $lastEnd] = $member;
+            $members[] = $ref;
+            $i = self::skipWs($tokens, $lastEnd);
+        }
+
+        // A different separator still ahead ⇒ a mix that needs DNF parens ⇒ bail.
+        // @infection-ignore-all LessThan — `$i < $n` is a defensive bound (a following
+        // `)` / `{` always exists); the separator conditions are pinned behaviorally.
+        if ($i < $n && ($tokens[$i]->text === '|'
+            || ($tokens[$i]->text === '&' && self::sigAmpersandIsIntersection($tokens, $i)))
+        ) {
+            return null;
+        }
+
+        $leaves = array_map(static fn (TypeRef $r): SigTypeRef => new SigTypeRef($r), $members);
+        if ($sep === '|') {
+            return [new SigUnion($leaves), $lastEnd];
+        }
+        // A scalar member makes the intersection invalid PHP ⇒ stay gradual (raw).
+        foreach ($members as $member) {
+            // @infection-ignore-all UnwrapLtrim/UnwrapStrToLower — a scalar keyword is
+            // never fully-qualified and arrives lowercased from the grammar, so both
+            // normalizations are defensive (same rationale as resolveTypeRef's scalar guard).
+            if (in_array(strtolower(ltrim($member->name, '\\')), self::SCALAR_TYPES, true)) {
+                return null;
+            }
+        }
+        return [new SigIntersection($leaves), $lastEnd];
+    }
+
+    /**
+     * Parse one union / intersection MEMBER leaf → `[TypeRef, nextIdx]`, or null if
+     * the position isn't a type leaf. Mirrors the primary-leaf parse in
+     * {@see parseSigType}: a `Name` / `Name<…>` via {@see parseTypeArg}, or a
+     * reserved-word type keyword (`array` / `callable` / `static`).
+     *
+     * @param list<PhpToken> $tokens
+     * @return array{0: TypeRef, 1: int}|null
+     */
+    private static function parseMemberLeaf(array $tokens, int $i): ?array
+    {
+        $parsed = self::parseTypeArg($tokens, $i);
+        if ($parsed === null) {
+            // @infection-ignore-all LessThan UnwrapStrToLower — the `$i < count` bound
+            // is defensive (the caller only reaches here mid-span, never at
+            // end-of-input); `strtolower` matches the first-leaf keyword branch but
+            // the resolver re-lowercases, so it is redundant. (The `$i + 1` end index
+            // is NOT ignored — it is pinned by a keyword-member-followed-by-parameter
+            // test.)
+            if ($i < count($tokens) && self::isSigTypeToken($tokens[$i])) {
+                $parsed = [new TypeRef(strtolower($tokens[$i]->text)), $i + 1];
+            }
+        }
+        if ($parsed === null) {
+            return null;
+        }
+        // Member-level `Name[]` sugar lowers to `array`, same as the first leaf.
+        [$ref, $next] = $parsed;
+        $suffix = self::arraySuffixEnd($tokens, $next);
+        if ($suffix !== null && !$ref->isGeneric()) {
+            return [new TypeRef('array'), $suffix + 1];
+        }
+        return $parsed;
+    }
+
+    /**
+     * The gradual {@see SigRaw} fallback for a compound leaf the flat splitter does
+     * not own — spans from `$start` to the end of the type expression.
+     *
+     * @infection-ignore-all — pure index plumbing: the `?? ($afterLeaf - 1)` arm is
+     * unreachable (scanTypeExprEnd returns non-null for the balanced spans that reach a
+     * bail), and the `$end + 1` next-index is the parser's shared convention, absorbed
+     * by every caller's `skipWs`, so a ±1 shift is unobservable. The raw text is
+     * display-only for a gradual leaf. Bail *detection* is pinned behaviorally.
+     *
+     * @param list<PhpToken> $tokens
+     * @return array{0: SigRaw, 1: int}
+     */
+    private static function rawSigLeaf(array $tokens, string $source, int $start, int $afterLeaf): array
+    {
+        $end = self::scanTypeExprEnd($tokens, $start) ?? ($afterLeaf - 1);
+        return [new SigRaw(self::sliceTokens($tokens, $source, $start, $end)), $end + 1];
+    }
+
+    /**
+     * True iff the `&` at `$idx` continues an intersection type (a Name follows)
+     * rather than marking a by-reference parameter (a `$var` / `...` follows).
+     *
+     * @infection-ignore-all — flat one-token lookahead; the intersection-vs-by-ref
+     * discrimination is pinned by the intersection-by-ref and intersection-member
+     * tests, and the residual `$nx < count()` guard is defensive (a `&` is only reached
+     * mid-span, never at the token-array boundary).
+     *
+     * @param list<PhpToken> $tokens
+     */
+    private static function sigAmpersandIsIntersection(array $tokens, int $idx): bool
+    {
+        $nx = self::skipWs($tokens, $idx + 1);
+        return $nx < count($tokens)
+            && (self::isSigTypeToken($tokens[$nx]) || $tokens[$nx]->text === '?');
+    }
 
-        return [$classMarkers, $nameMarkers, $methodMarkers, $cleaned, $byteOffsetMap];
+    /**
+     * Source substring spanning token indices `$from`..`$to` inclusive.
+     *
+     * @param list<PhpToken> $tokens
+     */
+    private static function sliceTokens(array $tokens, string $source, int $from, int $to): string
+    {
+        $start = $tokens[$from]->pos;
+        $end = $tokens[$to]->pos + strlen($tokens[$to]->text);
+        return substr($source, $start, $end - $start);
     }
 
     /**
@@ -617,10 +1748,11 @@ private static function parseTypeParamList(
             // hint rather than letting them fall through to a bare `null` (which
             // would surface downstream as an opaque PHP syntax error).
             if ($i < $n && ($tokens[$i]->text === '+' || $tokens[$i]->text === '-')) {
-                throw new RuntimeException(
+                throw new XphpParseException(
                     'The `+T` / `-T` variance syntax was replaced by `out T` / `in T`. '
                     . 'Write `out` for covariance and `in` for contravariance, e.g. '
                     . '`class Box<out T>` or `class Consumer<in T>`.',
+                    $tokens[$i]->line,
                 );
             }
 
@@ -638,13 +1770,14 @@ private static function parseTypeParamList(
                 $afterMarker = self::skipWs($tokens, $i + 1);
                 if ($afterMarker < $n && self::isNameToken($tokens[$afterMarker])) {
                     if (!$allowVariance) {
-                        throw new RuntimeException(
+                        throw new XphpParseException(
                             'Variance markers `out T` / `in T` are not supported on methods, '
                             . 'functions, closures, or arrow functions — variance is a '
                             . 'class-level-only feature by design: a function or closure '
                             . 'specialization has no stable class identity to anchor a '
                             . 'subtype `extends` edge to. Move the generic to a class-level '
                             . 'type parameter.',
+                            $tokens[$i]->line,
                         );
                     }
                     $variance = $tokens[$i]->text === 'out'
@@ -658,6 +1791,7 @@ private static function parseTypeParamList(
                 return null;
             }
             $paramName = ltrim($tokens[$i]->text, '\\');
+            $paramNameLine = $tokens[$i]->line;
             $i++;
 
             // Reserve `out` / `in` as variance markers: they can never name a
@@ -667,10 +1801,11 @@ private static function parseTypeParamList(
             // second `out` read as the name), `class Pair<in, out>`,
             // `class Box<in : Foo>` — all reject with a single diagnostic.
             if (in_array($paramName, ['out', 'in'], true)) {
-                throw new RuntimeException(
+                throw new XphpParseException(
                     '`out` and `in` are variance markers and cannot name a type parameter. '
                     . 'Use `out T` for covariance or `in T` for contravariance, and pick a '
                     . 'different name for the parameter itself.',
+                    $paramNameLine,
                 );
             }
 
@@ -689,22 +1824,22 @@ private static function parseTypeParamList(
             $afterBound = self::skipWs($tokens, $i);
             if ($afterBound < $n && $tokens[$afterBound]->text === '=') {
                 if (!$allowDefaults) {
-                    throw new RuntimeException(sprintf(
+                    throw new XphpParseException(sprintf(
                         'Generic parameter `%s` has a default value, which is not yet '
                         . 'supported on static closures. Drop the `static` modifier or '
                         . 'assign the closure to a named function.',
                         $paramName,
-                    ));
+                    ), $tokens[$afterBound]->line);
                 }
                 $afterEq = self::skipWs($tokens, $afterBound + 1);
                 $parsedDefault = self::parseTypeArg($tokens, $afterEq);
                 if ($parsedDefault === null) {
-                    throw new RuntimeException(sprintf(
+                    throw new XphpParseException(sprintf(
                         'Generic parameter `%s` has an invalid default; only a single '
                         . 'concrete or generic type is allowed after `=` (no nullable '
                         . 'or union shapes).',
                         $paramName,
-                    ));
+                    ), $tokens[$afterBound]->line);
                 }
                 [$default, $i] = $parsedDefault;
                 // Reject `T = Box | Other` (union) and `T = Box & Other` (intersection)
@@ -715,20 +1850,20 @@ private static function parseTypeParamList(
                 if ($afterDefault < $n
                     && ($tokens[$afterDefault]->text === '|' || $tokens[$afterDefault]->text === '&')
                 ) {
-                    throw new RuntimeException(sprintf(
+                    throw new XphpParseException(sprintf(
                         'Generic parameter `%s` has an invalid default; only a single '
                         . 'concrete or generic type is allowed after `=` (no nullable '
                         . 'or union shapes).',
                         $paramName,
-                    ));
+                    ), $tokens[$afterDefault]->line);
                 }
                 $sawDefault = true;
             } elseif ($sawDefault) {
-                throw new RuntimeException(sprintf(
+                throw new XphpParseException(sprintf(
                     'Generic parameter `%s` has no default but follows a parameter with '
                     . 'a default. Required type parameters must precede defaulted ones.',
                     $paramName,
-                ));
+                ), $paramNameLine);
             }
 
             $entries[] = [
@@ -1306,6 +2441,23 @@ private static function isNameToken(PhpToken $tok): bool
             || $tok->id === T_NAME_RELATIVE;
     }
 
+    /**
+     * A semi-reserved keyword usable as a method NAME. PHP has permitted every keyword
+     * (`list`, `print`, `for`, `default`, …) as a method name since 7.0, so a keyword-named
+     * generic method — `public function list<T>(…)` and its static call `Recv::list::<…>()` —
+     * must be recognized where `isNameToken` (which covers only real name tokens) would miss it.
+     * Deliberately excludes name tokens (handled by the isNameToken paths) and variables, and
+     * tests the token's TEXT against PHP's label grammar so punctuation (`(`, `&`, `<`) and
+     * `$vars` never qualify. The instance call `$o->list::<…>()` needs no help — PHP re-tokenizes
+     * `list` as T_STRING after `->`; only the after-`::` and declaration positions keep the keyword id.
+     */
+    private static function isSemiReservedName(PhpToken $tok): bool
+    {
+        return !self::isNameToken($tok)
+            && $tok->id !== T_VARIABLE
+            && preg_match('/^[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff]*$/', $tok->text) === 1;
+    }
+
     /**
      * `self` / `static` / `parent` are PHP keywords that resolve dynamically
      * at runtime against the currently-executing class. xphp's scanner sees
@@ -1336,6 +2488,29 @@ private static function isPseudoType(string $name): bool
         );
     }
 
+    /**
+     * Equal-length whitespace for a stripped span, keeping every newline byte
+     * in place: byte-keyed markers after the span rely on the length, and
+     * line-keyed (class / method / name) markers rely on the line count — a
+     * multi-line `<…>` clause, turbofish arg list, or sugar span collapsed to
+     * spaces would shift every later marker off its node. Deliberately
+     * byte-wise (no `/u`): a multibyte character inside the span must blank
+     * to one space PER BYTE or the length invariant breaks.
+     */
+    private static function blank(string $span): string
+    {
+        return preg_replace('/[^\r\n]/', ' ', $span) ?? '';
+    }
+
+    /**
+     * Just the newline bytes of a span, for length-CHANGING rewrites (the
+     * `T[]` -> `array` sugar) that still must not swallow line breaks.
+     */
+    private static function newlinesOf(string $span): string
+    {
+        return preg_replace('/[^\r\n]/', '', $span) ?? '';
+    }
+
     /**
      * @param list<array{int, int, string}> $replacements [byte offset, original length, replacement text]
      */
@@ -1359,19 +2534,26 @@ private static function applyReplacements(string $source, array $replacements):
      * recognition (closures / arrows, Phase 4) can dispatch to a different
      * matcher without having to peek at the rest of the marker shape.
      *
+     * Returns the loud-backstop error for the first class/method marker left
+     * unbound after the walk (always a transpiler alignment bug), or null when
+     * every declaration marker attached. The strict parse path throws it; the
+     * tolerant (LSP) path ignores it — half-typed code legitimately strands
+     * markers there.
+     *
      * @param list<Node\Stmt> $ast
      * @param list<array{line:int, name:string, kind:string, bytePosition:int, params:list<array{name:string, bound:?BoundDict, default:?TypeRef, variance:Variance}>}> $classMarkers
      * @param list<array{line:int, anchorLine:int, name:string, kind:string, bytePosition:int, args:list<TypeRef>}> $nameMarkers
      * @param list<array{line:int, name:string, kind:string, bytePosition:int, params:list<array{name:string, bound:?BoundDict, default:?TypeRef, variance:Variance}>}> $methodMarkers
+     * @param list<array{bytePosition:int, signature:ClosureSignature}> $closureMarkers
      */
-    private function resolveAndAttach(array $ast, array $classMarkers, array $nameMarkers, array $methodMarkers): void
+    private function resolveAndAttach(array $ast, array $classMarkers, array $nameMarkers, array $methodMarkers, array $closureMarkers, ByteOffsetMap $byteOffsetMap): ?string
     {
         $traverser = new NodeTraverser();
-        $traverser->addVisitor(new
+        $visitor = new
             /**
              * @phpstan-import-type BoundDict from XphpSourceParser
              */
-            class($classMarkers, $nameMarkers, $methodMarkers) extends NodeVisitorAbstract {
+            class($classMarkers, $nameMarkers, $methodMarkers, $closureMarkers, $byteOffsetMap) extends NodeVisitorAbstract {
             private NamespaceContext $ctx;
             /** @var list<list<string>> stack of enclosing type-param scopes */
             private array $typeParamStack = [];
@@ -1385,25 +2567,40 @@ class($classMarkers, $nameMarkers, $methodMarkers) extends NodeVisitorAbstract {
              * @param array<int, array{line:int, name:string, kind:string, bytePosition:int, params:list<array{name:string, bound:?BoundDict, default:?TypeRef, variance:Variance}>}> $classMarkers
              * @param array<int, array{line:int, anchorLine:int, name:string, kind:string, bytePosition:int, args:list<TypeRef>}> $nameMarkers
              * @param array<int, array{line:int, name:string, kind:string, bytePosition:int, params:list<array{name:string, bound:?BoundDict, default:?TypeRef, variance:Variance}>}> $methodMarkers
+             * @param array<int, array{bytePosition:int, signature:ClosureSignature}> $closureMarkers
              */
             public function __construct(
                 private array $classMarkers,
                 private array $nameMarkers,
                 private array $methodMarkers,
+                private array $closureMarkers,
+                private ByteOffsetMap $byteOffsetMap,
             ) {
                 $this->ctx = new NamespaceContext();
             }
 
             public function enterNode(Node $node): null
             {
+                if ($node instanceof Use_ || $node instanceof GroupUse) {
+                    // Reject a generic clause on a namespace-import BEFORE the blanket
+                    // Name branch below resolves its marker (which mis-qualifies the
+                    // already-absolute import name) or CallSiteRewriter emits an
+                    // absolute specialized name inside a `use N\{…}` prefix group
+                    // (unparseable PHP). A generic TRAIT-use is a Stmt\TraitUse — a
+                    // different node that never reaches here and keeps specializing.
+                    $this->rejectGenericClauseOnImport($node);
+                }
+
                 if ($node instanceof Namespace_) {
                     // @infection-ignore-all — bare `namespace { ... }` (no name) isn't used in any
                     // fixture; the null-coalesce branch never observably differs from a missing name.
                     $this->ctx->enterNamespace($node->name?->toString());
-                    // @infection-ignore-all — redundant with the standalone Use_ branch below; dead loop.
+                    // @infection-ignore-all — redundant with the standalone Use_/GroupUse branches below; dead loop.
                     foreach ($node->stmts as $inner) {
                         if ($inner instanceof Use_) {
                             $this->ctx->indexUse($inner);
+                        } elseif ($inner instanceof GroupUse) {
+                            $this->ctx->indexGroupUse($inner);
                         }
                     }
                 }
@@ -1411,13 +2608,24 @@ public function enterNode(Node $node): null
                 if ($node instanceof Use_) {
                     // @infection-ignore-all — dual-handled by the inner foreach above.
                     $this->ctx->indexUse($node);
+                } elseif ($node instanceof GroupUse) {
+                    // @infection-ignore-all — dual-handled by the inner foreach above.
+                    $this->ctx->indexGroupUse($node);
                 }
 
                 if ($node instanceof ClassLike && $node->name !== null) {
                     $shortName = $node->name->toString();
+                    // Match on the NAME Identifier's BYTE (mapped back to the
+                    // original source): the node starts at its first attribute
+                    // group or modifier, and line-keyed matching let two
+                    // same-name declarations on ONE line steal each other's
+                    // markers (`if(){class B}else{class B<T>}` handed the
+                    // clause to the plain class). The marker records the name
+                    // token's byte, which is unique per declaration.
+                    $classNameByte = $this->originalByteOf($node->name);
                     $paramEntries = null;
                     foreach ($this->classMarkers as $i => $marker) {
-                        if ($marker['line'] === $node->getStartLine() && $marker['name'] === $shortName) {
+                        if ($marker['bytePosition'] === $classNameByte && $marker['name'] === $shortName) {
                             $paramEntries = $marker['params'];
                             unset($this->classMarkers[$i]);
                             // @infection-ignore-all — break vs continue is equivalent after unset (marker is gone).
@@ -1465,29 +2673,50 @@ public function enterNode(Node $node): null
                     }
                 }
 
+                if ($node instanceof ClassLike) {
+                    // Rewrite generic-trait adaptation operands (`insteadof` / `as`)
+                    // to the same specialized FQN as their `use`-list entry. Runs
+                    // after the namespace/use context is set (Namespace_/Use_ branches
+                    // above) and this class's type params are pushed, so the list
+                    // entry's args resolve exactly as the blanket Name branch that
+                    // specializes the list itself.
+                    $this->markTraitUseAdaptations($node);
+                }
+
                 if ($node instanceof Node\Stmt\ClassMethod
                     || $node instanceof Node\Stmt\Function_
                     || $node instanceof Node\Expr\Closure
                     || $node instanceof Node\Expr\ArrowFunction
                 ) {
-                    // Named templates match by (line, name); anonymous templates
-                    // (closures + arrows) match by (line, bytePosition) -- the
-                    // bytePosition recorded at the `function` / `static` / `fn`
-                    // keyword aligns with nikic's `getStartFilePos()` for the
-                    // same AST node.
+                    // Named templates match by (name line, name); anonymous templates
+                    // (closures + arrows) match by (kind, bytePosition). The marker
+                    // records the ORIGINAL-source byte of the node's first token (the
+                    // first attribute group, `static`, or the keyword itself),
+                    // while getStartFilePos() reports the STRIPPED-source
+                    // byte -- a length-changing rewrite earlier in the file (e.g.
+                    // `LongName[]` -> `array`) shifts the two apart, so the stripped
+                    // position maps back through the byte-offset map before comparing
+                    // (same translation as attachClosureSig below).
                     $isAnonymous = $node instanceof Node\Expr\Closure
                         || $node instanceof Node\Expr\ArrowFunction;
                     $declName = $isAnonymous ? '' : $node->name->toString();
-                    $nodeStartByte = $node->getStartFilePos();
+                    // Named declarations match on the NAME Identifier's BYTE
+                    // (the node itself starts at its first attribute group or
+                    // modifier; a shared line no longer conflates two
+                    // declarations). Anonymous ones match the node's own start
+                    // byte — the marker anchored at the first attribute group,
+                    // `static`, or the keyword.
+                    $declByte = $isAnonymous ? -1 : $this->originalByteOf($node->name);
+                    $nodeStartByte = $this->byteOffsetMap->toOriginal($node->getStartFilePos());
                     $matchedParamNames = [];
                     foreach ($this->methodMarkers as $i => $marker) {
                         // @infection-ignore-all -- markers are populated jointly with
-                        // both halves of the (line, name) or (kind, bytePosition) pair;
-                        // any single-clause-only input is unreachable from the scanner.
+                        // both halves of the (name byte, name) or (kind, bytePosition)
+                        // pair; any single-clause-only input is unreachable from the scanner.
                         $isMatch = $isAnonymous
                             ? ($marker['kind'] !== 'named'
                                 && $marker['bytePosition'] === $nodeStartByte)
-                            : ($marker['line'] === $node->getStartLine()
+                            : ($marker['bytePosition'] === $declByte
                                 && $marker['name'] === $declName);
                         if ($isMatch) {
                             // Same two-pass scope-push-before-bound-build pattern
@@ -1544,18 +2773,17 @@ public function enterNode(Node $node): null
                     && $node->name instanceof Node\Identifier
                 ) {
                     $callMethodName = $node->name->toString();
-                    $startLine = $node->getStartLine();
+                    // Match by the method-name Identifier's BYTE — the marker
+                    // anchored at the method token, so this is exact for
+                    // multi-line chains (`Foo::\n method::<int>`) AND for two
+                    // same-name calls sharing a line (the old line-range match
+                    // let `Plain::pick(5) + Util::pick::<int>(4)` cross-claim,
+                    // false-rejecting both). Covers static, instance, and
+                    // nullsafe calls alike.
+                    $methodNameByte = $this->originalByteOf($node->name);
                     foreach ($this->nameMarkers as $i => $marker) {
-                        // Match by name + line-range overlap. The Call node's
-                        // getStartLine() is the receiver's line; the marker's anchorLine
-                        // is the same, and its (later) line is the identifier's line.
-                        // Both can differ on multi-line `Foo::\n    method::<int>` or
-                        // `$obj->\n    method::<int>` constructs. The same logic now
-                        // covers static, instance, and nullsafe method calls -- the
-                        // GenericMethodCompiler distinguishes them later by AST type.
                         if ($marker['name'] === $callMethodName
-                            && $startLine >= $marker['anchorLine']
-                            && $startLine <= $marker['line']
+                            && $marker['bytePosition'] === $methodNameByte
                         ) {
                             $resolvedArgs = $this->resolveTypeRefList($marker['args']);
                             $node->setAttribute(XphpSourceParser::ATTR_METHOD_GENERIC_ARGS, $resolvedArgs);
@@ -1569,15 +2797,21 @@ public function enterNode(Node $node): null
                 if ($node instanceof Node\Expr\FuncCall && $node->name instanceof Name) {
                     // Claim the marker on FuncCall enter (parent fires before children) so the
                     // inner Name doesn't pick it up and trigger the class-rewrite path.
-                    $funcName = $node->name->toString();
-                    $startLine = $node->getStartLine();
+                    // toCodeString(): markers record the raw source spelling, so a
+                    // `\App\make` / `namespace\make` marker must compare against the
+                    // node's own qualified spelling, not the prefix-erased toString().
+                    $funcName = $node->name->toCodeString();
+                    // Byte of the callee Name node — exact even for two
+                    // same-name turbofish calls sharing a line. The
+                    // variableTurbofish kind-guard is belt-and-braces (a
+                    // Variable marker's byte is a `$`, never a name byte).
+                    $calleeByte = $this->originalByteOf($node->name);
                     foreach ($this->nameMarkers as $i => $marker) {
-                        // @infection-ignore-all -- the three `&&` clauses are jointly
+                        // @infection-ignore-all -- the clauses are jointly
                         // populated when a marker is created; any single-clause-only
                         // input is unreachable from XphpSourceParser's own scanner.
                         if ($marker['name'] === $funcName
-                            && $startLine >= $marker['anchorLine']
-                            && $startLine <= $marker['line']
+                            && $marker['bytePosition'] === $calleeByte
                             && $marker['kind'] !== 'variableTurbofish'
                         ) {
                             $resolvedArgs = $this->resolveTypeRefList($marker['args']);
@@ -1590,6 +2824,31 @@ public function enterNode(Node $node): null
                     }
                 }
 
+                // Free-function callee: record its resolved FQN (honoring `use function`
+                // + namespace) so the Specializer can fully-qualify it on a relocated
+                // clone when the unit defines it. Skip generic-turbofish calls (owned by
+                // GenericMethodCompiler, marked with ATTR_METHOD_GENERIC_ARGS above) and
+                // variable callees (`$fn()` — not a Name).
+                if ($node instanceof Node\Expr\FuncCall
+                    && $node->name instanceof Name
+                    && $node->getAttribute(XphpSourceParser::ATTR_METHOD_GENERIC_ARGS) === null
+                ) {
+                    $node->name->setAttribute(
+                        XphpSourceParser::ATTR_RESOLVED_FUNC_FQN,
+                        $this->ctx->resolveFunctionName($node->name),
+                    );
+                }
+
+                // Const fetch: record its resolved FQN the same way. `true`/`false`/`null`
+                // are ConstFetch nodes too, but their resolved FQN is never in the const
+                // set, so the Specializer's in-set guard leaves them untouched.
+                if ($node instanceof Node\Expr\ConstFetch) {
+                    $node->name->setAttribute(
+                        XphpSourceParser::ATTR_RESOLVED_CONST_FQN,
+                        $this->ctx->resolveConstName($node->name),
+                    );
+                }
+
                 // Variable-turbofish call site: `$var::<...>(...)` -- nikic
                 // parses this (after the scanner stripped `::<...>`) as
                 // `FuncCall(name: Variable, args: [...])`. The marker's name
@@ -1599,16 +2858,18 @@ public function enterNode(Node $node): null
                     && is_string($node->name->name)
                 ) {
                     $varName = $node->name->name;
-                    $startLine = $node->getStartLine();
+                    // Byte of the Variable node's `$` — equals the recorded
+                    // T_VARIABLE position; exact for repeated `$f::<…>` calls
+                    // of the same variable on one line.
+                    $varByte = $this->originalByteOf($node->name);
                     foreach ($this->nameMarkers as $i => $marker) {
                         // @infection-ignore-all -- markers are populated jointly:
-                        // kind/name/anchorLine/line are all set together by the
+                        // kind/name/bytePosition are all set together by the
                         // scanner's variable-turbofish arm, so single-clause
                         // dropouts are unreachable.
                         if ($marker['kind'] === 'variableTurbofish'
                             && $marker['name'] === $varName
-                            && $startLine >= $marker['anchorLine']
-                            && $startLine <= $marker['line']
+                            && $marker['bytePosition'] === $varByte
                         ) {
                             $resolvedArgs = $this->resolveTypeRefList($marker['args']);
                             $node->setAttribute(XphpSourceParser::ATTR_METHOD_GENERIC_ARGS, $resolvedArgs);
@@ -1620,9 +2881,20 @@ public function enterNode(Node $node): null
                 }
 
                 if ($node instanceof Name) {
-                    $nameStr = $node->toString();
+                    // toCodeString(): a Relative node's toString() erases the
+                    // `namespace\` prefix, so a bare `Box` node on the same line
+                    // could steal a `namespace\Box` marker (and the relative
+                    // node's own marker never matched at all — silently dropping
+                    // its type args). The marker records the source spelling.
+                    $nameStr = $node->toCodeString();
+                    // Byte of the Name node itself — the old line match let a
+                    // plain same-spelling hint on the same line steal a generic
+                    // hint's marker (`f(Box $a, Box<int> $b)` specialized the
+                    // wrong parameter), and a return hint could steal a `new`
+                    // turbofish's marker.
+                    $nameByte = $this->originalByteOf($node);
                     foreach ($this->nameMarkers as $i => $marker) {
-                        if ($marker['line'] === $node->getStartLine() && $marker['name'] === $nameStr) {
+                        if ($marker['bytePosition'] === $nameByte && $marker['name'] === $nameStr) {
                             $resolved = $this->resolveTypeRefList($marker['args']);
                             $node->setAttribute(XphpSourceParser::ATTR_GENERIC_ARGS, $resolved);
                             $templateFqn = $this->resolveNameOnly($nameStr);
@@ -1692,6 +2964,7 @@ public function enterNode(Node $node): null
             private function markType(?Node $type): void
             {
                 if ($type instanceof Name) {
+                    $this->attachClosureSig($type);
                     $this->markName($type);
                 } elseif ($type instanceof Node\NullableType) {
                     $this->markType($type->type);
@@ -1702,13 +2975,160 @@ private function markType(?Node $type): void
                 }
             }
 
+            /**
+             * If a `\Closure` type Name is the erased head of a closure signature
+             * (the `(…)[: ret]` was blanked at scan time, leaving this surviving
+             * `\Closure`), attach the resolved signature. Matched by BYTE POSITION,
+             * not by line: a plain `Closure` type hint sharing a line with a real
+             * signature (`Closure $a, Closure(int): int $b`) would otherwise steal the
+             * marker. The node's stripped-source start position maps back through the
+             * byte-offset map to the original `Closure` position the marker recorded.
+             */
+            private function attachClosureSig(Name $node): void
+            {
+                // @infection-ignore-all ReturnRemoval — fast-path guard: a
+                // non-Closure name can never match a marker anyway (each
+                // recorded bytePosition holds the erased `\Closure` name
+                // itself), so falling through only wastes loop work.
+                if (ltrim($node->toString(), '\\') !== 'Closure') {
+                    return;
+                }
+                $startPos = $node->getStartFilePos();
+                // @infection-ignore-all — defensive: getStartFilePos() only returns < 0
+                // when positions are unrecorded; a real Name never sits at byte 0 (the
+                // open tag), so shifting this boundary is unreachable with valid input.
+                if ($startPos < 0) {
+                    return;
+                }
+                $originalPos = $this->byteOffsetMap->toOriginal($startPos);
+                foreach ($this->closureMarkers as $i => $marker) {
+                    if ($marker['bytePosition'] === $originalPos) {
+                        $node->setAttribute(
+                            XphpSourceParser::ATTR_CLOSURE_SIG,
+                            $this->resolveClosureSignature($marker['signature']),
+                        );
+                        unset($this->closureMarkers[$i]);
+                        // @infection-ignore-all — break vs continue is equivalent after unset:
+                        // bytePosition is unique, so no later marker can match again.
+                        break;
+                    }
+                }
+            }
+
+            private function resolveClosureSignature(ClosureSignature $sig): ClosureSignature
+            {
+                $params = array_map(
+                    fn (ClosureSignatureParam $p): ClosureSignatureParam => new ClosureSignatureParam(
+                        $this->resolveSigType($p->type),
+                        $p->byRef,
+                        $p->variadic,
+                        $p->optional,
+                    ),
+                    $sig->params,
+                );
+                $return = $sig->return === null ? null : $this->resolveSigType($sig->return);
+
+                return new ClosureSignature($params, $return, $sig->nullable);
+            }
+
+            private function resolveSigType(SigType $type): SigType
+            {
+                if ($type instanceof SigTypeRef) {
+                    return new SigTypeRef($this->resolveTypeRef($type->type));
+                }
+                if ($type instanceof SigClosure) {
+                    return new SigClosure($this->resolveClosureSignature($type->signature));
+                }
+                if ($type instanceof SigUnion) {
+                    return new SigUnion(array_map($this->resolveSigType(...), $type->members));
+                }
+                if ($type instanceof SigIntersection) {
+                    return new SigIntersection(array_map($this->resolveSigType(...), $type->members));
+                }
+
+                // SigRaw — a leaf the flat splitter could not structure (a DNF group,
+                // an intersection with a scalar); carry the raw text through gradual.
+                return $type;
+            }
+
+            /**
+             * A node's start byte in the ORIGINAL source: getStartFilePos()
+             * reports the STRIPPED-source byte, so a length-changing rewrite
+             * earlier in the file (the `T[]` -> `array` lowering) shifts the
+             * two apart; the byte-offset map translates back. Returns -1
+             * (matching no marker) for a position-less node — never produced
+             * by parsing real source, defensive only.
+             */
+            /**
+             * A generic clause on a namespace-import `use` — single (`use App\Box<int>;`),
+             * aliased (`… as B`), `use const`, or grouped (`use App\{Box<int>, …}`, and the
+             * clause-on-prefix shape `use App<int>\{…}`) — has no valid xphp meaning: imports
+             * name a symbol, they don't instantiate one. Left alone, the single/aliased/const
+             * forms mis-blame a double-qualified phantom template, and the grouped form emits
+             * an absolute specialized name inside a `use N\{…}` prefix group, which is
+             * unparseable PHP produced silently. Reject it here — before the blanket Name
+             * branch consumes the marker — so both `check` (collected) and `compile` (thrown)
+             * report the right symbol at the import's line. `use function …<…>` never reaches
+             * this stage (its clause is left unstripped, so php-parser rejects it first).
+             *
+             * @param Use_|GroupUse $node
+             */
+            private function rejectGenericClauseOnImport(Node $node): void
+            {
+                $prefix = $node instanceof GroupUse ? $node->prefix->toCodeString() : null;
+                /** @var list<array{Name, string}> $candidates [name node, display symbol] */
+                $candidates = [];
+                if ($node instanceof GroupUse) {
+                    $candidates[] = [$node->prefix, $prefix];
+                }
+                foreach ($node->uses as $use) {
+                    $spelling = $use->name->toCodeString();
+                    $candidates[] = [
+                        $use->name,
+                        $prefix !== null ? $prefix . '\\' . $spelling : $spelling,
+                    ];
+                }
+                foreach ($candidates as [$name, $symbol]) {
+                    $byte = $this->originalByteOf($name);
+                    $spelling = $name->toCodeString();
+                    foreach ($this->nameMarkers as $marker) {
+                        if ($marker['bytePosition'] === $byte && $marker['name'] === $spelling) {
+                            throw new XphpParseException(sprintf(
+                                'A generic clause is not allowed on a `use` import. Import the '
+                                . 'template with a plain `use %s;` and apply the type arguments '
+                                . 'at the use site (the hint `%s<...>` or the call `%s::<...>()`).',
+                                $symbol,
+                                $symbol,
+                                $symbol,
+                            ), $name->getStartLine());
+                        }
+                    }
+                }
+            }
+
+            private function originalByteOf(Node $node): int
+            {
+                $pos = $node->getStartFilePos();
+                // @infection-ignore-all — defensive: php-parser records positions on
+                // every node parsed from source; -1 only occurs for synthesized nodes,
+                // which never reach the marker matchers.
+                if ($pos < 0) {
+                    return -1;
+                }
+                return $this->byteOffsetMap->toOriginal($pos);
+            }
+
             private function markName(Name $node): void
             {
                 if (!$this->shouldQualify($node)) {
                     return;
                 }
-                $name = $node->toString();
-                $resolved = $this->ctx->resolveAgainstContext($name);
+                // resolveName (not a flattened toString()): a relative
+                // `namespace\Base` must bind to the current namespace — a
+                // `use Other\Base` alias never applies to it, and resolving
+                // the bare tail through the alias map emitted generated code
+                // extending/typing the WRONG class.
+                $resolved = $this->ctx->resolveName($node);
                 $node->setAttribute(XphpSourceParser::ATTR_RESOLVED_FQN, $resolved);
 
                 // Flag a bare, single-segment, non-imported class reference used inside a
@@ -1717,14 +3137,167 @@ private function markName(Name $node): void
                 // a real (in-project / built-in) type or a stray/undeclared type parameter
                 // like the `T` in `interface Foo<Z> { add(T $x): void; }`. The validator
                 // resolves which using the declared-set; here we only record the suspicion.
-                if (count($node->getParts()) === 1
+                // Relative names are excluded: `namespace\Thing` is as explicit a class
+                // reference as an import or a FQ spelling.
+                if (!$node->isRelative()
+                    && count($node->getParts()) === 1
                     && $this->hasEnclosingTypeParams()
-                    && !$this->ctx->isImported($name)
+                    && !$this->ctx->isImported($node->toString())
                 ) {
                     $node->setAttribute(XphpSourceParser::ATTR_SUSPECT_UNDECLARED_TYPE, $resolved);
                 }
             }
 
+            /**
+             * Rewrite the trait operands of every `insteadof` / `as` adaptation in
+             * this class to the specialized generated FQN of their `use`-list entry,
+             * so `use A<int>, B<int> { A::m insteadof B; B::m as bm; }` loads instead
+             * of fataling on the removed template `App\A`. The list entries specialize
+             * through the blanket Name branch (they carry a `<…>` marker); the operand
+             * Names carry none, so without this pass they emit bare and resolve to the
+             * stripped template.
+             *
+             * CLASS-SCOPED, not per-`use`-statement: PHP lets an adaptation name a
+             * trait brought in by a DIFFERENT `use` of the same class
+             * (`use A<int>; use B<int> { A::m insteadof B; }` — operand `A` is not in
+             * the `B` statement's trait list), so the operand→specialization map is
+             * built from the generic list entries of ALL `Stmt\TraitUse` in the body,
+             * keyed on resolved template FQN.
+             *
+             * Only operands matching a GENERIC list entry are rewritten; a plain
+             * (non-generic) trait, or an operand naming a trait this class does not use
+             * generically, is left exactly as written — it is a real trait that still
+             * exists (the over-qualification lesson: never mis-qualify a live name). An
+             * operand whose short name maps to more than one distinct specialization in
+             * the class cannot be disambiguated in an adaptation clause, so it is a
+             * loud compile error rather than an arbitrary pick.
+             */
+            private function markTraitUseAdaptations(ClassLike $node): void
+            {
+                /** @var array<string, list<TypeRef>> $genericArgs template FQN => resolved list-entry args (first seen) */
+                $genericArgs = [];
+                /** @var array<string, string> $firstKey template FQN => canonical arg key first seen */
+                $firstKey = [];
+                /** @var array<string, true> $ambiguous template FQN => a second, differently-specialized use appeared */
+                $ambiguous = [];
+                foreach ($node->stmts as $stmt) {
+                    if (!$stmt instanceof Node\Stmt\TraitUse) {
+                        continue;
+                    }
+                    foreach ($stmt->traits as $traitName) {
+                        $args = $this->peekGenericArgs($traitName);
+                        if ($args === null) {
+                            // A plain (non-generic) trait use — its operands stay bare.
+                            continue;
+                        }
+                        $fqn = $this->resolveNameOnly($traitName->toCodeString());
+                        $key = $this->argsKey($args);
+                        if (!isset($genericArgs[$fqn])) {
+                            $genericArgs[$fqn] = $args;
+                            $firstKey[$fqn] = $key;
+                        } elseif ($firstKey[$fqn] !== $key) {
+                            $ambiguous[$fqn] = true;
+                        }
+                    }
+                }
+                if ($genericArgs === []) {
+                    return;
+                }
+                foreach ($node->stmts as $stmt) {
+                    if (!$stmt instanceof Node\Stmt\TraitUse) {
+                        continue;
+                    }
+                    foreach ($stmt->adaptations as $adaptation) {
+                        if ($adaptation instanceof Node\Stmt\TraitUseAdaptation\Precedence) {
+                            // `A::m insteadof B, C;` — the winning trait (`->trait`) and
+                            // every excluded trait (`->insteadof`, a Name[]) are operands.
+                            $this->markTraitOperand($adaptation->trait, $genericArgs, $ambiguous);
+                            foreach ($adaptation->insteadof as $excluded) {
+                                $this->markTraitOperand($excluded, $genericArgs, $ambiguous);
+                            }
+                        } elseif ($adaptation instanceof Node\Stmt\TraitUseAdaptation\Alias) {
+                            // `B::m as bm;` — only `->trait` is a trait name; the
+                            // `newModifier` / `newName` subnodes stay untouched. A bare
+                            // `m as bm;` (no source trait) has a null `->trait`.
+                            $this->markTraitOperand($adaptation->trait, $genericArgs, $ambiguous);
+                        }
+                    }
+                }
+            }
+
+            /**
+             * Tag one adaptation operand with the generic attributes of its matching
+             * list entry so CallSiteRewriter rewrites it to the specialization's FQN
+             * (identical to the list entry — `recordInstantiation` dedupes to one
+             * generated trait). A null operand (`m as bm;` with no source trait) or one
+             * matching no generic list entry is left untouched; an ambiguous match is a
+             * loud error.
+             *
+             * @param array<string, list<TypeRef>> $genericArgs
+             * @param array<string, true> $ambiguous
+             */
+            private function markTraitOperand(?Name $operand, array $genericArgs, array $ambiguous): void
+            {
+                if ($operand === null) {
+                    return;
+                }
+                $fqn = $this->resolveNameOnly($operand->toCodeString());
+                if (isset($ambiguous[$fqn])) {
+                    throw new XphpParseException(sprintf(
+                        'Ambiguous generic trait operand `%s` in an adaptation clause: this '
+                        . 'class uses more than one specialization of that trait, and an '
+                        . '`insteadof` / `as` clause names a trait, not a specialization, so '
+                        . 'it cannot say which one is meant. Use a single specialization of '
+                        . 'that trait in an adapted class.',
+                        $operand->toCodeString(),
+                    ), $operand->getStartLine());
+                }
+                if (!isset($genericArgs[$fqn])) {
+                    // Not a generic trait this class uses — a real, still-existing trait
+                    // (or an unrelated operand). Leave it exactly as written.
+                    return;
+                }
+                $operand->setAttribute(XphpSourceParser::ATTR_GENERIC_ARGS, $genericArgs[$fqn]);
+                $operand->setAttribute(XphpSourceParser::ATTR_TEMPLATE_FQN, $fqn);
+            }
+
+            /**
+             * Peek (WITHOUT consuming) the resolved generic args recorded for a
+             * trait-use LIST entry Name. Returns null when the trait carries no `<…>`
+             * marker (a plain, non-generic trait use). Mirrors the byte+name match of
+             * the blanket Name branch but leaves the marker in place — that branch
+             * still consumes it when the traversal reaches the list entry.
+             *
+             * @return list<TypeRef>|null
+             */
+            private function peekGenericArgs(Name $traitName): ?array
+            {
+                $byte = $this->originalByteOf($traitName);
+                $nameStr = $traitName->toCodeString();
+                foreach ($this->nameMarkers as $marker) {
+                    if ($marker['bytePosition'] === $byte && $marker['name'] === $nameStr) {
+                        return $this->resolveTypeRefList($marker['args']);
+                    }
+                }
+                return null;
+            }
+
+            /**
+             * Canonical, order-sensitive key for a resolved arg list — the same
+             * per-arg canonical form the registry hashes on. Used to detect when one
+             * trait short-name is used with two DIFFERENT specializations in the same
+             * class (`use A<int>, A<string>`), which a bare operand cannot pick between.
+             *
+             * @param list<TypeRef> $args
+             */
+            private function argsKey(array $args): string
+            {
+                return implode(',', array_map(
+                    static fn (TypeRef $a): string => $a->canonical(),
+                    $args,
+                ));
+            }
+
             /**
              * A bare class/interface Name is fully-qualifiable only when it is not
              * already absolute, carries no generic args (those are rewritten by the
@@ -1745,11 +3318,14 @@ private function shouldQualify(Name $node): bool
                     return false;
                 }
                 $name = $node->toString();
+                // A RELATIVE spelling is never a type param (`namespace\T` is an
+                // explicit class reference), so only a plain name defers to the
+                // enclosing scope here.
                 // @infection-ignore-all — defensive only: an enclosing type-param is a single
                 // segment that the Specializer substitutes (returning early via typeRefToNode)
                 // before the resolved-FQN swap can ever read the attribute, so tagging it is
                 // likewise unobservable.
-                if ($this->isEnclosingTypeParam($name)) {
+                if (!$node->isRelative() && $this->isEnclosingTypeParam($name)) {
                     return false;
                 }
                 $parts = $node->getParts();
@@ -1763,9 +3339,9 @@ private function shouldQualify(Name $node): bool
 
             private function resolveNameOnly(string $name): string
             {
-                if (str_starts_with($name, '\\')) {
-                    return ltrim($name, '\\');
-                }
+                // A prefixed spelling (`\App\Box`, `namespace\Box`) can never
+                // name a type param and resolves in resolveAgainstContext's own
+                // leading-backslash / relative branches.
                 if ($this->isEnclosingTypeParam($name)) {
                     return $name;
                 }
@@ -1951,8 +3527,68 @@ private function hasEnclosingTypeParams(): bool
                 }
                 return false;
             }
-        });
+
+            /**
+             * Diagnostic for a class/method marker that survived the walk
+             * unbound, or null when every one attached. Valid input can never
+             * leave one behind — once parsing succeeded, every recognized
+             * declaration clause hangs off a real AST node — so a survivor is
+             * a marker/AST alignment bug that would otherwise silently drop
+             * the clause's type parameters from the emitted code. Name markers
+             * are deliberately excluded: their attachment is lax by design
+             * (pseudo-type type-args are skipped, gradual call shapes pass
+             * through unclaimed).
+             */
+            public function firstUnboundDeclarationMarker(): ?string
+            {
+                return XphpSourceParser::unboundDeclarationMarkerMessage(
+                    $this->classMarkers,
+                    $this->methodMarkers,
+                );
+            }
+        };
+        $traverser->addVisitor($visitor);
 
         $traverser->traverse($ast);
+
+        return $visitor->firstUnboundDeclarationMarker();
+    }
+
+    /**
+     * Build the loud error for the first unbound class/method generic marker,
+     * or null when none survived. See the visitor's
+     * `firstUnboundDeclarationMarker` for why a survivor is always a
+     * transpiler bug: the strict parse path throws it rather than compiling
+     * on and silently de-generifying the declaration.
+     *
+     * @internal exposed for direct testing; not part of the public API.
+     *
+     * @param array<int, array{line: int, name: string}> $classMarkers
+     * @param array<int, array{line: int, name: string}> $methodMarkers
+     */
+    public static function unboundDeclarationMarkerMessage(array $classMarkers, array $methodMarkers): ?string
+    {
+        foreach ($classMarkers as $marker) {
+            return self::unboundMarkerMessage(sprintf('`%s`', $marker['name']), $marker['line']);
+        }
+        foreach ($methodMarkers as $marker) {
+            $subject = $marker['name'] !== ''
+                ? sprintf('`%s`', $marker['name'])
+                : 'an anonymous closure';
+            return self::unboundMarkerMessage($subject, $marker['line']);
+        }
+        return null;
+    }
+
+    private static function unboundMarkerMessage(string $subject, int $line): string
+    {
+        return sprintf(
+            'The generic type-parameter clause for %s (line %d) was recognized but never bound to '
+            . 'its declaration — compiling on would silently drop the type parameters from the '
+            . 'emitted code. This is a transpiler bug; please report it. As a workaround, keep the '
+            . 'declaration header (attributes, modifiers, and name) on a single line.',
+            $subject,
+            $line,
+        );
     }
 }
diff --git a/test/Console/BinAutoloadBootstrapTest.php b/test/Console/BinAutoloadBootstrapTest.php
index c935031..8133f34 100644
--- a/test/Console/BinAutoloadBootstrapTest.php
+++ b/test/Console/BinAutoloadBootstrapTest.php
@@ -75,8 +75,10 @@ public function testFailsGracefullyWhenNoAutoloaderFound(): void
 
         self::assertSame(1, $result['exit']);
         // The diagnostic must go to STDERR (separate pipe), not STDOUT.
-        self::assertStringContainsString('could not locate', $result['stderr']);
-        self::assertStringContainsString('composer install', $result['stderr']);
+        self::assertSame(
+            "xphp: could not locate Composer's autoloader. Run `composer install`." . PHP_EOL,
+            $result['stderr'],
+        );
     }
 
     /**
diff --git a/test/Console/CheckCommandPhpStanTest.php b/test/Console/CheckCommandPhpStanTest.php
index 645ac77..ef76173 100644
--- a/test/Console/CheckCommandPhpStanTest.php
+++ b/test/Console/CheckCommandPhpStanTest.php
@@ -119,7 +119,11 @@ public function testMissingBinaryWarnsButDoesNotFailTheGate(): void
         ]);
 
         self::assertSame(0, $exit); // a missing optional tool is a Warning, not a failure
-        self::assertStringContainsString('PHPStan was not found', $tester->getDisplay());
+        self::assertStringContainsString(
+            'PHPStan was not found (looked for --phpstan-bin, then vendor/bin/phpstan, then $PATH); '
+                . 'skipping static analysis. Pass --no-phpstan to silence this.',
+            $tester->getDisplay(),
+        );
     }
 
     public function testExplicitConfigIsPassedThroughToPhpStan(): void
diff --git a/test/Console/CheckCommandTest.php b/test/Console/CheckCommandTest.php
index 65ac295..1f5658d 100644
--- a/test/Console/CheckCommandTest.php
+++ b/test/Console/CheckCommandTest.php
@@ -79,9 +79,10 @@ public function testParseErrorIsReportedButOtherFilesStillChecked(): void
         // A PHP syntax error: reported with its real line.
         self::assertSame(Compiler::CODE_PARSE_ERROR, $byFile['Broken.xphp']['code']);
         self::assertSame(11, $byFile['Broken.xphp']['line']);
-        // An xphp-specific parse rejection (no line): reported at line 1.
+        // An xphp-specific parse rejection: reported at the offending token's real line
+        // (the `<out T>` variance marker sits on line 9), not the line-1 fallback.
         self::assertSame(Compiler::CODE_PARSE_ERROR, $byFile['ClosureVariance.xphp']['code']);
-        self::assertSame(1, $byFile['ClosureVariance.xphp']['line']);
+        self::assertSame(9, $byFile['ClosureVariance.xphp']['line']);
         // A VALID file is still checked despite the two unparseable files.
         self::assertSame('xphp.bound_violation', $byFile['Use.xphp']['code']);
     }
diff --git a/test/Diagnostics/Renderer/RendererTest.php b/test/Diagnostics/Renderer/RendererTest.php
index e64f2c6..735f4c4 100644
--- a/test/Diagnostics/Renderer/RendererTest.php
+++ b/test/Diagnostics/Renderer/RendererTest.php
@@ -55,41 +55,45 @@ public function testTextRender(): void
     public function testTextOmitsColumnWhenAbsent(): void
     {
         $d = [new Diagnostic(Severity::Error, 'c', 'm', new SourceLocation('/a.xphp', 4))];
-        self::assertStringContainsString('at /a.xphp:4 [c]', (new TextRenderer())->render($d));
+        self::assertSame(
+            'error: m' . PHP_EOL . '  at /a.xphp:4 [c]' . PHP_EOL,
+            (new TextRenderer())->render($d),
+        );
     }
 
     public function testJsonContract(): void
     {
         $out = (new JsonRenderer())->render($this->sample());
-        // Pin the raw formatting: pretty-printed (space after key) and slashes unescaped.
-        self::assertStringContainsString('"file": "/src/Box.xphp"', $out);
-        /** @var array{diagnostics: list<array<string, mixed>>} $decoded */
-        $decoded = json_decode($out, true, flags: JSON_THROW_ON_ERROR);
-
-        self::assertSame([
-            'diagnostics' => [
-                [
-                    'severity' => 'error',
-                    'code' => 'xphp.bound_violation',
-                    'message' => 'bad bound',
-                    'source' => 'xphp',
-                    'triggeredBy' => null,
-                    'file' => '/src/Box.xphp',
-                    'line' => 7,
-                    'column' => 3,
-                ],
-                [
-                    'severity' => 'warning',
-                    'code' => 'phpstan.return',
-                    'message' => 'maybe',
-                    'source' => 'phpstan',
-                    'triggeredBy' => 'App\\Box<int>',
-                    'file' => null,
-                    'line' => null,
-                    'column' => null,
-                ],
-            ],
-        ], $decoded);
+        // Pin the whole raw formatting: pretty-printed (space after key), slashes
+        // unescaped, and a trailing newline.
+        $expected = <<<'JSON'
+            {
+                "diagnostics": [
+                    {
+                        "severity": "error",
+                        "code": "xphp.bound_violation",
+                        "message": "bad bound",
+                        "source": "xphp",
+                        "triggeredBy": null,
+                        "file": "/src/Box.xphp",
+                        "line": 7,
+                        "column": 3
+                    },
+                    {
+                        "severity": "warning",
+                        "code": "phpstan.return",
+                        "message": "maybe",
+                        "source": "phpstan",
+                        "triggeredBy": "App\\Box<int>",
+                        "file": null,
+                        "line": null,
+                        "column": null
+                    }
+                ]
+            }
+            JSON . PHP_EOL;
+
+        self::assertSame($expected, $out);
     }
 
     public function testJsonEmpty(): void
diff --git a/test/StaticAnalysis/PhpStanOutputParserTest.php b/test/StaticAnalysis/PhpStanOutputParserTest.php
index 75f77e1..2f282e2 100644
--- a/test/StaticAnalysis/PhpStanOutputParserTest.php
+++ b/test/StaticAnalysis/PhpStanOutputParserTest.php
@@ -155,8 +155,7 @@ public function testTopLevelErrorsWithNoFileFindingsIsAFailedRun(): void
         $result = PhpStanOutputParser::parse($json, '');
 
         self::assertFalse($result->ranOk);
-        self::assertStringContainsString('Ignored error pattern was not matched', $result->errorOutput ?? '');
-        self::assertStringContainsString('Another general error', $result->errorOutput ?? '');
+        self::assertSame("Ignored error pattern was not matched\nAnother general error", $result->errorOutput);
     }
 
     public function testFileFindingsWinOverTopLevelErrors(): void
diff --git a/test/StaticAnalysis/PhpStanRunnerConfigTest.php b/test/StaticAnalysis/PhpStanRunnerConfigTest.php
index 7fb70a7..cf2c6f9 100644
--- a/test/StaticAnalysis/PhpStanRunnerConfigTest.php
+++ b/test/StaticAnalysis/PhpStanRunnerConfigTest.php
@@ -19,20 +19,30 @@ public function testWithConsumerConfigIncludesItAndOmitsLevel(): void
             '/project/phpstan.neon',
         );
 
-        self::assertStringContainsString("includes:\n    - \"/project/phpstan.neon\"", $config);
-        self::assertStringContainsString('parameters:', $config);
-        self::assertStringContainsString("    scanDirectories:\n        - \"/abs/dist\"\n        - \"/abs/Generated\"", $config);
         // Level is inherited from the consumer config, so it must NOT be set here.
-        self::assertStringNotContainsString('level:', $config);
+        self::assertSame(
+            "includes:\n"
+            . "    - \"/project/phpstan.neon\"\n"
+            . "parameters:\n"
+            . "    scanDirectories:\n"
+            . "        - \"/abs/dist\"\n"
+            . "        - \"/abs/Generated\"\n",
+            $config,
+        );
     }
 
     public function testWithoutConsumerConfigSetsDefaultLevelAndNoIncludes(): void
     {
         $config = PhpStanRunner::buildConfig(['/abs/dist'], null);
 
-        self::assertStringNotContainsString('includes:', $config);
-        self::assertStringContainsString('    level: 5', $config);
-        self::assertStringContainsString("    scanDirectories:\n        - \"/abs/dist\"", $config);
+        // No consumer config, so a default level is set and there are no includes.
+        self::assertSame(
+            "parameters:\n"
+            . "    level: 5\n"
+            . "    scanDirectories:\n"
+            . "        - \"/abs/dist\"\n",
+            $config,
+        );
     }
 
     public function testPathsAreNeonQuotedAndEscaped(): void
@@ -40,7 +50,13 @@ public function testPathsAreNeonQuotedAndEscaped(): void
         $config = PhpStanRunner::buildConfig(['/weird/pa"th\\x'], null);
 
         // Double quote and backslash must be escaped inside the NEON double-quoted string.
-        self::assertStringContainsString('- "/weird/pa\\"th\\\\x"', $config);
+        self::assertSame(
+            "parameters:\n"
+            . "    level: 5\n"
+            . "    scanDirectories:\n"
+            . "        - \"/weird/pa\\\"th\\\\x\"\n",
+            $config,
+        );
     }
 
     public function testConfigEndsWithNewline(): void
@@ -71,6 +87,12 @@ public function testPathsWithSpacesAreNeonQuoted(): void
     {
         $config = PhpStanRunner::buildConfig(['/has a space/dist'], null);
 
-        self::assertStringContainsString('- "/has a space/dist"', $config);
+        self::assertSame(
+            "parameters:\n"
+            . "    level: 5\n"
+            . "    scanDirectories:\n"
+            . "        - \"/has a space/dist\"\n",
+            $config,
+        );
     }
 }
diff --git a/test/StaticAnalysis/StaticAnalysisGateTest.php b/test/StaticAnalysis/StaticAnalysisGateTest.php
index 85f3e2d..117a2d6 100644
--- a/test/StaticAnalysis/StaticAnalysisGateTest.php
+++ b/test/StaticAnalysis/StaticAnalysisGateTest.php
@@ -93,7 +93,11 @@ public function testMissingBinaryYieldsNonFailingWarning(): void
         self::assertSame(StaticAnalysisGate::CODE_UNAVAILABLE, $diagnostics[0]->code);
         self::assertSame(Severity::Warning, $diagnostics[0]->severity);
         self::assertFalse($diagnostics[0]->severity->isFailing());
-        self::assertStringContainsString('PHPStan was not found', $diagnostics[0]->message);
+        self::assertSame(
+            'PHPStan was not found (looked for --phpstan-bin, then vendor/bin/phpstan, then $PATH); '
+                . 'skipping static analysis. Pass --no-phpstan to silence this.',
+            $diagnostics[0]->message,
+        );
     }
 
     public function testFailedRunYieldsNonFailingWarning(): void
diff --git a/test/Transpiler/Monomorphize/ArraySugarIntegrationTest.php b/test/Transpiler/Monomorphize/ArraySugarIntegrationTest.php
index 2bffd3f..2891da6 100644
--- a/test/Transpiler/Monomorphize/ArraySugarIntegrationTest.php
+++ b/test/Transpiler/Monomorphize/ArraySugarIntegrationTest.php
@@ -90,6 +90,26 @@ public function testNullableReturnEnforcesConcreteType(): void
         }
     }
 
+    /**
+     * A length-changing `Name[]` -> `array` rewrite BEFORE a generic closure
+     * shifts every following byte of the stripped source; the closure's
+     * marker (recorded at the ORIGINAL `function` byte) must map back through
+     * the byte-offset map, or the closure silently loses its type params and
+     * the emitted output fatals at runtime.
+     */
+    #[\PHPUnit\Framework\Attributes\RunInSeparateProcess]
+    public function testSugarBeforeGenericClosureStillSpecializes(): void
+    {
+        $source = realpath(__DIR__ . '/../../fixture/compile/array_sugar_before_generic_closure/source')
+            ?: throw new RuntimeException('Fixture missing');
+        $fixture = CompiledFixture::compile($source, 'array-sugar-marker-offset');
+        try {
+            require __DIR__ . '/../../fixture/compile/array_sugar_before_generic_closure/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+
     private function compile(): void
     {
         $compiler = $this->buildCompiler();
diff --git a/test/Transpiler/Monomorphize/CheckPassIntegrationTest.php b/test/Transpiler/Monomorphize/CheckPassIntegrationTest.php
index 6e8131e..6e83529 100644
--- a/test/Transpiler/Monomorphize/CheckPassIntegrationTest.php
+++ b/test/Transpiler/Monomorphize/CheckPassIntegrationTest.php
@@ -6,6 +6,7 @@
 
 use PhpParser\ParserFactory;
 use PhpParser\PrettyPrinter\Standard as StandardPrinter;
+use PHPUnit\Framework\Attributes\DataProvider;
 use PHPUnit\Framework\TestCase;
 use RuntimeException;
 use XPHP\Diagnostics\DiagnosticCollector;
@@ -74,8 +75,14 @@ public function testVarianceEdgeUnprovableIsReportedAsNonFailingWarning(): void
         self::assertSame(\XPHP\Diagnostics\Severity::Warning, $d->severity);
         self::assertNotNull($d->location);
         self::assertStringEndsWith('Use.xphp', $d->location->file);
-        self::assertStringContainsString('Book', $d->message);
-        self::assertStringContainsString('not in the source set', $d->message);
+        self::assertSame(
+            'Variance edge cannot be proven while instantiating App\Check\VarianceEdgeUnprovable\Producer<App\Check\VarianceEdgeUnprovable\Book>.
+  type parameter out T is covariant, but App\Check\VarianceEdgeUnprovable\Book is not in the source set the hierarchy was built from (and is not a recognized PHP built-in),
+  so the compiler cannot prove its subtype edges — this specialization is not linked to related ones and the covariant relationship silently does not apply at runtime.
+
+  Add App\Check\VarianceEdgeUnprovable\Book to the source set the hierarchy is built from to enable the edge.',
+            $d->message,
+        );
     }
 
     public function testVarianceEdgeProvableTypesProduceNoWarning(): void
@@ -145,6 +152,49 @@ public function testMissingTypeArgumentIsCollectedByCheck(): void
         self::assertNotNull($diagnostics->all()[0]->location);
     }
 
+    public function testBareNewOfNonDefaultsGenericIsCollectedByCheck(): void
+    {
+        // `new Box(5)` where `Box<T>` has a required (non-defaulted) param and no
+        // turbofish: cannot pad from defaults, so it is a missing-type-argument error
+        // — same code and message as the call path, routed through padArgsWithDefaults.
+        $diagnostics = $this->check('bare_new_missing_arg');
+
+        self::assertCount(1, $diagnostics->all());
+        $d = $diagnostics->all()[0];
+        self::assertSame(Registry::CODE_MISSING_TYPE_ARGUMENT, $d->code);
+        self::assertNotNull($d->location);
+        self::assertStringEndsWith('Use.xphp', $d->location->file);
+        self::assertSame(10, $d->location->line);
+    }
+
+    public function testBareNewQualifiedAndRelativeSpellingsAreBothCollected(): void
+    {
+        // FQ `new \…\Box(5)` and relative `new namespace\Box(6)` reject with the same
+        // verdict as the bare spelling, and BOTH are collected in one run (check does
+        // not throw-on-first).
+        $diagnostics = $this->check('bare_new_missing_arg_qualified');
+
+        self::assertCount(2, $diagnostics->all());
+        foreach ($diagnostics->all() as $d) {
+            self::assertSame(Registry::CODE_MISSING_TYPE_ARGUMENT, $d->code);
+            self::assertNotNull($d->location);
+        }
+        self::assertSame([10, 11], array_map(
+            static fn ($d): ?int => $d->location?->line,
+            $diagnostics->all(),
+        ));
+    }
+
+    public function testBareNewOfConditionalSameNamePlainClassIsNotRejected(): void
+    {
+        // False-reject guard: a plain `class B` (live branch) coexists with a generic `class B<T>`
+        // (dead branch). `new B` resolves to the instantiable plain class, so the bare-new guard
+        // must stay silent — rejecting the generic twin's name here would be a false reject.
+        $diagnostics = $this->check('bare_new_conditional_same_name');
+
+        self::assertSame([], $diagnostics->all());
+    }
+
     public function testUndefinedTemplateIsCollectedByCheck(): void
     {
         // Exercises the collectUndefinedTemplates() step of check().
@@ -220,6 +270,64 @@ public function testCompileStillThrowsOnStaticGenericClosure(): void
         $this->compileFixture('closure_static');
     }
 
+    public function testAttributedStaticGenericClosureIsCollectedByCheck(): void
+    {
+        // The attribute moves the closure node's start to `#[`; the generic
+        // marker must still bind there, so the static-closure reject FIRES —
+        // before, the marker was lost and the closure silently compiled raw.
+        $diagnostics = $this->check('closure_static_attributed');
+
+        self::assertCount(1, $diagnostics->all());
+        $d = $diagnostics->all()[0];
+        self::assertSame(GenericMethodCompiler::CODE_UNSUPPORTED_STATIC_CLOSURE, $d->code);
+        self::assertNotNull($d->location);
+        self::assertSame(19, $d->location->line);
+    }
+
+    public function testCompileStillThrowsOnAttributedStaticGenericClosure(): void
+    {
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessage('static closures cannot yet be specialized');
+        $this->compileFixture('closure_static_attributed');
+    }
+
+    public function testUnspecializedGenericClosuresAreCollectedByCheck(): void
+    {
+        // Declared-but-never-turbofish-called generic closures across every
+        // position (assigned, return, argument, use-capturing, defaulted,
+        // unused-param, conditional else-arm) each draw ONE diagnostic; the
+        // called twins draw none. Note the eager static/$this rejects also
+        // stay single diagnostics (their templates count as attempted) —
+        // pinned by the closure_static / closure_this_capture tests' counts.
+        $diagnostics = $this->check('closure_unspecialized');
+
+        $all = $diagnostics->all();
+        self::assertCount(7, $all);
+        $arrowMsg = 'Generic arrow function is declared with type parameters but never specialized: no `$var::<...>(...)` call grounds them, so its type-parameter hints would reach the emitted code as references to non-existent classes. Call it with an explicit turbofish, or remove the `<...>` clause.';
+        $closureMsg = 'Generic closure is declared with type parameters but never specialized: no `$var::<...>(...)` call grounds them, so its type-parameter hints would reach the emitted code as references to non-existent classes. Call it with an explicit turbofish, or remove the `<...>` clause.';
+        $byLine = [];
+        foreach ($all as $d) {
+            self::assertSame(GenericMethodCompiler::CODE_UNSPECIALIZED_GENERIC_CLOSURE, $d->code);
+            self::assertContains($d->message, [$arrowMsg, $closureMsg]);
+            self::assertNotNull($d->location);
+            $byLine[$d->location->line] = $d->message;
+        }
+        ksort($byLine);
+        // The static arrow, return-position arrow, argument-position closure,
+        // use-capturing closure, defaulted closure, unused-param arrow, and
+        // the conditional else-arm arrow — NOT the called twins.
+        self::assertSame([12, 16, 19, 22, 24, 27, 30], array_keys($byLine));
+        self::assertSame($arrowMsg, $byLine[12]);
+        self::assertSame($closureMsg, $byLine[19]);
+    }
+
+    public function testCompileThrowsOnUnspecializedGenericClosure(): void
+    {
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessage('never specialized');
+        $this->compileFixture('closure_unspecialized');
+    }
+
     public function testUnresolvedGenericMethodTurbofishIsCollectedByCheck(): void
     {
         // A turbofish call to a generic method that exists nowhere on the receiver
@@ -232,7 +340,10 @@ public function testUnresolvedGenericMethodTurbofishIsCollectedByCheck(): void
         self::assertSame(GenericMethodCompiler::CODE_UNRESOLVED_GENERIC_CALL, $d->code);
         self::assertNotNull($d->location);
         self::assertSame(16, $d->location->line);
-        self::assertStringContainsString('nope', $d->message);
+        self::assertSame(
+            'Generic method `App\Check\UnresolvedGenericMethod\Box::nope::<...>()` could not be resolved to a declared generic method on `App\Check\UnresolvedGenericMethod\Box`. Check the method name or the receiver\'s type.',
+            $d->message,
+        );
     }
 
     public function testCompileStillThrowsOnUnresolvedGenericMethodTurbofish(): void
@@ -328,7 +439,10 @@ public function testGenericMethodInsideGenericTemplateIsReportedExactlyOnce(): v
 
         self::assertCount(1, $diagnostics->all());
         self::assertSame(UndeclaredTypeParameterValidator::CODE_UNDECLARED_TYPE, $diagnostics->all()[0]->code);
-        self::assertStringContainsString('Type `Stray`', $diagnostics->all()[0]->message);
+        self::assertSame(
+            'Type `Stray` used in template `App\NestedMethod\Box` is not a declared type parameter and does not resolve to a known class, interface, or trait. Declare it as a type parameter, or import (`use`) / fully-qualify it if it names a real type.',
+            $diagnostics->all()[0]->message,
+        );
     }
 
     public function testCompileStillThrowsOnUndeclaredTypeInGenericFunction(): void
@@ -345,7 +459,10 @@ public function testUndeclaredNameInABoundIsCollected(): void
 
         self::assertCount(1, $diagnostics->all());
         self::assertSame(UndeclaredTypeParameterValidator::CODE_UNDECLARED_TYPE, $diagnostics->all()[0]->code);
-        self::assertStringContainsString('Type `Nonexistent`', $diagnostics->all()[0]->message);
+        self::assertSame(
+            'Type `Nonexistent` used in template `App\BadBound\Box` is not a declared type parameter and does not resolve to a known class, interface, or trait. Declare it as a type parameter, or import (`use`) / fully-qualify it if it names a real type.',
+            $diagnostics->all()[0]->message,
+        );
     }
 
     public function testUndeclaredNameInADefaultIsCollected(): void
@@ -354,7 +471,10 @@ public function testUndeclaredNameInADefaultIsCollected(): void
 
         self::assertCount(1, $diagnostics->all());
         self::assertSame(UndeclaredTypeParameterValidator::CODE_UNDECLARED_TYPE, $diagnostics->all()[0]->code);
-        self::assertStringContainsString('Type `Nonexistent`', $diagnostics->all()[0]->message);
+        self::assertSame(
+            'Type `Nonexistent` used in template `App\BadDefault\Pair` is not a declared type parameter and does not resolve to a known class, interface, or trait. Declare it as a type parameter, or import (`use`) / fully-qualify it if it names a real type.',
+            $diagnostics->all()[0]->message,
+        );
     }
 
     public function testUndeclaredNamesInIntersectionBoundAndGenericArgAreCollected(): void
@@ -386,7 +506,10 @@ public function testSameUndeclaredNameInBoundAndDefaultIsReportedOnce(): void
         $diagnostics = $this->check('undeclared_bound_dedup');
 
         self::assertCount(1, $diagnostics->all());
-        self::assertStringContainsString('Type `Bad`', $diagnostics->all()[0]->message);
+        self::assertSame(
+            'Type `Bad` used in template `App\DupBound\Dup` is not a declared type parameter and does not resolve to a known class, interface, or trait. Declare it as a type parameter, or import (`use`) / fully-qualify it if it names a real type.',
+            $diagnostics->all()[0]->message,
+        );
     }
 
     public function testCompileStillThrowsOnUndeclaredBound(): void
@@ -445,6 +568,15 @@ public function testCompileStillThrowsOnGenericMethodMissingArgument(): void
         $this->compileFixture('generic_method_missing_arg');
     }
 
+    public function testCompileThrowsOnBareNewOfNonDefaultsGeneric(): void
+    {
+        // Compile mode (no collector) throws the identical missing-type-argument message
+        // the call path throws — confirms the shared reporter keeps the throw path intact.
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessage('has no default');
+        $this->compileFixture('bare_new_missing_arg');
+    }
+
     public function testCompileStillThrowsOnDuplicateGenericFunction(): void
     {
         $this->expectException(RuntimeException::class);
@@ -475,6 +607,187 @@ public function testCompileStillThrowsOnUndefinedTemplate(): void
         }
     }
 
+    public function testParseTimeVarianceOnMethodReportsRealLine(): void
+    {
+        // A parser-stage rejection (variance marker on a method) is caught in check mode
+        // and must report the offending token's real source line, not the line-1 fallback
+        // used for position-less parse failures. `eat<out T>` sits on line 9.
+        $diagnostics = $this->check('parse_line_variance_method');
+
+        self::assertCount(1, $diagnostics->all());
+        $d = $diagnostics->all()[0];
+        self::assertSame(Compiler::CODE_PARSE_ERROR, $d->code);
+        self::assertSame(
+            'Variance markers `out T` / `in T` are not supported on methods, functions, closures, or arrow functions — variance is a class-level-only feature by design: a function or closure specialization has no stable class identity to anchor a subtype `extends` edge to. Move the generic to a class-level type parameter.',
+            $d->message,
+        );
+        self::assertNotNull($d->location);
+        self::assertSame(9, $d->location->line);
+    }
+
+    public function testParseTimeLegacyVarianceGlyphReportsRealLine(): void
+    {
+        // The `+T` legacy-variance rejection fires from a different throw site; it too
+        // carries its token line. `class Box<+T>` sits on line 7.
+        $diagnostics = $this->check('parse_line_legacy_variance');
+
+        self::assertCount(1, $diagnostics->all());
+        $d = $diagnostics->all()[0];
+        self::assertSame(Compiler::CODE_PARSE_ERROR, $d->code);
+        self::assertSame(
+            'The `+T` / `-T` variance syntax was replaced by `out T` / `in T`. Write `out` for covariance and `in` for contravariance, e.g. `class Box<out T>` or `class Consumer<in T>`.',
+            $d->message,
+        );
+        self::assertNotNull($d->location);
+        self::assertSame(7, $d->location->line);
+    }
+
+    public function testParseTimeDefaultOrderingReportsRealLine(): void
+    {
+        // The required-after-defaulted rejection anchors to the offending parameter's
+        // name line (`class Pair<T = int, U>` on line 9), proving the name-line path.
+        $diagnostics = $this->check('parse_line_default_ordering');
+
+        self::assertCount(1, $diagnostics->all());
+        $d = $diagnostics->all()[0];
+        self::assertSame(Compiler::CODE_PARSE_ERROR, $d->code);
+        self::assertSame(
+            'Generic parameter `U` has no default but follows a parameter with a default. Required type parameters must precede defaulted ones.',
+            $d->message,
+        );
+        self::assertNotNull($d->location);
+        self::assertSame(9, $d->location->line);
+    }
+
+    public function testParseTimeInvalidDefaultReportsRealLine(): void
+    {
+        // An invalid default shape (`T = ?int`) rejects from the `$tokens[$afterBound]`
+        // (the `=`) throw site — a distinct index from the variance sites. Line 7.
+        $diagnostics = $this->check('parse_line_invalid_default');
+
+        self::assertCount(1, $diagnostics->all());
+        $d = $diagnostics->all()[0];
+        self::assertSame(Compiler::CODE_PARSE_ERROR, $d->code);
+        self::assertSame(
+            'Generic parameter `T` has an invalid default; only a single concrete or generic type is allowed after `=` (no nullable or union shapes).',
+            $d->message,
+        );
+        self::assertNotNull($d->location);
+        self::assertSame(7, $d->location->line);
+    }
+
+    public function testParseTimeUnionDefaultReportsRealLine(): void
+    {
+        // A union default (`T = Foo | Bar`) rejects from the `$tokens[$afterDefault]`
+        // (the `|`) throw site — again a distinct index. `class Slot<...>` on line 9.
+        $diagnostics = $this->check('parse_line_union_default');
+
+        self::assertCount(1, $diagnostics->all());
+        $d = $diagnostics->all()[0];
+        self::assertSame(Compiler::CODE_PARSE_ERROR, $d->code);
+        self::assertSame(
+            'Generic parameter `T` has an invalid default; only a single concrete or generic type is allowed after `=` (no nullable or union shapes).',
+            $d->message,
+        );
+        self::assertNotNull($d->location);
+        self::assertSame(9, $d->location->line);
+    }
+
+    public function testParseTimePositionlessRejectionFallsBackToLineOne(): void
+    {
+        // A structural rejection raised over parsed entries (a self-bound `T : T`) carries
+        // no token position, so check mode collects it via the fallback catch at line 1 —
+        // and it is collected, not propagated (the file is still reported, exit stays clean
+        // of a fatal).
+        $diagnostics = $this->check('parse_self_bound');
+
+        self::assertCount(1, $diagnostics->all());
+        $d = $diagnostics->all()[0];
+        self::assertSame(Compiler::CODE_PARSE_ERROR, $d->code);
+        self::assertSame(
+            'Generic parameter `T` cannot use itself as a bound (self-reference detected in the bound expression). Use a nested form like `T : Box<T>` for F-bounded recursion, or remove the bound.',
+            $d->message,
+        );
+        self::assertNotNull($d->location);
+        self::assertSame(1, $d->location->line);
+    }
+
+    public function testCompileStillThrowsOnVarianceOnMethod(): void
+    {
+        // Compile mode catches the same rejection as a RuntimeException (XphpParseException
+        // extends it) — the message path is unchanged; only check mode reads the line.
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessage('Variance markers');
+        $this->compileFixture('parse_line_variance_method');
+    }
+
+    /**
+     * A turbofish on a DYNAMICALLY-named method/static call (`$o->$m::<int>()`, its nullsafe and
+     * variable-variable and static-dynamic siblings) cannot be monomorphized — the name is a runtime
+     * value. Each used to silently drop the marker and strip the clause, leaving a bare dynamic call
+     * against a method that now exists only in its `_T_<hash>` form (runtime fatal behind a clean
+     * gate). Each now draws ONE parse-stage diagnostic at the receiver's real line (9 in each fixture).
+     *
+     * @return iterable<string, array{string}>
+     */
+    public static function dynamicTurbofishFixtures(): iterable
+    {
+        yield 'dynamic instance name' => ['dynamic_turbofish_instance'];
+        yield 'nullsafe dynamic name' => ['dynamic_turbofish_nullsafe'];
+        yield 'variable-variable' => ['dynamic_turbofish_varvar'];
+        yield 'static dynamic name' => ['dynamic_turbofish_static'];
+    }
+
+    #[DataProvider('dynamicTurbofishFixtures')]
+    public function testDynamicNameTurbofishIsRejectedWithRealLine(string $fixture): void
+    {
+        $diagnostics = $this->check($fixture);
+
+        self::assertCount(1, $diagnostics->all());
+        $d = $diagnostics->all()[0];
+        self::assertSame(Compiler::CODE_PARSE_ERROR, $d->code);
+        self::assertSame(
+            'A turbofish (`::<…>`) on a dynamically-named method or static call cannot be monomorphized; the method name must be a literal identifier, not a variable',
+            $d->message,
+        );
+        self::assertNotNull($d->location);
+        self::assertSame(9, $d->location->line);
+    }
+
+    public function testCompileStillThrowsOnDynamicNameTurbofish(): void
+    {
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessage('dynamically-named method');
+        $this->compileFixture('dynamic_turbofish_instance');
+    }
+
+    public function testAmbiguousGenericTraitOperandIsCollectedByCheck(): void
+    {
+        // `use A<int>, A<string>, B<int> { A::m insteadof B; }` — the bare operand `A`
+        // matches two different specializations of `A`, which an `insteadof` clause
+        // cannot disambiguate. Rewriting to an arbitrary one would silently pick a
+        // trait; instead it draws ONE parse-stage diagnostic at the operand's line.
+        $diagnostics = $this->check('generic_trait_ambiguous_operand');
+
+        self::assertCount(1, $diagnostics->all());
+        $d = $diagnostics->all()[0];
+        self::assertSame(Compiler::CODE_PARSE_ERROR, $d->code);
+        // The remedy names an actionable recourse (a trait-level rename is NOT possible).
+        self::assertSame(
+            'Ambiguous generic trait operand `A` in an adaptation clause: this class uses more than one specialization of that trait, and an `insteadof` / `as` clause names a trait, not a specialization, so it cannot say which one is meant. Use a single specialization of that trait in an adapted class.',
+            $d->message,
+        );
+        self::assertNotNull($d->location);
+        self::assertSame(13, $d->location->line);
+    }
+
+    public function testCompileStillThrowsOnAmbiguousGenericTraitOperand(): void
+    {
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessage('Ambiguous generic trait operand');
+        $this->compileFixture('generic_trait_ambiguous_operand');
+    }
+
     private function compileFixture(string $fixture): void
     {
         $work = sys_get_temp_dir() . '/xphp-check-compile-' . uniqid('', true);
@@ -486,6 +799,20 @@ private function compileFixture(string $fixture): void
         }
     }
 
+    public function testClosureConformanceViolationIsCollectedByCheck(): void
+    {
+        // Exercises the ClosureConformanceValidator step of check(): a return-site
+        // closure literal whose parameter is narrower than the target guarantees.
+        $diagnostics = $this->check('closure_conformance');
+
+        self::assertCount(1, $diagnostics->all());
+        self::assertSame(ClosureConformanceValidator::CODE, $diagnostics->all()[0]->code);
+        self::assertSame(
+            'Closure literal does not conform to the declared `Closure(...)` type: parameter 1: string is not wider than int',
+            $diagnostics->all()[0]->message,
+        );
+    }
+
     private function check(string $fixture): DiagnosticCollector
     {
         return $this->buildCompiler()->check($this->sources($fixture));
diff --git a/test/Transpiler/Monomorphize/ClosureConformanceIntegrationTest.php b/test/Transpiler/Monomorphize/ClosureConformanceIntegrationTest.php
new file mode 100644
index 0000000..1012c98
--- /dev/null
+++ b/test/Transpiler/Monomorphize/ClosureConformanceIntegrationTest.php
@@ -0,0 +1,160 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+use PHPUnit\Framework\Attributes\RunInSeparateProcess;
+use PHPUnit\Framework\TestCase;
+use RuntimeException;
+use XPHP\TestSupport\CompiledFixture;
+
+/**
+ * End-to-end coverage for closure-signature conformance through the full
+ * compile pipeline: a conforming source compiles, erases every `Closure(...)`
+ * to `\Closure`, and the emitted PHP executes; a provably non-conforming source
+ * fails the compile with the conformance diagnostic before any output is written.
+ */
+final class ClosureConformanceIntegrationTest extends TestCase
+{
+    #[RunInSeparateProcess]
+    public function testConformingClosuresCompileEraseAndRun(): void
+    {
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/closure_conformance_runtime/source',
+            'closure-conformance-run',
+        );
+        try {
+            require __DIR__ . '/../../fixture/compile/closure_conformance_runtime/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testDnfGroupedSignaturesCompileEraseAndRun(): void
+    {
+        // DNF groups (`(A&B)|C`) in a signature's parameter and return: the
+        // group scans as one gradual leaf, the arity stays correct (the factory
+        // literal is accepted, not arity-false-rejected), the signature fully
+        // erases, and the compiled output executes.
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/closure_conformance_dnf_runtime/source',
+            'closure-conformance-dnf',
+        );
+        try {
+            require __DIR__ . '/../../fixture/compile/closure_conformance_dnf_runtime/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testUserFunctionNamedClosureInExpressionColonsExecutes(): void
+    {
+        // A user function named `Closure` called after a ternary `:`, inside an
+        // alt-syntax `if (...):` block, and after a `case expr():` label — the
+        // `) :` pairs those positions produce must not be read as return-type
+        // slots; the calls compile untouched and RUN.
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/closure_named_user_function_runtime/source',
+            'closure-named-user-fn',
+        );
+        try {
+            require __DIR__ . '/../../fixture/compile/closure_named_user_function_runtime/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testArraySugarSignaturesCompileEraseAndRun(): void
+    {
+        // Array-sugar leaves in a signature's parameter and return lower to
+        // `array`: the arity stays correct (one sugared param is ONE param,
+        // not three), the signature fully erases, and the output executes.
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/closure_conformance_array_sugar_runtime/source',
+            'closure-conformance-sugar',
+        );
+        try {
+            require __DIR__ . '/../../fixture/compile/closure_conformance_array_sugar_runtime/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testExceptionFactoryAgainstBuiltinThrowableTargetCompilesAndRuns(): void
+    {
+        // Regression: a user subclass of the built-in \Exception returned against a
+        // Closure(): \Throwable target must not be false-rejected (the hierarchy
+        // models no built-in ancestor edges).
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/closure_conformance_builtin_ok/source',
+            'closure-conformance-builtin',
+        );
+        $fixture->registerAutoload('App\\ClosureBuiltinOk\\');
+        try {
+            require __DIR__ . '/../../fixture/compile/closure_conformance_builtin_ok/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+
+    public function testNonConformingClosureFailsCompilation(): void
+    {
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessage('parameter 1: string is not wider than int');
+
+        CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/closure_conformance_reject/source',
+            'closure-conformance-reject',
+        );
+    }
+
+    #[RunInSeparateProcess]
+    public function testGroundedGenericClosureConformsWhenTypeParameterResolves(): void
+    {
+        // `Closure(T): T` grounds to `Closure(int): int` under `Box<int>`; the
+        // conforming factory compiles, erases, and runs.
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/closure_conformance_grounded_runtime/source',
+            'closure-conformance-grounded-run',
+        );
+        $fixture->registerAutoload('App\\ClosureGroundRuntime\\');
+        try {
+            require __DIR__ . '/../../fixture/compile/closure_conformance_grounded_runtime/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+
+    public function testGroundedUnionMemberFailsWhenTypeParameterResolvesToAConflict(): void
+    {
+        // `Closure(): T|int` grounds to `string|int` under `Box<string>`; the class
+        // return literal is provably neither member, so the union member grounding
+        // turns a gradual accept at the template into a build failure.
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessage('is not a subtype of string|int');
+
+        CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/closure_conformance_grounded_union_reject/source',
+            'closure-conformance-grounded-union',
+        );
+    }
+
+    public function testGroundedGenericClosureFailsWhenTypeParameterResolvesToAConflict(): void
+    {
+        // Gradually accepted at the abstract template, but once `Box<int>` grounds
+        // `Closure(T $x): T` to `Closure(int $x): int` the `string`-parameter
+        // literal is a provable contravariance violation.
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessage('parameter 1: string is not wider than int');
+
+        CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/closure_conformance_grounded_reject/source',
+            'closure-conformance-grounded-reject',
+        );
+    }
+}
diff --git a/test/Transpiler/Monomorphize/ClosureConformanceValidatorTest.php b/test/Transpiler/Monomorphize/ClosureConformanceValidatorTest.php
new file mode 100644
index 0000000..2e96f2d
--- /dev/null
+++ b/test/Transpiler/Monomorphize/ClosureConformanceValidatorTest.php
@@ -0,0 +1,503 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+use PhpParser\ParserFactory;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+use RuntimeException;
+use XPHP\Diagnostics\DiagnosticCollector;
+
+/**
+ * The validator that wires {@see ClosureSignatureConformance} to the statically
+ * visible literal sites — a `return` / arrow body (S-A) and a parameter / property
+ * default (S-B) — and reports a provable mismatch.
+ *
+ * The one statically decidable site is the return position (S-A): a `return`
+ * literal or an arrow body whose declared return type is `Closure(...)`. A
+ * parameter/property default cannot hold a closure literal — a default must be a
+ * constant expression — so there is no site there to check.
+ *
+ * The site-recognition and namespace-tracking logic lives in an anonymous
+ * NodeVisitor (invisible to mutation testing), so every rule is pinned
+ * behaviourally: an accept/reject pair, exercised in BOTH modes
+ * (collect ⇒ diagnostics; fail-fast ⇒ throw).
+ */
+final class ClosureConformanceValidatorTest extends TestCase
+{
+    /** The fixed human-readable prefix {@see ClosureConformanceValidator::message()} prepends to every violation detail. */
+    private const MESSAGE_PREFIX = 'Closure literal does not conform to the declared `Closure(...)` type: ';
+
+    /**
+     * A conforming literal at any site is silent in both modes.
+     *
+     * @param non-empty-string $source
+     */
+    #[DataProvider('conformingSites')]
+    public function testConformingLiteralIsAccepted(string $source): void
+    {
+        self::assertCount(0, self::collect($source), 'no diagnostic expected');
+        self::assertNull($this->throwMode($source), 'compile mode must not throw');
+    }
+
+    /**
+     * @return iterable<string, array{string}>
+     */
+    public static function conformingSites(): iterable
+    {
+        yield 'S-A return: same signature' => [
+            '<?php function m(): Closure(int $x): int { return fn(int $x): int => $x; }',
+        ];
+        yield 'S-A return: contravariant param widening' => [
+            '<?php function m(): Closure(Apple $a): Fruit { return fn(Fruit $a): Apple => new Apple(); }',
+        ];
+        yield 'S-A arrow body' => [
+            '<?php $f = fn(): Closure(int $x): int => fn(int $x): int => $x;',
+        ];
+        yield 'S-A method return' => [
+            '<?php class C { public function m(): Closure(int $x): int { return fn(int $x): int => $x; } }',
+        ];
+        yield 'S-A union return: a narrower member conforms' => [
+            '<?php function m(): Closure(): int|string { return fn(): int => 0; }',
+        ];
+        yield 'S-A union parameter: candidate accepts the whole union' => [
+            '<?php function m(): Closure(int|string $x): void { return fn(int|string $x): void => null; }',
+        ];
+        yield 'target references a type parameter ⇒ gradual here' => [
+            '<?php class Box<T> { public function m(): Closure(T $x): T { return fn(string $x): int => 0; } }',
+        ];
+        yield 'S-A builtin target: chain THROUGH a built-in stays gradual' => [
+            // MyErr's chain contains \Exception (a built-in), whose own edge to
+            // \Throwable is unmodeled — the world is open, so the relation is
+            // truly satisfied at runtime and must stay accepted.
+            '<?php class MyErr extends \Exception {} function m(): Closure(): \Throwable { return fn(): MyErr => new MyErr(); }',
+        ];
+        yield 'S-A builtin target: enum implementing the interface stays accepted' => [
+            // The enum's implements clause + implicit UnitEnum edge are modeled,
+            // so its world is OPEN (built-ins in chain) — never falsely proven
+            // unrelated to \Countable.
+            '<?php enum Sized implements \Countable { case One; public function count(): int { return 1; } } function m(): Closure(): \Countable { return fn(): Sized => Sized::One; }',
+        ];
+        yield 'S-A builtin target: __toString class vs \Stringable stays accepted' => [
+            // Stringable is auto-implemented at runtime; methods are unmodeled,
+            // so the carve-out must keep this gradual even though Str's chain
+            // is closed-world built-in-free.
+            '<?php class Str { public function __toString(): string { return "s"; } } function m(): Closure(): \Stringable { return fn(): Str => new Str(); }',
+        ];
+        yield 'S-A builtin target: built-in CANDIDATE stays accepted' => [
+            // \Exception is itself a built-in — never closed-world; its real
+            // edge to \Throwable is unmodeled but genuine.
+            '<?php function m(): Closure(): \Throwable { return fn(): \Exception => new \Exception(); }',
+        ];
+        yield 'S-A builtin target: aliased Stringable carve-out still applies' => [
+            // The carve-out must compare POST-resolution names — an alias
+            // spelling of Stringable gets the same gradual treatment.
+            '<?php use Stringable as Str; class Text { public function __toString(): string { return "t"; } } function m(): Closure(): Str { return fn(): Text => new Text(); }',
+        ];
+        yield 'S-A builtin target: trait-provided __toString stays accepted' => [
+            // Stringable auto-implementation can come from a trait method —
+            // methods (trait or direct) are unmodeled either way.
+            '<?php trait Stringy { public function __toString(): string { return "s"; } } class Tagged2 { use Stringy; } function m(): Closure(): \Stringable { return fn(): Tagged2 => new Tagged2(); }',
+        ];
+        yield 'S-A builtin target: unknown interface in the chain stays accepted' => [
+            // The undeclared interface could extend \Throwable — open world.
+            '<?php class Maybe implements SomeVendorInterface {} function m(): Closure(): \Throwable { return fn(): Maybe => new Maybe(); }',
+        ];
+        yield 'S-A return: relative-named TARGET type resolves and conforms' => [
+            // `namespace\Fruit` in the target must bind to App\Fruit — a
+            // mis-resolution to `App\namespace\Fruit` would be gradual, hiding
+            // the type from the check entirely (the conforming case must hold
+            // for the right reason: Apple <: Fruit, not "unknown class").
+            '<?php function m(): Closure(): namespace\Fruit { return fn(): Apple => new Apple(); }',
+        ];
+        yield 'S-A return: fully-qualified literal type resolves and conforms' => [
+            // `\App\Apple` must resolve absolutely (App\Apple <: App\Fruit), not
+            // relative to the namespace (App\App\Apple, undeclared ⇒ gradual).
+            '<?php function m(): Closure(): Fruit { return fn(): \App\Apple => new Apple(); }',
+        ];
+        yield 'S-A array-sugar parameter: one param lowered to array — matching arity accepted' => [
+            // `U[] $x` is ONE parameter; the `[`/`]` mis-parse recorded three
+            // and false-rejected exactly this correct literal on arity.
+            '<?php function m(): Closure(U[] $x): void { return fn(array $x): void => null; }',
+        ];
+        yield 'S-A array-sugar return: lowers to array and accepts an array literal' => [
+            '<?php function m(): Closure(): int[] { return fn(): array => []; }',
+        ];
+        yield 'S-A chained array-sugar parameter: still ONE param lowered to array' => [
+            // `U[][]` consumes the whole chain; a one-pair-only consume left
+            // `[`/`]` phantom params and false-rejected this correct literal.
+            '<?php function m(): Closure(U[][] $x): void { return fn(array $x): void => null; }',
+        ];
+        yield 'S-A DNF group parameter: one param, gradual — matching arity accepted' => [
+            // `(A&B)|C $x` is ONE parameter; a mis-scan that split the group into
+            // extra params false-rejected this correct literal on arity.
+            '<?php function m(): Closure((A&B)|C $x): int { return fn($x): int => 0; }',
+        ];
+        yield 'S-A DNF group return: gradual leaf accepts any return' => [
+            '<?php function m(): Closure(): (A&B)|C { return fn(): int => 0; }',
+        ];
+        yield 'S-A trailing DNF group return: not truncated to its first member' => [
+            // A scan stopping mid-type recorded `return = A` and provably
+            // rejected a declared class that is no subtype of A; the full
+            // `A|(B&C)` leaf is gradual and must accept.
+            '<?php class A {} class Beta {} function m(): Closure(): A|(B&C) { return fn(): Beta => new Beta(); }',
+        ];
+        // No `Closure(...)` return target ⇒ no site, even though a literal is
+        // returned. A non-closure return type must not pair with the literal.
+        yield 'return of a literal from a non-closure return type' => [
+            '<?php function m(): callable { return fn(string $x): int => 0; }',
+        ];
+        yield 'arrow body literal under a non-closure return type' => [
+            '<?php $f = fn(): callable => fn(string $x): int => 0;',
+        ];
+    }
+
+    /**
+     * A provable mismatch surfaces in both modes, and the diagnostic carries the
+     * closure-conformance code, the literal's line, and the expected detail.
+     *
+     * @param non-empty-string $source
+     */
+    #[DataProvider('violatingSites')]
+    public function testViolatingLiteralIsRejected(string $source, int $line, string $detailNeedle): void
+    {
+        $diagnostics = self::collect($source);
+        self::assertCount(1, $diagnostics);
+        $diagnostic = $diagnostics[0];
+        self::assertSame(ClosureConformanceValidator::CODE, $diagnostic->code);
+        self::assertNotNull($diagnostic->location);
+        self::assertSame($line, $diagnostic->location->line, 'diagnostic points at the literal');
+        self::assertSame(self::MESSAGE_PREFIX . $detailNeedle, $diagnostic->message);
+
+        $thrown = $this->throwMode($source);
+        self::assertInstanceOf(RuntimeException::class, $thrown);
+        self::assertSame(self::MESSAGE_PREFIX . $detailNeedle, $thrown->getMessage());
+    }
+
+    /**
+     * @return iterable<string, array{string, int, string}>
+     */
+    public static function violatingSites(): iterable
+    {
+        yield 'S-A return: param not wider (contravariance)' => [
+            "<?php function m(): Closure(int \$x): int {\n    return fn(string \$x): int => 0;\n}",
+            2,
+            'parameter 1: string is not wider than int',
+        ];
+        yield 'S-A return: return not a subtype (covariance)' => [
+            "<?php function m(): Closure(int \$x): Apple {\n    return fn(int \$x): Fruit => new Fruit();\n}",
+            2,
+            'return type: App\\Fruit is not a subtype of App\\Apple',
+        ];
+        yield 'S-A arrow body: arity too few' => [
+            "<?php \$f = fn(): Closure(int \$a, int \$b): void =>\n    fn(int \$a): void => null;",
+            2,
+            'expects at least 2 parameter(s), candidate accepts at most 1',
+        ];
+        yield 'S-A return: requires more' => [
+            "<?php function m(): Closure(int \$a): void {\n    return fn(int \$a, int \$b): void => null;\n}",
+            2,
+            'requires 2 parameter(s) but the target guarantees only 1',
+        ];
+        yield 'S-A method return: by-ref mismatch' => [
+            "<?php class C {\n    public function m(): Closure(int \$x): void { return fn(int &\$x): void => null; }\n}",
+            2,
+            'parameter 1: by-reference-ness must match exactly (target by-value, candidate by-ref)',
+        ];
+        yield 'S-A union return: outside the union' => [
+            "<?php function m(): Closure(): int|string {\n    return fn(): float => 0.0;\n}",
+            2,
+            'return type: float is not a subtype of int|string',
+        ];
+        yield 'S-A union parameter: candidate too narrow' => [
+            "<?php function m(): Closure(int|string \$x): void {\n    return fn(int \$x): void => null;\n}",
+            2,
+            'parameter 1: int is not wider than int|string',
+        ];
+        yield 'S-A builtin target: closed-world candidate is provably rejected' => [
+            // Apple's whole ancestry (Fruit) is declared user code with no
+            // built-in anywhere — no unmodeled edge to \Throwable can exist, so
+            // the `false` is a real proof. (This was the guard's blind spot:
+            // ANY built-in target used to go gradual.)
+            "<?php function m(): Closure(): \\Throwable {\n    return fn(): Apple => new Apple();\n}",
+            2,
+            'return type: App\\Apple is not a subtype of Throwable',
+        ];
+        yield 'S-A return: relative-named TARGET violation is caught' => [
+            // Pre-fix, `namespace\Apple` resolved to `App\namespace\Apple`
+            // (undeclared ⇒ gradual) and this provable violation was missed.
+            "<?php function m(): Closure(): namespace\\Apple {\n    return fn(): Fruit => new Fruit();\n}",
+            2,
+            'return type: App\\Fruit is not a subtype of App\\Apple',
+        ];
+        yield 'S-A return: fully-qualified literal violation is caught' => [
+            // Pre-fix, `\App\Fruit` flattened to the relative `App\App\Fruit`
+            // (undeclared ⇒ gradual) and this provable violation was missed.
+            "<?php function m(): Closure(): Apple {\n    return fn(): \\App\\Fruit => new Fruit();\n}",
+            2,
+            'return type: App\\Fruit is not a subtype of App\\Apple',
+        ];
+        yield 'S-A array-sugar parameter: wrong arity still rejected' => [
+            // The lowered `array` leaf is gradual but the ARITY is not: the
+            // one-param target must reject a two-param literal.
+            "<?php function m(): Closure(int[] \$x): void {\n    return fn(array \$a, array \$b): void => null;\n}",
+            2,
+            'requires 2 parameter(s) but the target guarantees only 1',
+        ];
+        yield 'S-A DNF group parameter: wrong arity still rejected' => [
+            // The DNF leaf is gradual but the ARITY is not: the one-param target
+            // must reject a two-param literal (the group mis-scan used to record
+            // a phantom second parameter, false-accepting exactly this shape).
+            "<?php function m(): Closure((A&B)|C \$x): int {\n    return fn(int \$a, int \$b): int => 0;\n}",
+            2,
+            'requires 2 parameter(s) but the target guarantees only 1',
+        ];
+    }
+
+    /**
+     * A returned expression that is not a closure literal (a variable, a call, a
+     * property fetch) is not a candidate: the validator must skip it, never fatal
+     * by extracting a signature from a non-closure node.
+     *
+     * @param non-empty-string $source
+     */
+    #[DataProvider('nonLiteralValues')]
+    public function testNonLiteralValueIsSkipped(string $source): void
+    {
+        self::assertCount(0, self::collect($source));
+        self::assertNull($this->throwMode($source));
+    }
+
+    /**
+     * @return iterable<string, array{string}>
+     */
+    public static function nonLiteralValues(): iterable
+    {
+        yield 'return of a superglobal fetch' => [
+            '<?php function m(): Closure(int $x): int { return $GLOBALS["h"]; }',
+        ];
+        yield 'return of a variable' => [
+            '<?php function m(): Closure(int $x): int { $h = fn(string $s): int => 0; return $h; }',
+        ];
+        yield 'return of a call result' => [
+            '<?php function h(): callable { return fn() => 1; } function m(): Closure(int $x): int { return h(); }',
+        ];
+    }
+
+    public function testUseImportedTypeNamesResolveForConformance(): void
+    {
+        // Both the target's `Apple` and the candidate's `Fruit` reach the engine
+        // only if the `use` imports are tracked: without them each resolves to the
+        // undeclared `Client\...`, the relation is unprovable, and the real
+        // Fruit-is-not-a-subtype-of-Apple violation is silently lost.
+        $source = <<<'X'
+        <?php
+        namespace App { class Fruit {} class Apple extends Fruit {} }
+        namespace Client {
+            use App\Apple;
+            use App\Fruit;
+            function make(): Closure(): Apple { return fn(): Fruit => new Fruit(); }
+        }
+        X;
+        $ast = self::parseRaw($source);
+
+        $diagnostics = new DiagnosticCollector();
+        self::validator($ast)->validateFile($ast, 'test.xphp', $diagnostics);
+
+        $collected = $diagnostics->all();
+        self::assertCount(1, $collected);
+        self::assertSame(
+            self::MESSAGE_PREFIX . 'return type: App\\Fruit is not a subtype of App\\Apple',
+            $collected[0]->message,
+        );
+    }
+
+    public function testRelativeNamespaceLiteralTypeIsNotCapturedByAUseAlias(): void
+    {
+        // PHP binds `namespace\Apple` to the CURRENT namespace regardless of the
+        // colliding `use Other\Apple`. Routing it through the alias-aware
+        // resolver captured `Other\Apple` (declared, unrelated to App\Fruit) and
+        // FALSE-REJECTED this conforming factory.
+        $source = <<<'X'
+        <?php
+        namespace Other { class Apple {} }
+        namespace App { class Fruit {} class Apple extends Fruit {} }
+        namespace App {
+            use Other\Apple;
+            function make(): Closure(): Fruit { return fn(): namespace\Apple => new \App\Apple(); }
+        }
+        X;
+        $ast = self::parseRaw($source);
+
+        $diagnostics = new DiagnosticCollector();
+        self::validator($ast)->validateFile($ast, 'test.xphp', $diagnostics);
+
+        self::assertCount(0, $diagnostics->all(), 'namespace\\RealApple must bind to App, not the use alias');
+    }
+
+    public function testTargetUnionMembersAreResolvedForConformance(): void
+    {
+        // Both union members must resolve to `App\*` for the engine to prove `Fruit`
+        // is neither; if the resolver didn't recurse into union members they'd stay
+        // unqualified/undeclared and the violation would be silently lost.
+        $source = <<<'X'
+        <?php
+        namespace App;
+        class Fruit {}
+        class Apple extends Fruit {}
+        class Orange extends Fruit {}
+        function make(): Closure(): Apple|Orange { return fn(): Fruit => new Fruit(); }
+        X;
+        $ast = self::parseRaw($source);
+
+        $diagnostics = new DiagnosticCollector();
+        self::validator($ast)->validateFile($ast, 'test.xphp', $diagnostics);
+
+        self::assertCount(1, $diagnostics->all());
+        self::assertSame(
+            self::MESSAGE_PREFIX . 'return type: App\\Fruit is not a subtype of App\\Apple|App\\Orange',
+            $diagnostics->all()[0]->message,
+        );
+    }
+
+    public function testTargetIntersectionMembersAreResolvedForConformance(): void
+    {
+        // The intersection members must resolve too — `Fruit` is provably not an
+        // `App\Apple`, so the `App\Apple&App\Orange` return target is unsatisfied.
+        $source = <<<'X'
+        <?php
+        namespace App;
+        class Fruit {}
+        class Apple extends Fruit {}
+        class Orange extends Fruit {}
+        function make(): Closure(): Apple&Orange { return fn(): Fruit => new Fruit(); }
+        X;
+        $ast = self::parseRaw($source);
+
+        $diagnostics = new DiagnosticCollector();
+        self::validator($ast)->validateFile($ast, 'test.xphp', $diagnostics);
+
+        self::assertCount(1, $diagnostics->all());
+        self::assertSame(
+            self::MESSAGE_PREFIX . 'return type: App\\Fruit is not a subtype of App\\Apple&App\\Orange',
+            $diagnostics->all()[0]->message,
+        );
+    }
+
+    public function testGlobalBracedNamespaceIsHandledWithoutFatal(): void
+    {
+        // A bare `namespace { ... }` block has a null name; the walk must enter it
+        // (global scope) without dereferencing the absent name, and still reach the
+        // conformance site inside.
+        $source = "<?php\nnamespace { function make(): Closure(int \$x): int { return fn(string \$x): int => 0; } }";
+        $ast = self::parseRaw($source);
+
+        $diagnostics = new DiagnosticCollector();
+        self::validator($ast)->validateFile($ast, 'test.xphp', $diagnostics);
+
+        self::assertCount(1, $diagnostics->all());
+        self::assertSame(
+            self::MESSAGE_PREFIX . 'parameter 1: string is not wider than int',
+            $diagnostics->all()[0]->message,
+        );
+    }
+
+    public function testReturnLiteralIsPairedWithItsInnermostEnclosingFunction(): void
+    {
+        // The inner closure's OWN return type (Closure(int): int) is the target for
+        // its `return`; the outer function's `Closure(string): int` target must not
+        // leak in. A string param would be REJECTED against the outer target but is
+        // ACCEPTED against the inner one — so silence proves correct pairing.
+        $source = <<<'X'
+        <?php
+        function outer(): Closure(string $s): int {
+            $inner = function (): Closure(int $x): int {
+                return fn(int $x): int => $x;
+            };
+            return fn(string $s): int => 0;
+        }
+        X;
+
+        self::assertCount(0, self::collect($source));
+    }
+
+    // ---- outer-class decision helpers (directly mutation-covered) --------
+
+    public function testClosureSigOfUnwrapsNullableAndIgnoresPlainTypes(): void
+    {
+        $ast = self::parseRaw('<?php function m(?Closure(int $x): int $a, int $b): void {}');
+        $params = self::firstFunctionParams($ast);
+
+        self::assertInstanceOf(ClosureSignature::class, ClosureConformanceValidator::closureSigOf($params[0]->type));
+        self::assertNull(ClosureConformanceValidator::closureSigOf($params[1]->type), 'a plain scalar carries no target');
+        self::assertNull(ClosureConformanceValidator::closureSigOf(null));
+    }
+
+    // ---- Helpers ---------------------------------------------------------
+
+    /**
+     * @return list<\XPHP\Diagnostics\Diagnostic>
+     */
+    private static function collect(string $source): array
+    {
+        $ast = self::parse($source);
+        $diagnostics = new DiagnosticCollector();
+        self::validator($ast)->validateFile($ast, 'test.xphp', $diagnostics);
+        return $diagnostics->all();
+    }
+
+    private function throwMode(string $source): ?RuntimeException
+    {
+        $ast = self::parse($source);
+        try {
+            self::validator($ast)->validateFile($ast, 'test.xphp', null);
+            return null;
+        } catch (RuntimeException $e) {
+            return $e;
+        }
+    }
+
+    /**
+     * @param list<\PhpParser\Node\Stmt> $ast
+     */
+    private static function validator(array $ast): ClosureConformanceValidator
+    {
+        return new ClosureConformanceValidator(TypeHierarchy::fromAstPerFile(['test.xphp' => $ast]));
+    }
+
+    /**
+     * @return list<\PhpParser\Node\Stmt>
+     */
+    private static function parse(string $source): array
+    {
+        // The hierarchy needs App\Apple <: App\Fruit for the class-variance cases;
+        // inject the declarations INLINE (no added newline) so every fixture shares
+        // one `App` namespace + classes AND each literal keeps its original line.
+        $prelude = 'namespace App; class Fruit {} class Apple extends Fruit {} ';
+        $withPrelude = preg_replace('/^<\?php\s*/', "<?php {$prelude}", $source, 1);
+        \assert(is_string($withPrelude));
+        return self::parseRaw($withPrelude);
+    }
+
+    /**
+     * @return list<\PhpParser\Node\Stmt>
+     */
+    private static function parseRaw(string $source): array
+    {
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+        return $parser->parse($source);
+    }
+
+    /**
+     * @param list<\PhpParser\Node\Stmt> $ast
+     * @return list<\PhpParser\Node\Param>
+     */
+    private static function firstFunctionParams(array $ast): array
+    {
+        $fn = (new \PhpParser\NodeFinder())->findFirstInstanceOf($ast, \PhpParser\Node\Stmt\Function_::class);
+        \assert($fn instanceof \PhpParser\Node\Stmt\Function_);
+        return array_values($fn->params);
+    }
+}
diff --git a/test/Transpiler/Monomorphize/ClosureDispatcherIntegrationTest.php b/test/Transpiler/Monomorphize/ClosureDispatcherIntegrationTest.php
index be5e2c2..9b9c4c2 100644
--- a/test/Transpiler/Monomorphize/ClosureDispatcherIntegrationTest.php
+++ b/test/Transpiler/Monomorphize/ClosureDispatcherIntegrationTest.php
@@ -195,10 +195,12 @@ public function testUseClauseClosureSpecializesViaDispatcher(): void
         $this->rrmdir(dirname($dir));
     }
 
-    public function testEmptyArgSetsLeavesOriginalAssignUntouched(): void
+    public function testTemplateNeverCalledViaTurbofishIsRejected(): void
     {
-        // Template declared but never called via turbofish. The Assign
-        // RHS stays as the original closure body; no dispatcher emitted.
+        // Template declared but never called via turbofish. It used to keep
+        // its original Assign untouched — emitting raw `T` hints that name
+        // the non-existent class App\T and fatal on first invocation. It is
+        // now rejected loudly instead.
         $dir = $this->mkdir('disp-empty');
         file_put_contents($dir . '/Use.xphp', <<<'PHP'
         <?php
@@ -206,19 +208,13 @@ public function testEmptyArgSetsLeavesOriginalAssignUntouched(): void
         $id = function<T>(T $x): T { return $x; };
         PHP);
 
-        $this->compile($dir);
-        $out = file_get_contents($dir . '/dist/Use.php');
-        self::assertIsString($out);
-        // Negative invariants kept: no dispatcher tag-parameter and no
-        // specialized function emitted when the template is never called.
-        self::assertStringNotContainsString('__xphp_tag', $out);
-        self::assertStringNotContainsString('closure_id_T_', $out);
-        SnapshotHash::assertMatches(
-            __DIR__ . '/ClosureDispatcherIntegrationTest/testEmptyArgSetsLeavesOriginalAssignUntouched/Use.expected.php',
-            $out,
-        );
-
-        $this->rrmdir(dirname($dir));
+        try {
+            $this->expectException(RuntimeException::class);
+            $this->expectExceptionMessage('never specialized');
+            $this->compile($dir);
+        } finally {
+            $this->rrmdir(dirname($dir));
+        }
     }
 
     public function testNestedScopeCallsShareDispatcher(): void
@@ -259,6 +255,51 @@ public function testNestedScopeCallsShareDispatcher(): void
         $this->rrmdir(dirname($dir));
     }
 
+    #[RunInSeparateProcess]
+    public function testFirstClassCallableTurbofishClosureEmitsValidForwardingClosureAndRuns(): void
+    {
+        // `$g = $f::<int>(...)` used to emit `$f('T_…', ...)` — a tag arg beside the FCC
+        // placeholder, which does not parse. It now emits a forwarding closure that routes
+        // through the dispatcher, preserving captures / variadics / named args. The require
+        // below both parses (else it fatals) and executes the emitted output.
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/turbofish_fcc_closure/source',
+            'fcc-closure',
+        );
+        try {
+            require __DIR__ . '/../../fixture/compile/turbofish_fcc_closure/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+
+    public function testFirstClassCallableOfThisCapturingClosureIsRejected(): void
+    {
+        // The eager `$this`-capture reject fires for an FCC too (it sits before the FCC
+        // handling): an FCC of a `$this`-capturing generic closure draws the loud
+        // capture error, not a broken forwarding closure.
+        $dir = $this->mkdir('fcc-this');
+        file_put_contents($dir . '/Use.xphp', <<<'PHP'
+        <?php
+        namespace App;
+        class Widget {
+            public int $n = 3;
+            public function make(): callable {
+                $f = fn<T>(T $x): T => $x + $this->n;
+                return $f::<int>(...);
+            }
+        }
+        PHP);
+
+        try {
+            $this->expectException(RuntimeException::class);
+            $this->expectExceptionMessage('captures `$this`');
+            $this->compile($dir);
+        } finally {
+            $this->rrmdir(dirname($dir));
+        }
+    }
+
     // ----- helpers ---------------------------------------------------------
 
     private function mkdir(string $tag): string
diff --git a/test/Transpiler/Monomorphize/ClosureDispatcherIntegrationTest/testEmptyArgSetsLeavesOriginalAssignUntouched/Use.expected.php b/test/Transpiler/Monomorphize/ClosureDispatcherIntegrationTest/testEmptyArgSetsLeavesOriginalAssignUntouched/Use.expected.php
deleted file mode 100644
index 5b71f69..0000000
--- a/test/Transpiler/Monomorphize/ClosureDispatcherIntegrationTest/testEmptyArgSetsLeavesOriginalAssignUntouched/Use.expected.php
+++ /dev/null
@@ -1,7 +0,0 @@
-<?php
-
-namespace App;
-
-$id = function (T $x): T {
-    return $x;
-};
diff --git a/test/Transpiler/Monomorphize/ClosureLiteralSignatureTest.php b/test/Transpiler/Monomorphize/ClosureLiteralSignatureTest.php
new file mode 100644
index 0000000..88481d9
--- /dev/null
+++ b/test/Transpiler/Monomorphize/ClosureLiteralSignatureTest.php
@@ -0,0 +1,243 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+use PhpParser\Node;
+use PhpParser\Node\Expr\ArrowFunction;
+use PhpParser\Node\Expr\Closure;
+use PhpParser\NodeFinder;
+use PhpParser\ParserFactory;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * Extraction of a closure literal's declared signature into a candidate
+ * {@see ClosureSignature}. Types resolve against a supplied namespace context;
+ * untyped/absent/compound slots stay gradual.
+ */
+final class ClosureLiteralSignatureTest extends TestCase
+{
+    public function testExtractsTypedParametersAndReturn(): void
+    {
+        $sig = self::extract(
+            '<?php $f = function (int $x, Fruit $y): Apple { return new Apple(); };',
+            self::ctx('App', ['Fruit' => 'App\\Models\\Fruit']),
+        );
+
+        self::assertCount(2, $sig->params);
+        self::assertSame('int', self::typeName($sig->params[0]->type));
+        self::assertTrue(self::refIsScalar($sig->params[0]->type));
+        self::assertSame('App\\Models\\Fruit', self::typeName($sig->params[1]->type), 'a use-imported class resolves via the alias');
+        self::assertSame('App\\Apple', self::typeName($sig->return), 'a bare class resolves against the current namespace');
+    }
+
+    public function testFullyQualifiedTypesKeepTheirAbsoluteResolution(): void
+    {
+        // `\App\Foo` inside `namespace App` must resolve to `App\Foo` — not the
+        // namespace-relative `App\App\Foo` (toString() drops the leading `\`,
+        // and the mis-resolved name is undeclared ⇒ silently gradual).
+        $sig = self::extract(
+            '<?php $f = function (\App\Foo $x): \App\Bar { return new \App\Bar(); };',
+            self::ctx('App'),
+        );
+
+        self::assertSame('App\\Foo', self::typeName($sig->params[0]->type));
+        self::assertSame('App\\Bar', self::typeName($sig->return));
+    }
+
+    public function testRelativeNamespaceTypeStillResolvesAgainstCurrent(): void
+    {
+        // `namespace\Foo` (Name\Relative) resolves against the CURRENT
+        // namespace directly — never via the fully-qualified branch
+        // (toCodeString() would mis-resolve to `App\namespace\Foo`).
+        $sig = self::extract(
+            '<?php $f = function (): namespace\Foo { return new namespace\Foo(); };',
+            self::ctx('App'),
+        );
+
+        self::assertSame('App\\Foo', self::typeName($sig->return));
+    }
+
+    public function testRelativeNamespaceTypeIsNeverCapturedByAUseAlias(): void
+    {
+        // PHP binds `namespace\Foo` to the current namespace regardless of any
+        // `use Other\Foo` in scope; routing it through the alias-aware resolver
+        // would resolve `Other\Foo` and could FALSE-REJECT a conforming literal.
+        $sig = self::extract(
+            '<?php $f = function (): namespace\Foo { return new namespace\Foo(); };',
+            self::ctx('App', ['Foo' => 'Other\\Foo']),
+        );
+
+        self::assertSame('App\\Foo', self::typeName($sig->return));
+    }
+
+    public function testRelativeNamespaceTypeInGlobalNamespace(): void
+    {
+        // `namespace\Foo` in the unnamed namespace is just `Foo`.
+        $sig = self::extract(
+            '<?php $f = function (): namespace\Foo { return new namespace\Foo(); };',
+            self::ctx(''),
+        );
+
+        self::assertSame('Foo', self::typeName($sig->return));
+    }
+
+    public function testFullyQualifiedClosureTypeResolvesToClosure(): void
+    {
+        // `\Closure` is a class name, not a scalar — the FQ branch must hand it
+        // to the resolver, which strips the `\` to the plain `Closure` FQCN.
+        $sig = self::extract('<?php $f = function (): \Closure { return fn() => 1; };', self::ctx('App'));
+
+        self::assertSame('Closure', self::typeName($sig->return));
+    }
+
+    public function testUntypedParameterBecomesMixed(): void
+    {
+        $sig = self::extract('<?php $f = fn($x) => $x;', self::ctx());
+
+        self::assertCount(1, $sig->params);
+        self::assertSame('mixed', self::typeName($sig->params[0]->type));
+    }
+
+    public function testAbsentReturnStaysAbsent(): void
+    {
+        $sig = self::extract('<?php $f = fn(int $x) => $x;', self::ctx());
+
+        self::assertNull($sig->return, 'no return type ⇒ absent (gradual), distinct from mixed');
+    }
+
+    public function testByRefAndVariadicAndOptionalAreCaptured(): void
+    {
+        $sig = self::extract('<?php $f = function (int &$r, int $o = 0, string ...$rest) {};', self::ctx());
+
+        self::assertCount(3, $sig->params);
+        self::assertTrue($sig->params[0]->byRef);
+        self::assertFalse($sig->params[0]->optional);
+        self::assertTrue($sig->params[1]->optional);
+        self::assertTrue($sig->params[2]->variadic);
+    }
+
+    public function testNullableAndUnionTypesAreStructured(): void
+    {
+        $sig = self::extract('<?php $f = function (?int $a, int|string $b): int|null { return 1; };', self::ctx());
+
+        // ?int ≡ int|null
+        $a = $sig->params[0]->type;
+        self::assertInstanceOf(SigUnion::class, $a);
+        self::assertSame(['int', 'null'], self::memberNames($a));
+        // The synthesized `null` leaf is scalar-flagged, matching the SCALAR_TYPES
+        // leaf path (`null` ∈ SCALAR_TYPES).
+        self::assertTrue(self::refIsScalar($a->members[1]));
+
+        $b = $sig->params[1]->type;
+        self::assertInstanceOf(SigUnion::class, $b);
+        self::assertSame(['int', 'string'], self::memberNames($b));
+
+        self::assertInstanceOf(SigUnion::class, $sig->return);
+        self::assertSame(['int', 'null'], self::memberNames($sig->return));
+    }
+
+    public function testIntersectionTypeIsStructured(): void
+    {
+        $sig = self::extract('<?php $f = function (): Countable&Traversable { return null; };', self::ctx('App'));
+
+        self::assertInstanceOf(SigIntersection::class, $sig->return);
+        self::assertSame(['App\\Countable', 'App\\Traversable'], self::memberNames($sig->return));
+    }
+
+    public function testIntersectionWithAScalarMemberFallsBackToRaw(): void
+    {
+        // Not valid PHP (a scalar can't be an intersection member); nikic still
+        // builds it, and the extractor keeps it gradual rather than structuring.
+        $sig = self::extract('<?php $f = function (int&Countable $a) {}; ', self::ctx('App'));
+
+        self::assertInstanceOf(SigRaw::class, $sig->params[0]->type);
+    }
+
+    public function testDnfUnionMemberIsStructuredRecursively(): void
+    {
+        $sig = self::extract('<?php $f = function (): (Countable&Traversable)|Stringable { return null; };', self::ctx('App'));
+
+        $ret = $sig->return;
+        self::assertInstanceOf(SigUnion::class, $ret);
+        self::assertInstanceOf(SigIntersection::class, $ret->members[0]);
+        self::assertInstanceOf(SigTypeRef::class, $ret->members[1]);
+    }
+
+    public function testArrowFunctionReturnIsExtracted(): void
+    {
+        $sig = self::extract('<?php $f = fn(int $x): string => (string) $x;', self::ctx());
+
+        self::assertCount(1, $sig->params);
+        self::assertSame('string', self::typeName($sig->return));
+    }
+
+    public function testBuiltinArrayAndCallableResolveAsBuiltins(): void
+    {
+        $sig = self::extract('<?php $f = function (array $a, callable $c): void {};', self::ctx('App'));
+
+        self::assertSame('array', self::typeName($sig->params[0]->type));
+        self::assertSame('callable', self::typeName($sig->params[1]->type));
+        self::assertSame('void', self::typeName($sig->return));
+    }
+
+    public function testCapitalCasedScalarKeywordsAreRecognized(): void
+    {
+        // PHP type keywords are case-insensitive; `Int`/`Bool` must fold to the
+        // canonical lowercase scalar, not be mistaken for class names.
+        $sig = self::extract('<?php $f = function (Int $x): Bool { return true; };', self::ctx('App'));
+
+        self::assertSame('int', self::typeName($sig->params[0]->type));
+        self::assertTrue(self::refIsScalar($sig->params[0]->type));
+        self::assertSame('bool', self::typeName($sig->return));
+    }
+
+    // ---- Helpers ---------------------------------------------------------
+
+    private static function extract(string $source, NamespaceContext $ctx): ClosureSignature
+    {
+        $parser = (new ParserFactory())->createForHostVersion();
+        $ast = $parser->parse($source) ?? [];
+        $literal = (new NodeFinder())->findFirst($ast, static fn (Node $n): bool => $n instanceof Closure || $n instanceof ArrowFunction);
+        self::assertInstanceOf(Node::class, $literal);
+        \assert($literal instanceof Closure || $literal instanceof ArrowFunction);
+
+        return ClosureLiteralSignature::extract($literal, $ctx);
+    }
+
+    /**
+     * @param array<string, string> $uses alias => FQN
+     */
+    private static function ctx(string $namespace = '', array $uses = []): NamespaceContext
+    {
+        $ctx = new NamespaceContext();
+        $ctx->enterNamespace($namespace === '' ? null : $namespace);
+        foreach ($uses as $alias => $fqn) {
+            $ctx->indexUse(new \PhpParser\Node\Stmt\Use_([
+                new \PhpParser\Node\UseItem(new \PhpParser\Node\Name($fqn), new \PhpParser\Node\Identifier($alias)),
+            ]));
+        }
+        return $ctx;
+    }
+
+    private static function typeName(?SigType $type): ?string
+    {
+        return $type instanceof SigTypeRef ? $type->type->name : null;
+    }
+
+    /**
+     * The `TypeRef` names of a compound leaf's members, in order.
+     *
+     * @return list<?string>
+     */
+    private static function memberNames(SigUnion|SigIntersection $type): array
+    {
+        return array_map(self::typeName(...), $type->members);
+    }
+
+    private static function refIsScalar(SigType $type): bool
+    {
+        return $type instanceof SigTypeRef && $type->type->isScalar;
+    }
+}
diff --git a/test/Transpiler/Monomorphize/ClosureSignatureConformanceTest.php b/test/Transpiler/Monomorphize/ClosureSignatureConformanceTest.php
new file mode 100644
index 0000000..56f8f10
--- /dev/null
+++ b/test/Transpiler/Monomorphize/ClosureSignatureConformanceTest.php
@@ -0,0 +1,691 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * Unit matrix for the pure conformance engine: candidate closure signature vs.
+ * target `Closure(...)` type. `check()` returns null when the candidate conforms
+ * OR the mismatch is not provable (gradual accept), and a violation only for a
+ * PROVABLE mismatch. The cardinal rule: never a false reject.
+ */
+final class ClosureSignatureConformanceTest extends TestCase
+{
+    // ---- Arity -----------------------------------------------------------
+
+    public function testEqualArityConforms(): void
+    {
+        self::assertConforms(
+            self::sig([self::p(self::ref('int')), self::p(self::ref('int'))], self::ref('int')),
+            self::sig([self::p(self::ref('int')), self::p(self::ref('int'))], self::ref('int')),
+        );
+    }
+
+    public function testCandidateWithFewerParametersIsRejected(): void
+    {
+        self::assertViolation(
+            ClosureConformanceViolation::KIND_ARITY_TOO_FEW,
+            self::sig([self::p(self::ref('int'))], self::ref('int')),          // candidate: 1 param
+            self::sig([self::p(self::ref('int')), self::p(self::ref('int'))], self::ref('int')), // target: 2
+        );
+    }
+
+    public function testCandidateRequiringMoreThanTargetGuaranteesIsRejected(): void
+    {
+        self::assertViolation(
+            ClosureConformanceViolation::KIND_ARITY_REQUIRES_MORE,
+            self::sig([self::p(self::ref('int')), self::p(self::ref('int'))], self::ref('int')), // candidate requires 2
+            self::sig([self::p(self::ref('int'))], self::ref('int')),                            // target guarantees 1
+        );
+    }
+
+    public function testCandidateExtraOptionalParameterConforms(): void
+    {
+        // fn(int $x, int $y = 0) accepts a 1-arg call — conforms to Closure(int): int.
+        self::assertConforms(
+            self::sig([self::p(self::ref('int')), self::p(self::ref('int'), optional: true)], self::ref('int')),
+            self::sig([self::p(self::ref('int'))], self::ref('int')),
+        );
+    }
+
+    public function testVariadicCandidateAbsorbsExtraTargetParameters(): void
+    {
+        self::assertConforms(
+            self::sig([self::p(self::ref('int'), variadic: true)], self::ref('int')),
+            self::sig([self::p(self::ref('int')), self::p(self::ref('int'))], self::ref('int')),
+        );
+    }
+
+    public function testVariadicTargetRequiresVariadicCandidate(): void
+    {
+        // target Closure(int, ...int): a caller may pass 1, 2, 3… args; a fixed
+        // 1-arg candidate that matches the required arity still can't absorb the
+        // tail, so it needs its own variadic.
+        self::assertViolation(
+            ClosureConformanceViolation::KIND_VARIADIC_REQUIRED,
+            self::sig([self::p(self::ref('int'))], self::ref('int')),  // fixed candidate (arity 1 OK)
+            self::sig([self::p(self::ref('int')), self::p(self::ref('int'), variadic: true)], self::ref('int')),
+        );
+    }
+
+    // ---- Parameters: contravariant --------------------------------------
+
+    public function testWiderCandidateParameterConforms(): void
+    {
+        // target param Apple; candidate param Fruit (wider) — contravariant OK.
+        self::assertConforms(
+            self::sig([self::p(self::ref('App\\Fruit'))], self::ref('int')),
+            self::sig([self::p(self::ref('App\\Apple'))], self::ref('int')),
+        );
+    }
+
+    public function testNarrowerCandidateParameterIsRejected(): void
+    {
+        // target param Fruit; candidate param Apple (narrower) — provable violation.
+        self::assertViolation(
+            ClosureConformanceViolation::KIND_PARAM_TYPE,
+            self::sig([self::p(self::ref('App\\Apple'))], self::ref('int')),
+            self::sig([self::p(self::ref('App\\Fruit'))], self::ref('int')),
+        );
+    }
+
+    public function testUnrelatedClassParameterIsRejected(): void
+    {
+        self::assertViolation(
+            ClosureConformanceViolation::KIND_PARAM_TYPE,
+            self::sig([self::p(self::ref('App\\Apple'))], self::ref('int')),
+            self::sig([self::p(self::ref('App\\Orange'))], self::ref('int')),
+        );
+    }
+
+    public function testScalarParameterMismatchIsRejected(): void
+    {
+        self::assertViolation(
+            ClosureConformanceViolation::KIND_PARAM_TYPE,
+            self::sig([self::p(self::ref('string'))], self::ref('int')),
+            self::sig([self::p(self::ref('int'))], self::ref('int')),
+        );
+    }
+
+    public function testUntypedCandidateParameterConformsGradually(): void
+    {
+        // fn($x) => ... : untyped param ⇒ mixed ⇒ always conforms.
+        self::assertConforms(
+            self::sig([self::p(self::ref('mixed'))], self::ref('int')),
+            self::sig([self::p(self::ref('int'))], self::ref('int')),
+        );
+    }
+
+    // ---- Return: covariant ----------------------------------------------
+
+    public function testNarrowerReturnConforms(): void
+    {
+        self::assertConforms(
+            self::sig([], self::ref('App\\Apple')),   // candidate returns Apple
+            self::sig([], self::ref('App\\Fruit')),   // target returns Fruit
+        );
+    }
+
+    public function testWiderReturnIsRejected(): void
+    {
+        self::assertViolation(
+            ClosureConformanceViolation::KIND_RETURN_TYPE,
+            self::sig([], self::ref('App\\Fruit')),   // candidate returns Fruit (wider)
+            self::sig([], self::ref('App\\Apple')),   // target returns Apple
+        );
+    }
+
+    public function testAbsentCandidateReturnConformsGradually(): void
+    {
+        self::assertConforms(
+            self::sig([], null),                      // candidate: no return type
+            self::sig([], self::ref('int')),
+        );
+    }
+
+    public function testAbsentTargetReturnAcceptsAnyCandidateReturn(): void
+    {
+        self::assertConforms(
+            self::sig([], self::ref('int')),
+            self::sig([], null),
+        );
+    }
+
+    // ---- By-reference: exact --------------------------------------------
+
+    public function testByRefCandidateInByValueSlotIsRejected(): void
+    {
+        self::assertViolation(
+            ClosureConformanceViolation::KIND_BYREF,
+            self::sig([self::p(self::ref('int'), byRef: true)], self::ref('int')),
+            self::sig([self::p(self::ref('int'))], self::ref('int')),
+        );
+    }
+
+    public function testByValueCandidateInByRefSlotIsRejected(): void
+    {
+        self::assertViolation(
+            ClosureConformanceViolation::KIND_BYREF,
+            self::sig([self::p(self::ref('int'))], self::ref('int')),
+            self::sig([self::p(self::ref('int'), byRef: true)], self::ref('int')),
+        );
+    }
+
+    // ---- Pseudo-type leaves: every one must ACCEPT (would false-reject
+    //      if routed through isSubtype). ------------------------------------
+
+    #[DataProvider('pseudoTypeAcceptPairs')]
+    public function testPseudoTypeLeavesAreAccepted(string $candidateReturn, string $targetReturn): void
+    {
+        self::assertConforms(
+            self::sig([], self::ref($candidateReturn)),
+            self::sig([], self::ref($targetReturn)),
+        );
+    }
+
+    /** @return iterable<string, array{string, string}> */
+    public static function pseudoTypeAcceptPairs(): iterable
+    {
+        yield 'class candidate vs object target' => ['App\\Fruit', 'object'];
+        yield 'object candidate vs class target' => ['object', 'App\\Fruit'];
+        yield 'never candidate return' => ['never', 'App\\Fruit'];
+        yield 'array candidate vs iterable target' => ['array', 'iterable'];
+        yield 'mixed target' => ['int', 'mixed'];
+        yield 'mixed candidate' => ['mixed', 'int'];
+        yield 'callable vs Closure' => ['callable', 'App\\Closurish'];
+        yield 'static leaf' => ['static', 'App\\Fruit'];
+        yield 'self leaf' => ['self', 'App\\Fruit'];
+    }
+
+    public function testTrueAndFalseNormalizeToBool(): void
+    {
+        self::assertConforms(self::sig([], self::ref('true')), self::sig([], self::ref('bool')));
+        self::assertConforms(self::sig([], self::ref('false')), self::sig([], self::ref('bool')));
+    }
+
+    // ---- Gradual: type-param, SigRaw, unresolved class ------------------
+
+    public function testUngroundedTypeParameterLeafIsAccepted(): void
+    {
+        self::assertConforms(
+            self::sig([self::p(self::refParam('T'))], self::refParam('U')),
+            self::sig([self::p(self::ref('int'))], self::ref('string')),
+        );
+    }
+
+    public function testRawUnionLeafIsAcceptedGradually(): void
+    {
+        self::assertConforms(
+            self::sig([self::p(new SigRaw('A|B'))], self::ref('int')),
+            self::sig([self::p(self::ref('App\\Apple'))], self::ref('int')),
+        );
+    }
+
+    public function testUnresolvedClassIsAcceptedGradually(): void
+    {
+        // Neither class is in the hierarchy ⇒ isSubtype null ⇒ accept.
+        self::assertConforms(
+            self::sig([], self::ref('App\\Unknown\\Foo')),
+            self::sig([], self::ref('App\\Unknown\\Bar')),
+        );
+    }
+
+    // ---- Nested closure leaf: variance flips ----------------------------
+
+    public function testNestedClosureParameterFlipsVariance(): void
+    {
+        // target param: Closure(Apple): int  ; candidate param: Closure(Fruit): int
+        // A parameter position is contravariant, and a nested closure's own params
+        // are contravariant — the two flips compose so the candidate's inner param
+        // (Fruit) being WIDER than the target's inner param (Apple) is a REJECT
+        // (the candidate promises to accept a narrower inner arg than the target).
+        $targetInner = self::sig([self::p(self::ref('App\\Apple'))], self::ref('int'));
+        $candidateInner = self::sig([self::p(self::ref('App\\Fruit'))], self::ref('int'));
+
+        $violation = self::engine()->check(
+            self::sig([self::p(self::cl($candidateInner))], self::ref('int')),
+            self::sig([self::p(self::cl($targetInner))], self::ref('int')),
+        );
+        self::assertNotNull($violation);
+        self::assertSame(ClosureConformanceViolation::KIND_PARAM_TYPE, $violation->kind);
+        self::assertSame('parameter 1: Closure(...) is not wider than Closure(...)', $violation->detail);
+    }
+
+    public function testNestedClosureReturnConforms(): void
+    {
+        // return position: candidate Closure(Fruit): Apple vs target Closure(Apple): Fruit
+        // inner param contravariant (Fruit wider than Apple: OK), inner return
+        // covariant (Apple narrower than Fruit: OK) — conforms.
+        $candidateInner = self::sig([self::p(self::ref('App\\Fruit'))], self::ref('App\\Apple'));
+        $targetInner = self::sig([self::p(self::ref('App\\Apple'))], self::ref('App\\Fruit'));
+
+        self::assertConforms(
+            self::sig([], self::cl($candidateInner)),
+            self::sig([], self::cl($targetInner)),
+        );
+    }
+
+    public function testClosureCandidateVsScalarTargetIsRejected(): void
+    {
+        self::assertViolation(
+            ClosureConformanceViolation::KIND_RETURN_TYPE,
+            self::sig([], self::cl(self::sig([], self::ref('int')))),
+            self::sig([], self::ref('int')),
+        );
+    }
+
+    // ---- checkStructural stops at arity/by-ref, ignores type rules -------
+
+    public function testCheckStructuralIgnoresTypeMismatch(): void
+    {
+        // A narrower param (type violation) but matching arity/by-ref: structural
+        // pass is clean; full check rejects.
+        $candidate = self::sig([self::p(self::ref('App\\Apple'))], self::ref('int'));
+        $target = self::sig([self::p(self::ref('App\\Fruit'))], self::ref('int'));
+
+        self::assertNull(self::engine()->checkStructural($candidate, $target));
+        self::assertNotNull(self::engine()->check($candidate, $target));
+    }
+
+    public function testCheckStructuralStillCatchesArity(): void
+    {
+        self::assertSame(
+            ClosureConformanceViolation::KIND_ARITY_TOO_FEW,
+            self::engine()->checkStructural(
+                self::sig([], self::ref('int')),
+                self::sig([self::p(self::ref('int'))], self::ref('int')),
+            )?->kind,
+        );
+    }
+
+    public function testVariadicCandidateTailTypeIsCheckedOnOverflowPositions(): void
+    {
+        // candidate Closure(int, Fruit ...$rest); target Closure(int, Apple, string).
+        // Position 0 uses the FIXED candidate param (int); the overflow position 2
+        // falls back to the variadic tail (Fruit) and provably mismatches `string`.
+        self::assertViolation(
+            ClosureConformanceViolation::KIND_PARAM_TYPE,
+            self::sig([self::p(self::ref('int')), self::p(self::ref('App\\Fruit'), variadic: true)], self::ref('int')),
+            self::sig([self::p(self::ref('int')), self::p(self::ref('App\\Apple')), self::p(self::ref('string'))], self::ref('int')),
+        );
+    }
+
+    public function testVariadicCandidateFixedParameterIsUsedBeforeTail(): void
+    {
+        // candidate Closure(Fruit, int ...$rest); target Closure(Apple, int). At
+        // position 0 the FIXED candidate param (Fruit, wider than Apple) must be
+        // used — NOT the variadic tail (int) — so this conforms. Reading the tail
+        // at a fixed position would wrongly reject (Apple vs int).
+        self::assertConforms(
+            self::sig([self::p(self::ref('App\\Fruit')), self::p(self::ref('int'), variadic: true)], self::ref('int')),
+            self::sig([self::p(self::ref('App\\Apple')), self::p(self::ref('int'))], self::ref('int')),
+        );
+    }
+
+    public function testVariadicCandidateTailByRefIsCheckedOnOverflowPositions(): void
+    {
+        // candidate Closure(int, int ...$rest by-value); target Closure(int, int, int&).
+        // The overflow position 2 falls back to the by-value tail and mismatches the
+        // target's by-ref param.
+        self::assertViolation(
+            ClosureConformanceViolation::KIND_BYREF,
+            self::sig([self::p(self::ref('int')), self::p(self::ref('int'), variadic: true)], self::ref('int')),
+            self::sig([self::p(self::ref('int')), self::p(self::ref('int')), self::p(self::ref('int'), byRef: true)], self::ref('int')),
+        );
+    }
+
+    public function testVariadicCandidateFixedByRefIsUsedBeforeTail(): void
+    {
+        // candidate Closure(int&, int ...$rest by-value); target Closure(int&, int).
+        // Position 0 must use the FIXED by-ref param (matches the target's by-ref);
+        // reading the by-value tail there would wrongly reject.
+        self::assertConforms(
+            self::sig([self::p(self::ref('int'), byRef: true), self::p(self::ref('int'), variadic: true)], self::ref('int')),
+            self::sig([self::p(self::ref('int'), byRef: true), self::p(self::ref('int'))], self::ref('int')),
+        );
+    }
+
+    public function testRequiredParameterAfterOptionalStillCountsTowardArity(): void
+    {
+        // A required parameter following an optional one lowers nothing: the leading
+        // optional means required arity is 0, so this conforms to a 0-param target;
+        // but the presence of a later required param must not be silently dropped —
+        // against a target that guarantees 0, requiring even one is too many only if
+        // it is *leading*. Here the optional leads, so arity is 0 → conforms.
+        self::assertConforms(
+            self::sig([self::p(self::ref('int'), optional: true), self::p(self::ref('int'))], self::ref('int')),
+            self::sig([], self::ref('int')),
+        );
+    }
+
+    public function testRawUnionOnTargetSideIsAcceptedGradually(): void
+    {
+        self::assertConforms(
+            self::sig([], self::ref('App\\Apple')),
+            self::sig([], new SigRaw('A|B')),
+        );
+    }
+
+    public function testClosureCandidateVsClassTargetIsAccepted(): void
+    {
+        // A closure value vs a non-scalar leaf (a class / object) is gradually
+        // accepted — only a true-scalar target is a provable mismatch.
+        self::assertConforms(
+            self::sig([], self::cl(self::sig([], self::ref('int')))),
+            self::sig([], self::ref('App\\Closurish')),
+        );
+    }
+
+    public function testKnownClassAgainstUndeclaredTargetClassIsAccepted(): void
+    {
+        // Regression: isSubtype(knownChild, undeclaredParent) returns a hard false
+        // (BFS never reaches the unknown); it must NOT be read as a proven mismatch.
+        self::assertConforms(
+            self::sig([], self::ref('App\\Apple')),          // known
+            self::sig([], self::ref('App\\External\\Thing')), // undeclared
+        );
+    }
+
+    public function testUndeclaredCandidateAgainstKnownTargetClassIsAccepted(): void
+    {
+        self::assertConforms(
+            self::sig([], self::ref('App\\External\\Thing')), // undeclared
+            self::sig([], self::ref('App\\Fruit')),           // known
+        );
+    }
+
+    public function testBuiltinReturnTargetIsAcceptedGradually(): void
+    {
+        // Regression (false-reject): the hierarchy models no ancestor edges for
+        // PHP built-ins, so isSubtype('Exception','Throwable') returns a hard false.
+        // A built-in target must NOT be read as a proven mismatch — Exception really
+        // IS a Throwable. Covariant return: candidate Exception, target Throwable.
+        self::assertConforms(
+            self::sig([], self::ref('Exception')),
+            self::sig([], self::ref('Throwable')),
+        );
+    }
+
+    public function testUserSubclassOfBuiltinAgainstBuiltinReturnTargetIsAccepted(): void
+    {
+        // App\MyExc extends the built-in Exception; its ancestry escapes into the
+        // unmodeled built-in graph, so it is really a Throwable but BFS can't prove it.
+        self::assertConforms(
+            self::sig([], self::ref('App\\MyExc')),
+            self::sig([], self::ref('Throwable')),
+        );
+    }
+
+    public function testBuiltinParameterTargetIsAcceptedGradually(): void
+    {
+        // Contravariant parameter: target Exception, candidate Throwable. Throwable
+        // is genuinely wider than Exception, but the relation runs through the
+        // built-in graph — accept rather than false-reject.
+        self::assertConforms(
+            self::sig([self::p(self::ref('Throwable'))], self::ref('void')),
+            self::sig([self::p(self::ref('Exception'))], self::ref('void')),
+        );
+    }
+
+    // ---- Union / intersection member variance (WI-03) --------------------
+
+    public function testUnionTargetParameterRejectsTooNarrowCandidate(): void
+    {
+        // target Closure(int|string $x); candidate fn(int $x) can't accept a string
+        // the target may pass — sub-union OR finds the string arm provably-not.
+        self::assertViolation(
+            ClosureConformanceViolation::KIND_PARAM_TYPE,
+            self::sig([self::p(self::ref('int'))], null),                                    // candidate
+            self::sig([self::p(self::union(self::ref('int'), self::ref('string')))], null),  // target
+        );
+    }
+
+    public function testUnionParameterAcceptsEqualUnionRegardlessOfMemberOrder(): void
+    {
+        // The order-independence case that a super-first decomposition would false-
+        // reject: candidate string|int vs target int|string must conform.
+        self::assertConforms(
+            self::sig([self::p(self::union(self::ref('string'), self::ref('int')))], null),
+            self::sig([self::p(self::union(self::ref('int'), self::ref('string')))], null),
+        );
+    }
+
+    public function testNarrowerReturnConformsToUnionReturn(): void
+    {
+        // candidate return int; target return int|string — int fits the union.
+        self::assertConforms(
+            self::sig([], self::ref('int')),
+            self::sig([], self::union(self::ref('int'), self::ref('string'))),
+        );
+    }
+
+    public function testReturnOutsideUnionIsRejected(): void
+    {
+        // candidate return float; target return int|string — provably neither.
+        self::assertViolation(
+            ClosureConformanceViolation::KIND_RETURN_TYPE,
+            self::sig([], self::ref('float')),
+            self::sig([], self::union(self::ref('int'), self::ref('string'))),
+        );
+    }
+
+    public function testUnionReturnWithGradualMemberStaysGradual(): void
+    {
+        // candidate return App\Apple; target return int|App\External\Thing. Apple is
+        // provably not an int, but the undeclared Thing arm can't be disproven — so
+        // the union stays gradual and accepts (no false reject). A scalar candidate
+        // would instead reject, since a scalar is provably no class at all.
+        self::assertConforms(
+            self::sig([], self::ref('App\\Apple')),
+            self::sig([], self::union(self::ref('int'), self::ref('App\\External\\Thing'))),
+        );
+    }
+
+    public function testNarrowerReturnConformsToNullableUnionReturn(): void
+    {
+        // ?int modelled as int|null; candidate return int is a subtype — accept.
+        self::assertConforms(
+            self::sig([], self::ref('int')),
+            self::sig([], self::union(self::ref('int'), self::ref('null'))),
+        );
+    }
+
+    public function testSuperIntersectionReturnRejectsNonMember(): void
+    {
+        // candidate return App\Fruit; target return App\Apple & App\Closurish —
+        // Fruit is provably not an Apple, so the intersection is not satisfied.
+        self::assertViolation(
+            ClosureConformanceViolation::KIND_RETURN_TYPE,
+            self::sig([], self::ref('App\\Fruit')),
+            self::sig([], self::intersection(self::ref('App\\Apple'), self::ref('App\\Closurish'))),
+        );
+    }
+
+    public function testSuperIntersectionWithUndeclaredMemberStaysGradual(): void
+    {
+        // One member undeclared ⇒ the whole intersection is unprovable ⇒ accept.
+        self::assertConforms(
+            self::sig([], self::ref('App\\Apple')),
+            self::sig([], self::intersection(self::ref('App\\Apple'), self::ref('App\\External\\Thing'))),
+        );
+    }
+
+    public function testSubIntersectionParameterIsAcceptedEvenWhenUninhabited(): void
+    {
+        // CRITICAL cardinal-rule guard: target Closure(Apple&Orange $x) is
+        // uninhabited (two concrete siblings ⇒ `never`), and `never` is a subtype of
+        // everything, so ANY candidate parameter is vacuously wide. The sub-side
+        // intersection must stay gradual, never decompose into a reject.
+        self::assertConforms(
+            self::sig([self::p(self::ref('App\\Closurish'))], null),
+            self::sig([self::p(self::intersection(self::ref('App\\Apple'), self::ref('App\\Orange')))], null),
+        );
+    }
+
+    public function testSubIntersectionParameterAcceptedAgainstUnionCandidate(): void
+    {
+        // Pins the sub-intersection-vs-union-super accept path: target parameter
+        // Apple&Orange (uninhabited ⇒ gradual sub side) checked contravariantly against
+        // a candidate parameter Apple|Orange. Decomposing the sub side would false-reject;
+        // it must stay gradual through the super-union arm.
+        self::assertConforms(
+            self::sig([self::p(self::union(self::ref('App\\Apple'), self::ref('App\\Orange')))], null),
+            self::sig([self::p(self::intersection(self::ref('App\\Apple'), self::ref('App\\Orange')))], null),
+        );
+    }
+
+    public function testSubIntersectionParameterAcceptedAgainstIntersectionCandidate(): void
+    {
+        // Sub-intersection-vs-intersection-super accept path: the sub-side intersection
+        // must stay gradual as the super-intersection arm recurses over each member.
+        self::assertConforms(
+            self::sig([self::p(self::intersection(self::ref('App\\Apple'), self::ref('App\\Closurish')))], null),
+            self::sig([self::p(self::intersection(self::ref('App\\Apple'), self::ref('App\\Orange')))], null),
+        );
+    }
+
+    public function testSubIntersectionReturnAcceptedAgainstUnionTarget(): void
+    {
+        // The return analog: candidate return Apple&Orange (gradual sub side) checked
+        // covariantly against a union target return Apple|Orange. Stays gradual.
+        self::assertConforms(
+            self::sig([], self::intersection(self::ref('App\\Apple'), self::ref('App\\Orange'))),
+            self::sig([], self::union(self::ref('App\\Apple'), self::ref('App\\Orange'))),
+        );
+    }
+
+    public function testViolationDetailRendersUnionMembers(): void
+    {
+        $violation = self::engine()->check(
+            self::sig([], self::ref('float')),
+            self::sig([], self::union(self::ref('int'), self::ref('string'))),
+        );
+        self::assertNotNull($violation);
+        self::assertSame(ClosureConformanceViolation::KIND_RETURN_TYPE, $violation->kind);
+        self::assertSame('return type: float is not a subtype of int|string', $violation->detail);
+    }
+
+    public function testViolationDetailRendersIntersectionMembers(): void
+    {
+        $violation = self::engine()->check(
+            self::sig([], self::ref('App\\Fruit')),
+            self::sig([], self::intersection(self::ref('App\\Apple'), self::ref('App\\Closurish'))),
+        );
+        self::assertNotNull($violation);
+        self::assertSame('return type: App\\Fruit is not a subtype of App\\Apple&App\\Closurish', $violation->detail);
+    }
+
+    public function testViolationDetailNamesThePositionAndBothTypes(): void
+    {
+        $violation = self::engine()->check(
+            self::sig([self::p(self::ref('string'))], self::ref('int')),
+            self::sig([self::p(self::ref('int'))], self::ref('int')),
+        );
+        self::assertNotNull($violation);
+        self::assertSame(ClosureConformanceViolation::KIND_PARAM_TYPE, $violation->kind);
+        self::assertSame('parameter 1: string is not wider than int', $violation->detail);
+    }
+
+    public function testReturnViolationDetailNamesBothTypes(): void
+    {
+        $violation = self::engine()->check(
+            self::sig([], self::ref('App\\Fruit')),
+            self::sig([], self::ref('App\\Apple')),
+        );
+        self::assertNotNull($violation);
+        self::assertSame(ClosureConformanceViolation::KIND_RETURN_TYPE, $violation->kind);
+        self::assertSame('return type: App\\Fruit is not a subtype of App\\Apple', $violation->detail);
+    }
+
+    public function testByRefViolationDetailNamesTheDirections(): void
+    {
+        $violation = self::engine()->check(
+            self::sig([self::p(self::ref('int'), byRef: true)], self::ref('int')),
+            self::sig([self::p(self::ref('int'))], self::ref('int')),
+        );
+        self::assertNotNull($violation);
+        self::assertSame(ClosureConformanceViolation::KIND_BYREF, $violation->kind);
+        self::assertSame('parameter 1: by-reference-ness must match exactly (target by-value, candidate by-ref)', $violation->detail);
+    }
+
+    // ---- Helpers ---------------------------------------------------------
+
+    private static function engine(): ClosureSignatureConformance
+    {
+        // App\Apple <: App\Fruit, App\Orange <: App\Fruit; App\Closurish is a bare class.
+        // App\MyExc extends the built-in Exception (its ancestry escapes into PHP's
+        // unmodeled built-in graph).
+        $hierarchy = new TypeHierarchy([
+            'App\\Apple' => ['App\\Fruit'],
+            'App\\Orange' => ['App\\Fruit'],
+            'App\\Fruit' => [],
+            'App\\Closurish' => [],
+            'App\\MyExc' => ['Exception'],
+        ]);
+        return new ClosureSignatureConformance($hierarchy);
+    }
+
+    private static function assertConforms(ClosureSignature $candidate, ClosureSignature $target): void
+    {
+        $violation = self::engine()->check($candidate, $target);
+        self::assertNull(
+            $violation,
+            'expected conformance but got: ' . ($violation?->detail ?? ''),
+        );
+    }
+
+    private static function assertViolation(string $kind, ClosureSignature $candidate, ClosureSignature $target): void
+    {
+        $violation = self::engine()->check($candidate, $target);
+        self::assertNotNull($violation, 'expected a violation but the pair conformed');
+        self::assertSame($kind, $violation->kind, 'wrong violation kind (detail: ' . $violation->detail . ')');
+    }
+
+    /**
+     * @param list<ClosureSignatureParam> $params
+     */
+    private static function sig(array $params, ?SigType $return, bool $nullable = false): ClosureSignature
+    {
+        return new ClosureSignature($params, $return, $nullable);
+    }
+
+    private static function p(SigType $type, bool $byRef = false, bool $variadic = false, bool $optional = false): ClosureSignatureParam
+    {
+        // Exercise the constructor's `$optional = false` default in the common case
+        // (only pass it when true) so that default stays behaviorally pinned.
+        return $optional
+            ? new ClosureSignatureParam($type, $byRef, $variadic, true)
+            : new ClosureSignatureParam($type, $byRef, $variadic);
+    }
+
+    private static function ref(string $name): SigTypeRef
+    {
+        $scalars = ['int', 'string', 'float', 'bool', 'true', 'false', 'mixed', 'object',
+            'void', 'never', 'null', 'array', 'iterable', 'callable', 'self', 'static', 'parent'];
+        return new SigTypeRef(new TypeRef($name, [], isScalar: in_array($name, $scalars, true)));
+    }
+
+    private static function refParam(string $name): SigTypeRef
+    {
+        return new SigTypeRef(new TypeRef($name, [], isTypeParam: true));
+    }
+
+    private static function cl(ClosureSignature $sig): SigClosure
+    {
+        return new SigClosure($sig);
+    }
+
+    private static function union(SigType ...$members): SigUnion
+    {
+        return new SigUnion(array_values($members));
+    }
+
+    private static function intersection(SigType ...$members): SigIntersection
+    {
+        return new SigIntersection(array_values($members));
+    }
+}
diff --git a/test/Transpiler/Monomorphize/ClosureSignatureParseTest.php b/test/Transpiler/Monomorphize/ClosureSignatureParseTest.php
new file mode 100644
index 0000000..5ecb154
--- /dev/null
+++ b/test/Transpiler/Monomorphize/ClosureSignatureParseTest.php
@@ -0,0 +1,1568 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+use PhpParser\Node;
+use PhpParser\Node\Name;
+use PhpParser\ParserFactory;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * Parsing + erasure of closure-signature types (`Closure(int $x): bool`).
+ *
+ * WI-01 scope: the scanner recognizes a `Closure(...)[: ret]` production in a
+ * type slot, erases it to a bare `\Closure` (newline-preserving so line-keyed
+ * markers stay aligned), and attaches the structured {@see ClosureSignature} as
+ * an AST attribute for the later conformance validator. A flat union / intersection
+ * / nullable leaf is structured into a {@see SigUnion} / {@see SigIntersection}; a
+ * shape the flat splitter doesn't own (a DNF group, an intersection with a scalar)
+ * stays raw ({@see SigRaw}). No conformance checking happens here.
+ */
+final class ClosureSignatureParseTest extends TestCase
+{
+    // ===================================================================
+    // Shape: the attached ClosureSignature matches the source
+    // ===================================================================
+
+    public function testParsesNamedParametersAndReturn(): void
+    {
+        $sig = self::firstSig('<?php function f(Closure(int $x, string $y): bool $c) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(2, $sig->params);
+        self::assertSame('int', self::refName($sig->params[0]->type));
+        self::assertTrue(self::isScalarRef($sig->params[0]->type));
+        self::assertSame('string', self::refName($sig->params[1]->type));
+        self::assertSame('bool', self::refName($sig->return));
+        self::assertFalse($sig->nullable);
+    }
+
+    public function testParametersMayOmitNames(): void
+    {
+        // Names are insignificant to conformance; a bare `Closure(int, int): int`
+        // must parse to two params exactly like the named form.
+        $sig = self::firstSig('<?php class C { public Closure(int, int): int $op; }');
+
+        self::assertNotNull($sig);
+        self::assertCount(2, $sig->params);
+        self::assertSame('int', self::refName($sig->params[0]->type));
+        self::assertSame('int', self::refName($sig->params[1]->type));
+        self::assertSame('int', self::refName($sig->return));
+    }
+
+    public function testSingleScalarParameterLexedAsCastTokenIsParsed(): void
+    {
+        // `Closure(int)` — PHP lexes `(int)` as ONE T_INT_CAST token, not
+        // `(` `int` `)`. The scanner must accept the cast token as the whole
+        // one-scalar parameter list (the same collision the engine RFC handles).
+        $sig = self::firstSig('<?php function s(Closure(int): int $c) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(1, $sig->params);
+        self::assertSame('int', self::refName($sig->params[0]->type));
+        self::assertTrue(self::isScalarRef($sig->params[0]->type));
+        self::assertSame('int', self::refName($sig->return));
+    }
+
+    public function testEachCastTokenScalarMapsToItsCanonicalName(): void
+    {
+        // Locks the castTokenScalars() id→name table: every single-scalar param
+        // spelled as a cast token resolves to the right scalar. `(unset)` has no
+        // matching scalar type, so it maps to `void` (the RFC's bottom return),
+        // exercised via the return slot below.
+        $cases = [
+            '(int): void' => 'int',
+            '(bool): void' => 'bool',
+            '(float): void' => 'float',
+            '(string): void' => 'string',
+            '(array): void' => 'array',
+            '(object): void' => 'object',
+        ];
+        foreach ($cases as $spelling => $expected) {
+            $sig = self::firstSig("<?php function f(Closure{$spelling} \$c) {}");
+            self::assertNotNull($sig, "sig for Closure{$spelling}");
+            self::assertCount(1, $sig->params, "one param for Closure{$spelling}");
+            self::assertSame($expected, self::refName($sig->params[0]->type), "Closure{$spelling}");
+        }
+    }
+
+    public function testUnsetCastTokenMapsToVoid(): void
+    {
+        // `(unset)` is a cast token with no scalar-type spelling; the table maps
+        // it to `void`. Kept as its own test so the assertion is unambiguous.
+        $sig = self::firstSig('<?php function f(Closure(unset): int $c) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(1, $sig->params);
+        self::assertSame('void', self::refName($sig->params[0]->type));
+    }
+
+    public function testReturnPositionSignatureIsRecognized(): void
+    {
+        // `Closure` in a return slot (`) : Closure(): int`) is a type, not a call.
+        $sig = self::firstSig('<?php function g(): Closure(): int {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(0, $sig->params);
+        self::assertSame('int', self::refName($sig->return));
+    }
+
+    public function testNoParametersAndNoReturnIsDistinctFromMixed(): void
+    {
+        // An ABSENT return is `$return === null` — kept distinct from `: mixed`.
+        $sig = self::firstSig('<?php function h(Closure() $c) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(0, $sig->params);
+        self::assertNull($sig->return, 'absent return must stay null, not default to mixed');
+    }
+
+    public function testNullablePrefixSetsNullableFlag(): void
+    {
+        // `?Closure(int): int` — the `?` precedes the erased `\Closure`; nullable
+        // is captured on the signature (the emitted `?\Closure` carries the PHP
+        // nullability, the flag records it for conformance).
+        $sig = self::firstSig('<?php function h(?Closure(int): int $c) {}');
+
+        self::assertNotNull($sig);
+        self::assertTrue($sig->nullable);
+        self::assertCount(1, $sig->params);
+    }
+
+    public function testByRefAndVariadicMarkersAreCaptured(): void
+    {
+        $sig = self::firstSig('<?php function m(Closure(int &$r, string ...$rest): void $c) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(2, $sig->params);
+        self::assertTrue($sig->params[0]->byRef, 'first param is by-reference');
+        self::assertFalse($sig->params[0]->variadic);
+        self::assertFalse($sig->params[1]->byRef);
+        self::assertTrue($sig->params[1]->variadic, 'last param is variadic');
+        self::assertSame('void', self::refName($sig->return));
+    }
+
+    public function testNestedClosureParameterAndReturnRecurse(): void
+    {
+        // `Closure(Closure(int): int): Closure(): string` — the param type and the
+        // return type are themselves closure signatures (SigClosure), not TypeRefs.
+        $sig = self::firstSig('<?php function nn(Closure(Closure(int): int): Closure(): string $c) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(1, $sig->params);
+        $inner = $sig->params[0]->type;
+        self::assertInstanceOf(SigClosure::class, $inner);
+        self::assertCount(1, $inner->signature->params);
+        self::assertSame('int', self::refName($inner->signature->params[0]->type));
+        self::assertSame('int', self::refName($inner->signature->return));
+        self::assertFalse($inner->signature->nullable, 'a nested closure is not nullable unless prefixed with `?`');
+
+        self::assertInstanceOf(SigClosure::class, $sig->return);
+        self::assertCount(0, $sig->return->signature->params);
+        self::assertSame('string', self::refName($sig->return->signature->return));
+        self::assertFalse($sig->return->signature->nullable);
+    }
+
+    public function testFullyQualifiedClosureNameCarriesSignature(): void
+    {
+        // A `\Closure(int): int` written fully-qualified must normalize to `Closure`
+        // (leading-`\` stripped) before the only-`Closure` check, so it is accepted
+        // and carries a signature — not rejected as a non-`Closure` name.
+        $sig = self::firstSig('<?php function f(\Closure(int): int $c) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(1, $sig->params);
+        self::assertSame('int', self::refName($sig->params[0]->type));
+        self::assertSame('int', self::refName($sig->return));
+    }
+
+    public function testFullyQualifiedNestedClosureNameIsRecognized(): void
+    {
+        // Same leading-`\` normalization on a NESTED closure leaf.
+        $sig = self::firstSig('<?php function f(Closure(\Closure(int): int): int $c) {}');
+
+        self::assertNotNull($sig);
+        self::assertInstanceOf(SigClosure::class, $sig->params[0]->type);
+        self::assertSame('int', self::refName($sig->params[0]->type->signature->params[0]->type));
+    }
+
+    public function testUnionMembersIncludingNullableAndStaticContinueTheScan(): void
+    {
+        // `A|?B|static` — the scan's union continuation must accept a `?`-prefixed
+        // member AND a `static` member, not just plain names. A predicate that drops
+        // either would stop the span early and leave unparseable residue.
+        $source = '<?php function f(): Closure(): A|?B|static {}';
+        $sig = self::firstSig($source);
+
+        self::assertNotNull($sig);
+        self::assertInstanceOf(SigRaw::class, $sig->return);
+        self::assertSame('A|?B|static', $sig->return->raw);
+    }
+
+    public function testIntersectionMembersIncludingNullableAndStaticAreDetected(): void
+    {
+        // The intersection-vs-by-ref discriminator must treat a `?`-prefixed name and
+        // a `static` after `&` as intersection continuations (not by-ref markers).
+        $nullableMember = self::firstSig('<?php function f(Closure(A&?B): void $c) {}');
+        self::assertNotNull($nullableMember);
+        self::assertInstanceOf(SigRaw::class, $nullableMember->params[0]->type);
+        self::assertSame('A&?B', $nullableMember->params[0]->type->raw);
+
+        $staticMember = self::firstSig('<?php function f(Closure(A&static): void $c) {}');
+        self::assertNotNull($staticMember);
+        self::assertInstanceOf(SigRaw::class, $staticMember->params[0]->type);
+        self::assertSame('A&static', $staticMember->params[0]->type->raw);
+    }
+
+    public function testTypeParametersInSignatureResolveAsTypeParamRefs(): void
+    {
+        // Generics in scope: a `Closure(T): U` inside a generic class must carry
+        // the enclosing type params as type-param TypeRefs so a later work item can
+        // substitute them per specialization.
+        $sig = self::firstSig(<<<'PHP'
+        <?php
+        namespace App;
+        class Mapper<T, U> {
+            public function make(Closure(T): U $fn): void {}
+        }
+        PHP);
+
+        self::assertNotNull($sig);
+        self::assertCount(1, $sig->params);
+        $param = $sig->params[0]->type;
+        self::assertInstanceOf(SigTypeRef::class, $param);
+        self::assertSame('T', $param->type->name);
+        self::assertTrue($param->type->isTypeParam, 'T must resolve as an enclosing type-param, not a class');
+        self::assertInstanceOf(SigTypeRef::class, $sig->return);
+        self::assertTrue($sig->return->type->isTypeParam, 'U must resolve as an enclosing type-param');
+    }
+
+    public function testClassTypeParameterResolvesAgainstNamespace(): void
+    {
+        // A non-type-param class name in a signature resolves against the namespace
+        // like any other type reference (reusing resolveTypeRef).
+        $sig = self::firstSig(<<<'PHP'
+        <?php
+        namespace App;
+        function f(Closure(Widget): Gadget $c) {}
+        PHP);
+
+        self::assertNotNull($sig);
+        self::assertSame('App\\Widget', self::refName($sig->params[0]->type));
+        self::assertSame('App\\Gadget', self::refName($sig->return));
+    }
+
+    // ===================================================================
+    // Erasure: output is valid PHP, line-stable, and executes
+    // ===================================================================
+
+    public function testErasesToBareClosureLeavingNoSignatureResidue(): void
+    {
+        $stripped = self::strip('<?php function f(Closure(int $x, string $y): bool $c) {}');
+
+        self::assertSame('<?php function f(\Closure                         $c) {}', $stripped);
+    }
+
+    public function testErasurePreservesLineCountForLaterMarkers(): void
+    {
+        // A multi-line signature must not change the total line count — line-keyed
+        // markers on later lines rely on newline positions staying fixed.
+        $source = <<<'PHP'
+        <?php
+        namespace App;
+        class C<T> {
+            public function build(
+                Closure(
+                    int $x,
+                    string $y
+                ): bool $cb
+            ): void {}
+            public Box<T> $b;
+        }
+        PHP;
+        $stripped = self::strip($source);
+
+        self::assertSame(
+            substr_count($source, "\n"),
+            substr_count($stripped, "\n"),
+            'newline count must be identical before and after erasure',
+        );
+        // The Box<T> marker on a later line must still resolve after the multi-line
+        // erasure — proving the line counter stayed aligned.
+        $sig = self::firstSig($source);
+        self::assertNotNull($sig);
+    }
+
+    public function testErasureAtColumnZeroKeepsLaterMarkersAligned(): void
+    {
+        // A signature whose `Closure` sits at column 0 (start of its line) stresses the
+        // erasure byte math: the newline-preserving blank must span exactly the
+        // signature bytes and not shift the preceding newline. If it did, the `Box<T>`
+        // marker two lines below would desync and no longer resolve as a type param.
+        $source = "<?php\n"
+            . "namespace App;\n"
+            . "class C<T> {\n"
+            . "    public function f(\n"
+            . "Closure(int): int \$cb\n"
+            . "    ): void {}\n"
+            . "    public Box<T> \$b;\n"
+            . "}\n";
+
+        $args = self::genericArgs($source, 'Box');
+        self::assertCount(1, $args);
+        self::assertTrue(
+            $args[0]->isTypeParam,
+            'Box<T> below a column-0 closure signature must stay line-aligned to resolve as a type param',
+        );
+    }
+
+    public function testErasedSignatureCompilesAndExecutesInNamespace(): void
+    {
+        // A bare `Closure` in a namespace would fatal (`App\Closure` doesn't exist);
+        // erasure MUST emit the fully-qualified `\Closure`. Round-trip through PHP.
+        $source = <<<'PHP'
+        <?php
+        namespace App;
+        function apply(Closure(int): int $fn, int $n): int {
+            return $fn($n);
+        }
+        PHP;
+        $stripped = self::strip($source);
+
+        $harness = $stripped . "\n\$r = \\App\\apply(fn(int \$x): int => \$x + 1, 41);\necho \$r;";
+        $out = self::runPhp($harness);
+        self::assertSame('42', $out);
+    }
+
+    // ===================================================================
+    // Flat union / intersection / nullable leaves are structured (WI-03)
+    // ===================================================================
+
+    public function testUnionAndIntersectionLeavesAreStructuredAndErased(): void
+    {
+        $source = '<?php function u(Closure(A&B): C|null $c) {}';
+        $sig = self::firstSig($source);
+
+        self::assertNotNull($sig);
+        self::assertCount(1, $sig->params);
+        $param = $sig->params[0]->type;
+        self::assertInstanceOf(SigIntersection::class, $param);
+        self::assertSame(['A', 'B'], self::sigMemberNames($param));
+        self::assertInstanceOf(SigUnion::class, $sig->return);
+        self::assertSame(['C', 'null'], self::sigMemberNames($sig->return));
+
+        // Still fully erased to a bare \Closure.
+        $stripped = self::strip($source);
+        self::assertSame('<?php function u(\Closure             $c) {}', $stripped);
+    }
+
+    public function testUnionParameterSpanEndsSoNextParameterParses(): void
+    {
+        // The union's end index must be exact, or the following `bool $b` mis-parses.
+        $sig = self::firstSig('<?php function f(Closure(int|string $a, bool $b): void $c) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(2, $sig->params);
+        self::assertInstanceOf(SigUnion::class, $sig->params[0]->type);
+        self::assertSame(['int', 'string'], self::sigMemberNames($sig->params[0]->type));
+        self::assertSame('bool', self::refName($sig->params[1]->type));
+    }
+
+    public function testKeywordUnionMemberSpanEndsSoNextParameterParses(): void
+    {
+        // `array` is a reserved-word keyword member (parsed by the keyword branch, not
+        // parseTypeArg); its end index must land the following `bool $b` correctly.
+        $sig = self::firstSig('<?php function f(Closure(int|array $a, bool $b): void $c) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(2, $sig->params);
+        self::assertInstanceOf(SigUnion::class, $sig->params[0]->type);
+        self::assertSame(['int', 'array'], self::sigMemberNames($sig->params[0]->type));
+        self::assertSame('bool', self::refName($sig->params[1]->type));
+    }
+
+    public function testIntersectionParameterSpanEndsSoNextParameterParses(): void
+    {
+        $sig = self::firstSig('<?php function f(Closure(Countable&Traversable $a, int $b): void $c) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(2, $sig->params);
+        self::assertInstanceOf(SigIntersection::class, $sig->params[0]->type);
+        self::assertSame(['Countable', 'Traversable'], self::sigMemberNames($sig->params[0]->type));
+        self::assertSame('int', self::refName($sig->params[1]->type));
+    }
+
+    public function testScalarIntersectionBailSpanEndsSoNextParameterParses(): void
+    {
+        // The bailed SigRaw's end index must also be exact so `bool $b` parses.
+        $sig = self::firstSig('<?php function f(Closure(int&Countable $a, bool $b): void $c) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(2, $sig->params);
+        self::assertInstanceOf(SigRaw::class, $sig->params[0]->type);
+        self::assertSame('bool', self::refName($sig->params[1]->type));
+    }
+
+    public function testMixedTopLevelSeparatorsFallBackToRaw(): void
+    {
+        // `A|B&C` mixes union and intersection at top level (needs DNF parens) — the
+        // flat splitter must not structure it; keep it a gradual SigRaw.
+        $sig = self::firstSig('<?php function f(): Closure(): A|B&C {}');
+
+        self::assertNotNull($sig);
+        self::assertInstanceOf(SigRaw::class, $sig->return);
+        self::assertSame('A|B&C', $sig->return->raw);
+    }
+
+    public function testUnionByReferenceParameterKeepsUnionAndMarker(): void
+    {
+        // `A|B &$r` — the trailing `&` is a by-ref marker (a `$var` follows), NOT an
+        // intersection continuation; the union stays structured and the param is by-ref.
+        $sig = self::firstSig('<?php function f(Closure(A|B &$r): void $c) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(1, $sig->params);
+        self::assertInstanceOf(SigUnion::class, $sig->params[0]->type);
+        self::assertSame(['A', 'B'], self::sigMemberNames($sig->params[0]->type));
+        self::assertTrue($sig->params[0]->byRef);
+    }
+
+    public function testIntersectionWithScalarMemberStaysRawAndErases(): void
+    {
+        // `int&Countable` is invalid PHP (scalars can't intersect); the splitter keeps
+        // it a gradual SigRaw rather than structuring, and it still fully erases.
+        $source = '<?php function f(Closure(int&Countable $x): void $c) {}';
+        $sig = self::firstSig($source);
+
+        self::assertNotNull($sig);
+        self::assertInstanceOf(SigRaw::class, $sig->params[0]->type);
+        self::assertSame('int&Countable', $sig->params[0]->type->raw);
+        self::assertStringNotContainsString('int&Countable', self::strip($source));
+    }
+
+    public function testNullableLeafInsideSignatureIsStructuredAsUnionWithNull(): void
+    {
+        // A `?Type` leaf INSIDE the signature (distinct from an outer `?Closure`)
+        // structures to `Type|null`; the outer nullable flag stays false.
+        $sig = self::firstSig('<?php function f(Closure(?int): int $c) {}');
+
+        self::assertNotNull($sig);
+        $param = $sig->params[0]->type;
+        self::assertInstanceOf(SigUnion::class, $param);
+        self::assertSame(['int', 'null'], self::sigMemberNames($param));
+        self::assertFalse($sig->nullable, 'the inner `?int` must not set the outer nullable flag');
+    }
+
+    // ===================================================================
+    // DNF groups — consumed as ONE gradual leaf, never mis-scanned
+    // ===================================================================
+
+    public function testLeadingDnfGroupReturnErasesAndStaysRaw(): void
+    {
+        // `(A&B)|C` in the signature's return: the group is consumed as one
+        // gradual leaf and the whole signature erases (this shape used to stop
+        // the type scanner cold — the signature was never recognized and the
+        // raw superset syntax reached PHP as a parse error).
+        $source = '<?php function g(): Closure(): (A&B)|C {}';
+        $sig = self::firstSig($source);
+
+        self::assertNotNull($sig);
+        self::assertCount(0, $sig->params);
+        self::assertInstanceOf(SigRaw::class, $sig->return);
+        self::assertSame('(A&B)|C', $sig->return->raw);
+        self::assertStringNotContainsString('(A&B)', self::strip($source));
+    }
+
+    public function testTrailingDnfGroupReturnErasesFullyNotMidType(): void
+    {
+        // `A|(B&C)` in the return: the scan must consume PAST the `|(` — a scan
+        // that stops mid-type erases only through `A` and emits the valid-but-
+        // wrong hint `\Closure    |(B&C)` with a truncated recorded return.
+        $source = "<?php function g(): Closure(): A|(B&C) {\n}";
+        $sig = self::firstSig($source);
+
+        self::assertNotNull($sig);
+        self::assertInstanceOf(SigRaw::class, $sig->return);
+        self::assertSame('A|(B&C)', $sig->return->raw);
+        self::assertStringNotContainsString('|(B&C)', self::strip($source));
+    }
+
+    public function testLeadingDnfGroupParameterIsOneParamAndKeepsReturn(): void
+    {
+        // `(A&B)|C $x` is ONE parameter (a single-token `(` leaf used to split
+        // it into two, throwing the arity off) and the `: int` return — which
+        // sat past the mis-scanned span — must survive.
+        $sig = self::firstSig('<?php function f(Closure((A&B)|C $x): int $cb) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(1, $sig->params);
+        self::assertInstanceOf(SigRaw::class, $sig->params[0]->type);
+        self::assertSame('(A&B)|C', $sig->params[0]->type->raw);
+        self::assertSame('int', self::refName($sig->return));
+    }
+
+    public function testTrailingDnfGroupParameterIsOneParamAndKeepsReturn(): void
+    {
+        // `A|(B&C) $x` — the trailing-group order mis-parsed as FOUR params.
+        $sig = self::firstSig('<?php function f(Closure(A|(B&C) $x): int $cb) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(1, $sig->params);
+        self::assertInstanceOf(SigRaw::class, $sig->params[0]->type);
+        self::assertSame('A|(B&C)', $sig->params[0]->type->raw);
+        self::assertSame('int', self::refName($sig->return));
+    }
+
+    public function testDnfGroupWithGenericAndNestedSignatureMember(): void
+    {
+        // A group interior reuses the full leaf machinery: a generic member
+        // whose argument is itself a nested signature (with a cast-token param
+        // list) must all land inside the one raw leaf.
+        $sig = self::firstSig('<?php function f(Closure((A&B<Closure(int): C>)|D $x): int $cb) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(1, $sig->params);
+        self::assertInstanceOf(SigRaw::class, $sig->params[0]->type);
+        self::assertSame('(A&B<Closure(int): C>)|D', $sig->params[0]->type->raw);
+    }
+
+    public function testNullableDnfGroupReturnStaysRawGradual(): void
+    {
+        // `?(A&B)` is not valid PHP, but signature types are erased before PHP
+        // sees them — the scanner keeps it one gradual raw leaf.
+        $sig = self::firstSig('<?php function f(Closure(): ?(A&B) $cb) {}');
+
+        self::assertNotNull($sig);
+        self::assertInstanceOf(SigRaw::class, $sig->return);
+        self::assertSame('?(A&B)', $sig->return->raw);
+    }
+
+    public function testDnfGroupBesideFlatUnionParameter(): void
+    {
+        // A DNF leaf must not poison its neighbours: the flat union before it
+        // stays structured and the return stays typed.
+        $sig = self::firstSig('<?php function f(Closure(A|B $x, (C&D)|E $y): F $cb) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(2, $sig->params);
+        self::assertInstanceOf(SigUnion::class, $sig->params[0]->type);
+        self::assertSame(['A', 'B'], self::sigMemberNames($sig->params[0]->type));
+        self::assertInstanceOf(SigRaw::class, $sig->params[1]->type);
+        self::assertSame('(C&D)|E', $sig->params[1]->type->raw);
+        self::assertSame('F', self::refName($sig->return));
+    }
+
+    public function testPlainPhpDnfHintOutsideSignatureIsUntouched(): void
+    {
+        // Ordinary PHP DNF hints don't involve the signature scanner at all.
+        $source = '<?php function f((A&B)|C $x) {}';
+
+        self::assertSame($source, self::strip($source));
+    }
+
+    public function testExpressionParenAfterTernaryColonIsNotAbsorbed(): void
+    {
+        // `($x)` after a ternary `:` is an expression paren — its interior is a
+        // variable, not a type, so the group-interior validation rejects it and
+        // the call to a user symbol named `Closure` stays untouched.
+        $source = '<?php $r = $a ? Closure(Foo::class) : ($x);';
+
+        self::assertNull(self::firstSig($source));
+        self::assertSame($source, self::strip($source));
+    }
+
+    public function testGroupedUseClauseIsUntouched(): void
+    {
+        // A closure `use (...)` group is nowhere near a signature slot; pin it
+        // against any future scanner change.
+        $source = '<?php $f = function () use ($a, &$b) { return $a; };';
+
+        self::assertSame($source, self::strip($source));
+    }
+
+    public function testUnionOfTwoDnfGroupsIsOneLeaf(): void
+    {
+        // `(A&B)|(C&D)` — the continuation after the FIRST group must consume
+        // the `|` and the second group into the same leaf; a walk that skips
+        // past the separator splits the leaf and corrupts the arity.
+        $sig = self::firstSig('<?php function f(Closure((A&B)|(C&D) $x): int $cb) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(1, $sig->params);
+        self::assertInstanceOf(SigRaw::class, $sig->params[0]->type);
+        self::assertSame('(A&B)|(C&D)', $sig->params[0]->type->raw);
+        self::assertSame('int', self::refName($sig->return));
+    }
+
+    public function testGroupWithNestedSignatureThenUnionMember(): void
+    {
+        // The walk must resume EXACTLY one token after the nested signature's
+        // end so the following `|A` continuation and the group's `)` are seen.
+        $sig = self::firstSig('<?php function f(Closure((Closure(int): int)|A $x): int $cb) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(1, $sig->params);
+        self::assertInstanceOf(SigRaw::class, $sig->params[0]->type);
+        self::assertSame('(Closure(int): int)|A', $sig->params[0]->type->raw);
+    }
+
+    public function testGroupWithGenericMemberThenIntersectionMember(): void
+    {
+        // Same resume-offset pin for the ANGLE branch: after `A<T>` the `&B`
+        // continuation and the `)` must still be reached.
+        $sig = self::firstSig('<?php function f(Closure((A<T>&B)|C $x): int $cb) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(1, $sig->params);
+        self::assertInstanceOf(SigRaw::class, $sig->params[0]->type);
+        self::assertSame('(A<T>&B)|C', $sig->params[0]->type->raw);
+    }
+
+    public function testSingleNameGroupIsConsumedFromItsFirstToken(): void
+    {
+        // `(A)|B` — a one-token interior; an interior scan that starts one
+        // token late sees only the `)` and wrongly rejects the group.
+        $sig = self::firstSig('<?php function f(Closure((A)|B $x): int $cb) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(1, $sig->params);
+        self::assertInstanceOf(SigRaw::class, $sig->params[0]->type);
+        self::assertSame('(A)|B', $sig->params[0]->type->raw);
+    }
+
+    public function testNestedFullyQualifiedClosureSignatureInReturn(): void
+    {
+        // The nested-signature branch must recognize `\Closure` (leading `\`)
+        // — matching on the bare text would leave the nested tail unconsumed.
+        $sig = self::firstSig('<?php function f(): Closure(): \Closure(int): int {}');
+
+        self::assertNotNull($sig);
+        self::assertInstanceOf(SigClosure::class, $sig->return);
+        self::assertSame('int', self::refName($sig->return->signature->return));
+    }
+
+    public function testAdjacentGroupsAreNotSilentlySwallowed(): void
+    {
+        // `(A&B)(C&D)` is not a type — the scan ends after the first group and
+        // the junk tail must survive as loud residue, never be absorbed.
+        $stripped = self::strip('<?php function f(): Closure(): (A&B)(C&D) {}');
+
+        self::assertSame('<?php function f(): \Closure        (C&D) {}', $stripped);
+    }
+
+    public function testBodyOpeningBraceEndsTheReturnScan(): void
+    {
+        // A body whose first statement is a bare function call (`strlen(...)`)
+        // must never be absorbed into the return-type span: the `{` terminates
+        // the scan unconditionally.
+        $stripped = self::strip("<?php function f(): Closure(): int { strlen('x'); }");
+
+        self::assertSame("<?php function f(): \Closure       { strlen('x'); }", $stripped);
+    }
+
+    public function testGroupInteriorMustReachTheClosingParen(): void
+    {
+        // `(A|B, C)` — the interior scan stops at the `,`, so the group is NOT
+        // a type leaf; the pre-existing raw fallback (a one-token `(` leaf and
+        // whatever follows) is preserved rather than a group ending mid-way.
+        $sig = self::firstSig('<?php function f(Closure((A|B, C) $x): void $cb) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(3, $sig->params);
+        self::assertInstanceOf(SigRaw::class, $sig->params[0]->type);
+        self::assertSame('(', $sig->params[0]->type->raw);
+    }
+
+    public function testNestedSignatureWithoutReturnInScannedReturnPosition(): void
+    {
+        // `Closure(A)` — a nested signature whose last token is its own `)`
+        // (no return type). The walk must resume exactly ONE token after it;
+        // resuming a token early re-consumes the nested signature (or corrupts
+        // the span with a stray `)` residue).
+        $source = '<?php function f(): Closure(): Closure(A) {}';
+        $sig = self::firstSig($source);
+
+        self::assertNotNull($sig);
+        self::assertInstanceOf(SigClosure::class, $sig->return);
+        self::assertCount(1, $sig->return->signature->params);
+        self::assertNull($sig->return->signature->return);
+        self::assertSame('<?php function f(): \Closure              {}', self::strip($source));
+    }
+
+    public function testNameThenGroupInReturnStaysTheOnlyClosureThrow(): void
+    {
+        // `A (B)` — a name followed by a paren group is A trying to carry a
+        // call signature; the only-Closure structural throw must stay loud (a
+        // scan that treats `(B)` as a fresh group leaf silently swallows it).
+        $this->expectException(\RuntimeException::class);
+        $this->expectExceptionMessage('Only "Closure" may carry a call signature, "A" may not');
+        self::strip('<?php function f(Closure(): A (B) $x) {}');
+    }
+
+    public function testDoubleSeparatorLeavesLoudResidue(): void
+    {
+        // `A&|B` is malformed — the scan stops at the dangling `&` and the
+        // junk survives as loud residue, never silently swallowed.
+        $stripped = self::strip('<?php function f(): Closure(): A&|B {}');
+
+        self::assertSame('<?php function f(): \Closure    &|B {}', $stripped);
+    }
+
+    public function testBareClosureMemberInSignatureUnionReturn(): void
+    {
+        // A bare `Closure` (no paren) as a union member inside a signature's
+        // return: the nested-signature branch must require the name AND the
+        // following `(` together — keying on either alone sends the bare name
+        // into the nested scan, which fails and kills the whole recognition.
+        $sig = self::firstSig('<?php function f(): Closure(): Closure|null {}');
+
+        self::assertNotNull($sig);
+        self::assertInstanceOf(SigUnion::class, $sig->return);
+        self::assertSame(['Closure', 'null'], self::sigMemberNames($sig->return));
+    }
+
+    public function testTruncatedNestedSignatureFailsRecognitionCleanly(): void
+    {
+        // An unbalanced NESTED signature aborts recognition of the outer one —
+        // the whole file stays untouched. A scan that survives the nested
+        // failure restarts from the file start (where the leading bare name
+        // `A` would satisfy it) and corrupts the span.
+        $source = '<?php A::class; function f(): Closure(): Closure(int';
+
+        self::assertSame($source, self::strip($source));
+    }
+
+    public function testTruncatedSourceAtEofDoesNotFatal(): void
+    {
+        // A file ending mid-signature must degrade cleanly (the walk-boundary
+        // guards), never read past the token array. The return-slot variant
+        // reaches the group scan with its interior running off the file end.
+        self::assertIsString(self::strip('<?php function f(): Closure(): A|'));
+        self::assertIsString(self::strip('<?php function f(): Closure(): (A'));
+        self::assertIsString(self::strip('<?php function f(): Closure(): A['));
+        self::assertIsString(self::strip('<?php function f(): Closure()'));
+        $truncatedGroup = '<?php function f(Closure((A';
+        self::assertSame($truncatedGroup, self::strip($truncatedGroup));
+    }
+
+    // ===================================================================
+    // Array-sugar leaves — lowered to `array` inside signatures
+    // ===================================================================
+
+    public function testArraySugarReturnLowersToArrayAndErases(): void
+    {
+        // `int[]` in the signature's return: consumed into the blanked span
+        // (this shape used to leave `[]` residue → a raw PHP parse error) and
+        // lowered to `array`, the same lowering the global rewrite applies.
+        $source = '<?php function f(): Closure(): int[] {}';
+        $sig = self::firstSig($source);
+
+        self::assertNotNull($sig);
+        self::assertSame('array', self::refName($sig->return));
+        self::assertStringNotContainsString('[]', self::strip($source));
+    }
+
+    public function testArraySugarParameterIsOneParamLoweredToArray(): void
+    {
+        // `U[] $x` is ONE parameter lowered to `array` (it used to mis-parse
+        // as THREE — `U`, `[`, `]` — falsely rejecting a correct one-param
+        // literal on arity at a checked site).
+        $source = '<?php function f(Closure(U[] $x): void $cb) {}';
+        $sig = self::firstSig($source);
+
+        self::assertNotNull($sig);
+        self::assertCount(1, $sig->params);
+        self::assertSame('array', self::refName($sig->params[0]->type));
+        self::assertSame('void', self::refName($sig->return));
+        self::assertStringNotContainsString('[]', self::strip($source));
+    }
+
+    public function testArraySugarReturnBeforeParamVariableStillRecognizes(): void
+    {
+        // `Closure(): T[] $cb` — the recognition gate looks at the token after
+        // the span; with the `[]` inside the span the `$cb` is visible again
+        // (it used to see `[`, fail the gate, and let the global rewrite fire
+        // MID-signature → parse error).
+        $sig = self::firstSig('<?php function f(Closure(): T[] $cb) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(0, $sig->params);
+        self::assertSame('array', self::refName($sig->return));
+    }
+
+    public function testArraySugarUnionMemberLowersToArray(): void
+    {
+        // Member-level sugar: `A|B[]` structures as a union of `A` and `array`.
+        $sig = self::firstSig('<?php function f(Closure(A|B[] $x): void $cb) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(1, $sig->params);
+        self::assertInstanceOf(SigUnion::class, $sig->params[0]->type);
+        self::assertSame(['A', 'array'], self::sigMemberNames($sig->params[0]->type));
+    }
+
+    public function testNullableArraySugarLowersToArrayOrNull(): void
+    {
+        // `?int[]` ≡ array|null after lowering.
+        $sig = self::firstSig('<?php function f(Closure(?int[] $x): void $cb) {}');
+
+        self::assertNotNull($sig);
+        self::assertInstanceOf(SigUnion::class, $sig->params[0]->type);
+        self::assertSame(['array', 'null'], self::sigMemberNames($sig->params[0]->type));
+    }
+
+    public function testChainedArraySugarIsConsumedWhole(): void
+    {
+        // `U[][]` — the global sugar consumes chains; the signature scanner
+        // must match it. One pair consumed out of two leaves `[`/`]` residue:
+        // phantom params at a checked site (a false reject) or a parse error
+        // in a return.
+        $source = '<?php function f(Closure(U[][] $x): int[][] $cb) {}';
+        $sig = self::firstSig($source);
+
+        self::assertNotNull($sig);
+        self::assertCount(1, $sig->params);
+        self::assertSame('array', self::refName($sig->params[0]->type));
+        self::assertSame('array', self::refName($sig->return));
+        self::assertStringNotContainsString('[]', self::strip($source));
+    }
+
+    public function testPartialChainAfterCompletePairStaysLoudResidue(): void
+    {
+        // `A[][0]` — the first pair is sugar, the `[0]` is expression junk;
+        // consume the sugar, leave the junk loud.
+        $stripped = self::strip('<?php function f(): Closure(): A[][0] {}');
+
+        self::assertSame('<?php function f(): \Closure      [0] {}', $stripped);
+    }
+
+    public function testWhitespaceSeparatedArraySugarIsConsumed(): void
+    {
+        // The global sugar tolerates whitespace around the bracket pair; the
+        // signature scanner must accept the same spelling.
+        $sig = self::firstSig('<?php function f(Closure(U [] $x): void $cb) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(1, $sig->params);
+        self::assertSame('array', self::refName($sig->params[0]->type));
+    }
+
+    public function testArraySugarWithUnionContinuationErasesFully(): void
+    {
+        // `int[]|null` — the walk must resume exactly one token after the `]`
+        // so the `|null` continuation joins the span; resuming on (or before)
+        // the `]` truncates the span and leaves `|null` residue.
+        $source = '<?php function f(): Closure(): int[]|null {}';
+        $sig = self::firstSig($source);
+
+        self::assertNotNull($sig);
+        self::assertInstanceOf(SigUnion::class, $sig->return);
+        self::assertSame(['array', 'null'], self::sigMemberNames($sig->return));
+        self::assertStringNotContainsString('|null', self::strip($source));
+    }
+
+    public function testArraySugarWithGroupContinuationErasesFully(): void
+    {
+        // `int[]|(A&B)` — the token right after the `]` is the separator that
+        // carries the group; skipping it truncates the span.
+        $source = '<?php function f(): Closure(): int[]|(A&B) {}';
+        $sig = self::firstSig($source);
+
+        self::assertNotNull($sig);
+        self::assertInstanceOf(SigRaw::class, $sig->return);
+        self::assertSame('int[]|(A&B)', $sig->return->raw);
+        self::assertStringNotContainsString('|(', self::strip($source));
+    }
+
+    public function testNonEmptyBracketAfterReturnTypeStaysLoudResidue(): void
+    {
+        // `A[0]` is expression syntax, not array sugar — the bracket pair must
+        // NOT be absorbed into the type span; the junk survives loudly.
+        $stripped = self::strip('<?php function f(): Closure(): A[0] {}');
+
+        self::assertSame('<?php function f(): \Closure    [0] {}', $stripped);
+    }
+
+    public function testDoubledClosingBracketStaysLoudResidue(): void
+    {
+        // `A]]` — no opening `[` means no sugar; the sugar probe must bail on
+        // the first non-`[` token, never read on and match the second `]`.
+        $stripped = self::strip('<?php function f(): Closure(): A]] {}');
+
+        self::assertSame('<?php function f(): \Closure    ]] {}', $stripped);
+    }
+
+    public function testVariadicMarkerDirectlyAfterMemberArraySugar(): void
+    {
+        // Tight `B[]...$rest` — the member leaf must end exactly one token
+        // after the `]` so the `...` is seen as the variadic marker, not
+        // skipped into the parameter variable.
+        $sig = self::firstSig('<?php function f(Closure(A|B[]...$rest): void $cb) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(1, $sig->params);
+        self::assertInstanceOf(SigUnion::class, $sig->params[0]->type);
+        self::assertSame(['A', 'array'], self::sigMemberNames($sig->params[0]->type));
+        self::assertTrue($sig->params[0]->variadic);
+    }
+
+    public function testGenericArraySugarComboStaysLoud(): void
+    {
+        // `Foo<T>[]` — the generic + sugar combination is the pre-existing
+        // loud gap everywhere; inside a signature it must stay loud residue,
+        // not be silently absorbed or lowered.
+        $stripped = self::strip('<?php function f(): Closure(): Foo<T>[] {}');
+
+        self::assertSame('<?php function f(): \Closure         [] {}', $stripped);
+    }
+
+    public function testArrayAccessOfClosureCallIsUntouched(): void
+    {
+        // `$arr[Closure(1)]` — brackets in expression context around a call to
+        // a user symbol named `Closure`; nothing here is a type slot.
+        $source = '<?php $r = $arr[Closure(1)];';
+
+        self::assertNull(self::firstSig($source));
+        self::assertSame($source, self::strip($source));
+    }
+
+    // ===================================================================
+    // Structural rejects
+    // ===================================================================
+
+    public function testOnlyClosureMayCarryACallSignature(): void
+    {
+        $this->expectException(\RuntimeException::class);
+        $this->expectExceptionMessage('Only "Closure" may carry a call signature, "Foo" may not');
+        self::strip('<?php function f(Foo(int): int $c) {}');
+    }
+
+    public function testVariadicParameterMustBeLast(): void
+    {
+        $this->expectException(\RuntimeException::class);
+        $this->expectExceptionMessage('Only the last parameter of a Closure signature can be variadic');
+        self::strip('<?php function f(Closure(int ...$rest, string $tail): void $c) {}');
+    }
+
+    // ===================================================================
+    // No false positives — expression-context `Closure(` must be untouched
+    // ===================================================================
+
+    public function testCallToUserFunctionNamedClosureIsNotTreatedAsSignature(): void
+    {
+        $source = "<?php function Closure(\$n) { return \$n; }\n\$y = Closure(5);";
+
+        self::assertNull(self::firstSig($source), 'a call `Closure(5)` is not a type signature');
+        // Source is left intact (no erasure) so the call still works.
+        self::assertSame($source, self::strip($source));
+    }
+
+    public function testInstanceofClosureIsNotTreatedAsSignature(): void
+    {
+        $source = '<?php $r = $c instanceof Closure;';
+
+        self::assertNull(self::firstSig($source));
+        self::assertSame(rtrim($source), rtrim(self::strip($source)), 'instanceof Closure must be untouched');
+    }
+
+    public function testPlainClosureTypeHintWithoutSignatureIsUntouched(): void
+    {
+        // A bare `Closure $c` hint (no `(`) is an ordinary type — no marker, and
+        // the scanner must not rewrite it.
+        $source = '<?php function f(Closure $c) {}';
+
+        self::assertNull(self::firstSig($source));
+        self::assertSame($source, self::strip($source));
+    }
+
+    public function testSignatureShapedCallInExpressionContextIsNotErased(): void
+    {
+        // A call whose first argument is a NAME (`Closure(Foo::class)`) passes the
+        // cheap type-ish pre-filter, so only the POSITION GATE distinguishes it: the
+        // `)` is followed by `;`, not a `$var`, and it is not a return slot, so the
+        // production falls through untouched. Locks the gate independently of the
+        // pre-filter (which the literal-argument tests above cover).
+        $source = "<?php \$x = Closure(Foo::class);";
+
+        self::assertNull(self::firstSig($source));
+        self::assertSame($source, self::strip($source));
+    }
+
+    /**
+     * Expression-context `) :` producers — ternaries, case labels, alt-syntax
+     * blocks, member calls of the semi-reserved `fn`/`function` — must never be
+     * read as return-type slots: the source stays byte-identical and no
+     * only-Closure throw fires. (Keying on bare `) :` silently erased calls to
+     * a user function named `Closure` and hard-threw on ordinary `g(FOO)`.)
+     *
+     * @param non-empty-string $source
+     */
+    #[\PHPUnit\Framework\Attributes\DataProvider('expressionColonShapes')]
+    public function testExpressionColonShapesAreNeverReturnSlots(string $source): void
+    {
+        self::assertNull(self::firstSig($source));
+        self::assertSame($source, self::strip($source));
+    }
+
+    /**
+     * @return iterable<string, array{string}>
+     */
+    public static function expressionColonShapes(): iterable
+    {
+        $closureFn = '<?php namespace App; function Closure($n) { return $n; } ';
+        yield 'ternary else: first-class callable' => [$closureFn . '$r = $a ? b() : Closure(...);'];
+        yield 'ternary else: const-arg call' => [$closureFn . '$r = $a ? b() : Closure(A);'];
+        yield 'ternary else: grouping parens' => [$closureFn . '$r = ($a) ? ($b) : Closure(A);'];
+        yield 'ternary else: new before the colon' => [$closureFn . '$r = $a ? new Foo() : Closure(A);'];
+        yield 'ternary else: ANY function name must not throw' => ['<?php namespace App; $r = $a ? b() : g(FOO);'];
+        yield 'alt-syntax if' => [$closureFn . 'if ($x): Closure(A); endif;'];
+        yield 'alt-syntax if: any name' => ['<?php namespace App; if ($x): g(FOO); endif;'];
+        yield 'alt-syntax elseif: any name' => ['<?php namespace App; if ($a): ; elseif (f()): g(FOO); endif;'];
+        yield 'alt-syntax while' => ['<?php namespace App; while (f()): g(FOO); endwhile;'];
+        yield 'alt-syntax foreach' => ['<?php namespace App; foreach (f() as $x): g(FOO); endforeach;'];
+        yield 'declare block colon' => ['<?php declare(ticks=1): g(FOO); enddeclare;'];
+        yield 'case label' => [$closureFn . 'switch ($a) { case f(): Closure(A); }'];
+        yield 'statement right after a body brace' => [
+            // `{ Closure(A); }` — the walk must REQUIRE the `:`; skipping that
+            // check makes the body's `)` (of the enclosing header) masquerade
+            // as a return slot and erases the statement.
+            $closureFn . 'function f() { Closure(A); }',
+        ];
+        yield 'static call of a method named use' => [
+            // `C::use($q)` puts a real T_USE before the matched `(` — the
+            // use-layer hop must reject it (no `)` precedes the T_USE).
+            $closureFn . '$r = $c ? C::use($q) : Closure(A);',
+        ];
+        yield 'static call of semi-reserved fn' => [$closureFn . '$r = $c ? C::fn() : Closure(A);'];
+        yield 'static call of semi-reserved function' => [$closureFn . '$r = $c ? C::function() : Closure(A);'];
+        yield 'instance call of semi-reserved fn' => [$closureFn . '$r = $c ? $o->fn() : Closure(A);'];
+        yield 'short ternary' => [$closureFn . '$r = b() ?: Closure(A);'];
+        yield 'goto label' => [$closureFn . 'lbl: Closure(A); goto lbl;'];
+    }
+
+    /**
+     * Genuine declaration-header return slots — every spelling of the
+     * `function`/`fn` head the discriminator must accept.
+     *
+     * @param non-empty-string $source
+     */
+    #[\PHPUnit\Framework\Attributes\DataProvider('declarationReturnSlots')]
+    public function testDeclarationReturnSlotsKeepRecognizing(string $source): void
+    {
+        self::assertNotNull(self::firstSig($source), 'the return slot must recognize the signature');
+        self::assertStringContainsString('\\Closure', self::strip($source));
+    }
+
+    /**
+     * @return iterable<string, array{string}>
+     */
+    public static function declarationReturnSlots(): iterable
+    {
+        yield 'nullable return slot' => ['<?php function f(): ?Closure(int): int {}'];
+        yield 'tight colon return slot' => ['<?php function f():Closure(int): int {}'];
+        yield 'nullable return, tight colon' => ['<?php function f():?Closure(int): int {}'];
+        yield 'tight use clause (no space before use)' => ['<?php $f = function ()use ($a): Closure(int): int {};'];
+        yield 'tight by-ref arrow fn' => ['<?php $f = fn&(): Closure(int): int => fn(int $x): int => $x;'];
+        yield 'by-ref named function' => ['<?php function &f(): Closure(int): int {}'];
+        yield 'keyword-named method (list)' => ['<?php class C { public function list(): Closure(int): int { return fn(int $x): int => $x; } }'];
+        yield 'keyword-named method (default)' => ['<?php class C { public function default(): Closure(int): int { return fn(int $x): int => $x; } }'];
+        yield 'by-ref keyword-named method' => ['<?php class C { public function &list(): Closure(int): int { return fn(int $x): int => $x; } }'];
+        yield 'generic closure' => ['<?php $f = function<T>(T $x): Closure(int): int { return fn(int $y): int => $y; };'];
+        yield 'generic method with bound' => ['<?php class C { public function m<T : Fruit>(T $x): Closure(int): int { return fn(int $y): int => $y; } }'];
+        // NOTE: `function list<T>(...)` (generic + keyword name) is NOT here —
+        // the generic-marker scanner itself rejects keyword method names (a
+        // separate pre-existing loud gap, unrelated to the return-slot walk).
+        yield 'closure with use clause' => ['<?php $f = function () use ($a): Closure(int): int {};'];
+        yield 'by-ref closure with use clause' => ['<?php $f = function &() use ($a): Closure(int): int {};'];
+        yield 'by-ref arrow fn' => ['<?php $f = fn &(): Closure(int): int => fn(int $x): int => $x;'];
+        yield 'parenthesised default in params' => ['<?php function f($x = (1 + 2)): Closure(int): int {}'];
+        yield 'paren inside a string default' => ['<?php function f($s = "a)b"): Closure(int): int {}'];
+        yield 'comment between paren and colon' => ['<?php function f() /* c */ : Closure(int): int {}'];
+        yield 'abstract method' => ['<?php abstract class C { abstract protected function m(): Closure(int): int; }'];
+    }
+
+    public function testSourceWithoutAnyClosureSignatureIsReturnedUnchanged(): void
+    {
+        $source = <<<'PHP'
+        <?php
+        namespace App;
+        class Box<T> {
+            public T $item;
+            public function get(): T { return $this->item; }
+        }
+        PHP;
+        // No closure signature anywhere → the strip output must be byte-identical
+        // to the generic-only erasure it would already produce (no closure marker
+        // interference). We only assert no \Closure was introduced.
+        self::assertStringNotContainsString('\\Closure', self::strip($source));
+    }
+
+    // ===================================================================
+    // Adversarial span / token-walk coverage. `parse()` runs the erasure
+    // through nikic, so a signature span that ends too early or too late
+    // leaves invalid residue and fails to parse — every assertion here both
+    // checks the parsed shape AND (implicitly, via firstSig calling parse())
+    // proves the erased output is still valid PHP.
+    // ===================================================================
+
+    public function testGenericTypeInReturnPositionIsParsedAndErased(): void
+    {
+        // A `Name<...>` return type: scanTypeExprEnd must extend the span across
+        // the angle clause (findAngleEnd), and parseSigType must keep the generic
+        // args. A span that stops at `Vec` would leave `<int>` as invalid residue.
+        $sig = self::firstSig('<?php function f(): Closure(): Vec<int> {}');
+
+        self::assertNotNull($sig);
+        self::assertInstanceOf(SigTypeRef::class, $sig->return);
+        self::assertSame('Vec', $sig->return->type->name);
+        self::assertCount(1, $sig->return->type->args);
+        self::assertSame('int', $sig->return->type->args[0]->name);
+    }
+
+    public function testNestedGenericAnglesInSignatureEraseFully(): void
+    {
+        // `Map<K, Vec<V>>` — the `>>` is two levels of angle nesting. findAngleEnd's
+        // depth counter must reach zero only at the OUTER `>`; a broken counter
+        // ends the span at the inner `>` and leaves `>` residue (unparseable).
+        $source = '<?php function f(Closure(Map<K, Vec<V>>): bool $c) {}';
+        $sig = self::firstSig($source);
+
+        self::assertNotNull($sig);
+        $paramType = $sig->params[0]->type;
+        self::assertInstanceOf(SigTypeRef::class, $paramType);
+        self::assertSame('Map', $paramType->type->name);
+        self::assertCount(2, $paramType->type->args);
+
+        // Fully erased: no fragment of the nested generic survives (and firstSig
+        // above already proved the erased output re-parses).
+        $stripped = self::strip($source);
+        self::assertStringNotContainsString('Map', $stripped);
+        self::assertStringNotContainsString('Vec', $stripped);
+        self::assertStringNotContainsString('>', $stripped);
+    }
+
+    public function testThreeMemberUnionReturnIsStructuredAndErases(): void
+    {
+        // `A|B|C` drives scanTypeExprEnd's `|`-continuation loop twice. A span that
+        // stops after the first `|` yields raw `A|B` and leaves `|C` residue.
+        $source = '<?php function f(): Closure(): A|B|C {}';
+        $sig = self::firstSig($source);
+
+        self::assertNotNull($sig);
+        self::assertInstanceOf(SigUnion::class, $sig->return);
+        self::assertSame(['A', 'B', 'C'], self::sigMemberNames($sig->return));
+        self::assertStringNotContainsString('A|B|C', self::strip($source));
+    }
+
+    public function testIntersectionByReferenceParameterSeparatesTypeFromMarker(): void
+    {
+        // `A&B &$r` — the FIRST `&` is an intersection continuation (a Name follows),
+        // the SECOND `&` is the by-ref marker (a `$var` follows). scanTypeExprEnd must
+        // consume the first and STOP at the second (its non-continuing-`&` break);
+        // parseSigParam then reads the by-ref marker.
+        $source = '<?php function f(Closure(A&B &$r): void $c) {}';
+        $sig = self::firstSig($source);
+
+        self::assertNotNull($sig);
+        self::assertCount(1, $sig->params);
+        self::assertInstanceOf(SigRaw::class, $sig->params[0]->type);
+        self::assertSame('A&B', $sig->params[0]->type->raw);
+        self::assertTrue($sig->params[0]->byRef, 'the second `&` is the by-ref marker');
+        self::assertSame('void', self::refName($sig->return));
+    }
+
+    public function testWhitespaceAndCommentsWithinSignatureAreSkipped(): void
+    {
+        // Spaces around every token and a comment between params — exercises the
+        // forward whitespace/comment skips in the param/return walk.
+        $source = '<?php function f(Closure( int $x , /* c */ string $y ) : bool $c) {}';
+        $sig = self::firstSig($source);
+
+        self::assertNotNull($sig);
+        self::assertCount(2, $sig->params);
+        self::assertSame('int', self::refName($sig->params[0]->type));
+        self::assertSame('string', self::refName($sig->params[1]->type));
+        self::assertSame('bool', self::refName($sig->return));
+    }
+
+    public function testCommentBetweenNullableAndClosureStillMarksNullable(): void
+    {
+        // The backward walk (skipWsBack) that finds a leading `?` must skip a comment
+        // sitting between the `?` and `Closure`.
+        $sig = self::firstSig('<?php function f(?/* n */Closure(int): int $c) {}');
+
+        self::assertNotNull($sig);
+        self::assertTrue($sig->nullable);
+    }
+
+    public function testTightlyPackedSignatureIsParsed(): void
+    {
+        // No whitespace anywhere — the token walks must advance to the next
+        // SIGNIFICANT token, not blindly by one index (which coincides only when a
+        // whitespace token happens to sit between). Locks the comma / colon skips.
+        $sig = self::firstSig('<?php function f(Closure(int,string):bool $c){}');
+
+        self::assertNotNull($sig);
+        self::assertCount(2, $sig->params);
+        self::assertSame('int', self::refName($sig->params[0]->type));
+        self::assertSame('string', self::refName($sig->params[1]->type));
+        self::assertSame('bool', self::refName($sig->return));
+    }
+
+    public function testTightlyPackedCastParamAndReturn(): void
+    {
+        // `Closure(int):int` — cast-token param list immediately followed by `:int`
+        // with no surrounding whitespace.
+        $sig = self::firstSig('<?php function f(Closure(int):int $c){}');
+
+        self::assertNotNull($sig);
+        self::assertCount(1, $sig->params);
+        self::assertSame('int', self::refName($sig->params[0]->type));
+        self::assertSame('int', self::refName($sig->return));
+    }
+
+    public function testByReferenceVariadicParameterCapturesBothMarkers(): void
+    {
+        // `int&...$rest` — a by-reference variadic. The `&` (by-ref) and `...`
+        // (variadic) must both be read, in order, off the same parameter; a skip that
+        // overshoots the `&` would miss the `...` and drop the variadic flag.
+        $sig = self::firstSig('<?php function f(Closure(int&...$rest):void $c){}');
+
+        self::assertNotNull($sig);
+        self::assertCount(1, $sig->params);
+        self::assertTrue($sig->params[0]->byRef);
+        self::assertTrue($sig->params[0]->variadic);
+        self::assertSame('int', self::refName($sig->params[0]->type));
+    }
+
+    public function testNestedClosureInnerTypeIsResolvedAgainstNamespace(): void
+    {
+        // The resolver must recurse INTO a nested closure: an inner class name is
+        // namespace-resolved (`Widget` → `App\Widget`). Without the recursion the
+        // inner leaf would stay the bare, unresolved `Widget`.
+        $sig = self::firstSig(<<<'PHP'
+        <?php
+        namespace App;
+        function f(Closure(Closure(Widget): int): int $c) {}
+        PHP);
+
+        self::assertNotNull($sig);
+        $inner = $sig->params[0]->type;
+        self::assertInstanceOf(SigClosure::class, $inner);
+        self::assertSame('App\\Widget', self::refName($inner->signature->params[0]->type));
+    }
+
+    // ===================================================================
+    // Multiple signatures on one line map to Name nodes in source order
+    // ===================================================================
+
+    public function testTwoSignaturesOnOneLineMapToNamesInSourceOrder(): void
+    {
+        $sigs = self::allSigs('<?php function f(Closure(int): int $a, Closure(string): bool $b) {}');
+
+        self::assertCount(2, $sigs);
+        self::assertSame('int', self::refName($sigs[0]->params[0]->type));
+        self::assertSame('int', self::refName($sigs[0]->return));
+        self::assertSame('string', self::refName($sigs[1]->params[0]->type));
+        self::assertSame('bool', self::refName($sigs[1]->return));
+    }
+
+    // ===================================================================
+    // Reserved-word type keywords: `array` / `callable` / `static` lex as their
+    // own tokens (T_ARRAY / T_CALLABLE / T_STATIC), not T_STRING, so they must be
+    // recognized as type names — otherwise the signature fails to erase.
+    // ===================================================================
+
+    public function testArrayAsFirstParameterErasesAndParses(): void
+    {
+        $sig = self::firstSig('<?php function f(Closure(array $a): void $cb) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(1, $sig->params);
+        self::assertSame('array', self::refName($sig->params[0]->type));
+        self::assertSame('void', self::refName($sig->return));
+    }
+
+    public function testCallableAsReturnTypeErasesAndParses(): void
+    {
+        $sig = self::firstSig('<?php function f(): Closure(): callable {}');
+
+        self::assertNotNull($sig);
+        self::assertSame('callable', self::refName($sig->return));
+    }
+
+    public function testArrayAsNonFirstParameterIsAStructuredLeaf(): void
+    {
+        // Not just erased — represented as a SigTypeRef, not raw text.
+        $sig = self::firstSig('<?php function f(Closure(int $a, array $b): void $cb) {}');
+
+        self::assertNotNull($sig);
+        self::assertCount(2, $sig->params);
+        self::assertSame('array', self::refName($sig->params[1]->type));
+    }
+
+    public function testStaticAsReturnTypeIsAStructuredLeaf(): void
+    {
+        $sig = self::firstSig('<?php function f(Closure(): static $cb) {}');
+
+        self::assertNotNull($sig);
+        self::assertSame('static', self::refName($sig->return));
+    }
+
+    public function testUnionWithArrayMemberErasesFullyWithoutResidue(): void
+    {
+        // Regression: `int|array` once stopped the span at `int`, leaving `|array`
+        // which re-parsed into a bogus `\Closure|array` return type (unsound). The
+        // whole union must erase and be carried raw.
+        $source = '<?php function f(): Closure(): int|array {}';
+        $sig = self::firstSig($source);
+
+        self::assertNotNull($sig);
+        self::assertInstanceOf(SigUnion::class, $sig->return);
+        self::assertSame(['int', 'array'], self::sigMemberNames($sig->return));
+
+        $stripped = self::strip($source);
+        self::assertStringNotContainsString('|array', $stripped);
+        self::assertStringNotContainsString('|', $stripped);
+    }
+
+    public function testNullableArrayLeafIsStructuredAsUnionWithNull(): void
+    {
+        $sig = self::firstSig('<?php function f(Closure(): ?array $cb) {}');
+
+        self::assertNotNull($sig);
+        self::assertInstanceOf(SigUnion::class, $sig->return);
+        self::assertSame(['array', 'null'], self::sigMemberNames($sig->return));
+    }
+
+    // ===================================================================
+    // Marker attaches to the exact Name it belongs to — a plain `Closure`
+    // hint sharing a line with a real signature must not steal the marker.
+    // ===================================================================
+
+    public function testPlainClosureHintDoesNotStealASiblingSignature(): void
+    {
+        // param $a is a plain `Closure`; param $b carries the signature. The marker
+        // must land on $b, not the earlier plain $a.
+        $names = self::closureTypeNamesInOrder('<?php function f(Closure $a, Closure(int): int $b) {}');
+
+        self::assertCount(2, $names);
+        self::assertNull($names[0], 'the plain `Closure $a` hint must carry no signature');
+        self::assertNotNull($names[1], 'the signature must attach to `Closure(int): int $b`');
+        self::assertSame('int', self::refName($names[1]->return));
+    }
+
+    public function testSignatureParamDoesNotLeakToPlainClosureReturn(): void
+    {
+        // param $a carries the signature; the bare `Closure` return type is plain.
+        $names = self::closureTypeNamesInOrder('<?php function f(Closure(int): int $a): Closure {}');
+
+        self::assertCount(2, $names);
+        self::assertNotNull($names[0], 'the signature must attach to the `Closure(int): int $a` param');
+        self::assertNull($names[1], 'the bare `Closure` return type must carry no signature');
+    }
+
+    // ===================================================================
+    // Byte-length preservation: erasure must not shift positions of later
+    // byte-keyed markers (anonymous-closure generics).
+    // ===================================================================
+
+    public function testErasureDoesNotShiftLaterByteKeyedMarkers(): void
+    {
+        // An anonymous generic closure is matched by BYTE POSITION. A closure
+        // signature earlier in the file must erase to an equal-length span so the
+        // later closure's `<T>` marker still aligns and attaches.
+        $source = "<?php\n"
+            . "function outer(Closure(int): int \$cb) {}\n"
+            . "\$f = function <T>(T \$x): T { return \$x; };\n";
+
+        $ast = self::parser()->parse($source);
+        $params = null;
+        $walker = function ($nodes) use (&$walker, &$params): void {
+            foreach ($nodes as $node) {
+                if ($node instanceof Node\Expr\Closure) {
+                    $params = $node->getAttribute(XphpSourceParser::ATTR_METHOD_GENERIC_PARAMS);
+                }
+                if (is_object($node) && method_exists($node, 'getSubNodeNames')) {
+                    foreach ($node->getSubNodeNames() as $name) {
+                        $value = $node->$name;
+                        if (is_array($value)) {
+                            $walker($value);
+                        } elseif (is_object($value)) {
+                            $walker([$value]);
+                        }
+                    }
+                }
+            }
+        };
+        $walker($ast);
+
+        self::assertIsArray($params, 'the anonymous closure generic marker must still attach after a closure-sig erasure');
+        self::assertCount(1, $params);
+        self::assertSame('T', $params[0]->name);
+    }
+
+    // ===================================================================
+    // Helpers
+    // ===================================================================
+
+    /**
+     * The signature (or null) attached to each `Closure`/`\Closure` type Name in
+     * the source, in traversal order — one entry per Name, so a plain hint shows
+     * up as a null slot.
+     *
+     * @return list<?ClosureSignature>
+     */
+    private static function closureTypeNamesInOrder(string $source): array
+    {
+        $ast = self::parser()->parse($source);
+        $out = [];
+        $walker = function ($nodes) use (&$walker, &$out): void {
+            foreach ($nodes as $node) {
+                if ($node instanceof Name && ltrim($node->toString(), '\\') === 'Closure') {
+                    $sig = $node->getAttribute(XphpSourceParser::ATTR_CLOSURE_SIG);
+                    $out[] = $sig instanceof ClosureSignature ? $sig : null;
+                }
+                if (is_object($node) && method_exists($node, 'getSubNodeNames')) {
+                    foreach ($node->getSubNodeNames() as $name) {
+                        $value = $node->$name;
+                        if (is_array($value)) {
+                            $walker($value);
+                        } elseif (is_object($value)) {
+                            $walker([$value]);
+                        }
+                    }
+                }
+            }
+        };
+        $walker($ast);
+        return $out;
+    }
+
+    // ===================================================================
+    // Base helpers
+    // ===================================================================
+
+    private static function parser(): XphpSourceParser
+    {
+        return new XphpSourceParser((new ParserFactory())->createForHostVersion());
+    }
+
+    private static function strip(string $source): string
+    {
+        return self::parser()->strip($source);
+    }
+
+    /** The ClosureSignature attached to the first `\Closure` Name, or null. */
+    private static function firstSig(string $source): ?ClosureSignature
+    {
+        return self::allSigs($source)[0] ?? null;
+    }
+
+    /**
+     * Every attached ClosureSignature in source (traversal) order.
+     *
+     * @return list<ClosureSignature>
+     */
+    private static function allSigs(string $source): array
+    {
+        $ast = self::parser()->parse($source);
+        $found = [];
+        $walker = function ($nodes) use (&$walker, &$found): void {
+            foreach ($nodes as $node) {
+                if ($node instanceof Name) {
+                    $sig = $node->getAttribute(XphpSourceParser::ATTR_CLOSURE_SIG);
+                    if ($sig instanceof ClosureSignature) {
+                        $found[] = $sig;
+                    }
+                }
+                if (is_object($node) && method_exists($node, 'getSubNodeNames')) {
+                    foreach ($node->getSubNodeNames() as $name) {
+                        $value = $node->$name;
+                        if (is_array($value)) {
+                            $walker($value);
+                        } elseif (is_object($value)) {
+                            $walker([$value]);
+                        }
+                    }
+                }
+            }
+        };
+        $walker($ast);
+        return $found;
+    }
+
+    /**
+     * The ATTR_GENERIC_ARGS attached to the first Name matching $nameLookup.
+     *
+     * @return list<TypeRef>
+     */
+    private static function genericArgs(string $source, string $nameLookup): array
+    {
+        $ast = self::parser()->parse($source);
+        $found = [];
+        $walker = function ($nodes) use (&$walker, &$found, $nameLookup): void {
+            foreach ($nodes as $node) {
+                if ($found) {
+                    return;
+                }
+                if ($node instanceof Name && $node->toString() === $nameLookup) {
+                    $args = $node->getAttribute(XphpSourceParser::ATTR_GENERIC_ARGS);
+                    if (is_array($args)) {
+                        $found = $args;
+                        return;
+                    }
+                }
+                if (is_object($node) && method_exists($node, 'getSubNodeNames')) {
+                    foreach ($node->getSubNodeNames() as $name) {
+                        $value = $node->$name;
+                        if (is_array($value)) {
+                            $walker($value);
+                        } elseif (is_object($value)) {
+                            $walker([$value]);
+                        }
+                    }
+                }
+            }
+        };
+        $walker($ast);
+        return $found;
+    }
+
+    private static function refName(?SigType $type): ?string
+    {
+        if (!$type instanceof SigTypeRef) {
+            return null;
+        }
+        return $type->type->name;
+    }
+
+    /**
+     * The (unresolved) member names of a compound leaf, in order.
+     *
+     * @return list<?string>
+     */
+    private static function sigMemberNames(SigUnion|SigIntersection $type): array
+    {
+        return array_map(self::refName(...), $type->members);
+    }
+
+    private static function isScalarRef(SigType $type): bool
+    {
+        return $type instanceof SigTypeRef && $type->type->isScalar;
+    }
+
+    private static function runPhp(string $code): string
+    {
+        $file = tempnam(sys_get_temp_dir(), 'xphp_closure_sig_') ?: throw new \RuntimeException('tempnam failed');
+        try {
+            file_put_contents($file, $code);
+            $output = shell_exec(escapeshellarg(PHP_BINARY) . ' ' . escapeshellarg($file) . ' 2>&1');
+            return trim((string) $output);
+        } finally {
+            @unlink($file);
+        }
+    }
+}
diff --git a/test/Transpiler/Monomorphize/DefaultedGenericIntegrationTest.php b/test/Transpiler/Monomorphize/DefaultedGenericIntegrationTest.php
index 441bccd..49eec68 100644
--- a/test/Transpiler/Monomorphize/DefaultedGenericIntegrationTest.php
+++ b/test/Transpiler/Monomorphize/DefaultedGenericIntegrationTest.php
@@ -6,12 +6,14 @@
 
 use PhpParser\ParserFactory;
 use PhpParser\PrettyPrinter\Standard as StandardPrinter;
+use PHPUnit\Framework\Attributes\RunInSeparateProcess;
 use PHPUnit\Framework\TestCase;
 use RuntimeException;
 use XPHP\FileSystem\FileFinder\NativeFileFinder;
 use XPHP\FileSystem\FilepathArray;
 use XPHP\FileSystem\FileReader\NativeFileReader;
 use XPHP\FileSystem\FileWriter\NativeFileWriter;
+use XPHP\TestSupport\CompiledFixture;
 use XPHP\TestSupport\SnapshotHash;
 
 final class DefaultedGenericIntegrationTest extends TestCase
@@ -87,6 +89,25 @@ public function testFullDefaultsFixtureGeneratesExpectedSpecializations(): void
         );
     }
 
+    #[RunInSeparateProcess]
+    public function testBareNewSelfInNonDefaultsGenericBodyIsNotRejectedAndRuns(): void
+    {
+        // WI-06 false-reject guard: the bare-new reject fires only on a bare `new` of the
+        // *template name*. A bare `new self` inside a non-defaults generic body must NOT be
+        // rejected -- `self` resolves to no template and the Specializer rewrites it per
+        // instantiation. Compiled and executed end-to-end.
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/bare_new_self_in_generic_body/source',
+            'bare-new-self',
+        );
+        try {
+            $fixture->registerAutoload('App\\BareNewSelfInGenericBody');
+            require __DIR__ . '/../../fixture/compile/bare_new_self_in_generic_body/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+
     public function testEmptyTurbofishAndBareNewProduceSameSpecialization(): void
     {
         // After compile, both `new Cache;` and `new Cache::<>` in the same
diff --git a/test/Transpiler/Monomorphize/EnclosingParamBoundIntegrationTest.php b/test/Transpiler/Monomorphize/EnclosingParamBoundIntegrationTest.php
index 10cb210..d2e6104 100644
--- a/test/Transpiler/Monomorphize/EnclosingParamBoundIntegrationTest.php
+++ b/test/Transpiler/Monomorphize/EnclosingParamBoundIntegrationTest.php
@@ -159,10 +159,14 @@ public function contains<U : E>(U $value): bool { return true; }
             ]);
             self::fail('Expected a bound violation for Box<Banana>::contains<Fruit>.');
         } catch (RuntimeException $e) {
-            $msg = $e->getMessage();
-            self::assertStringContainsString('Generic bound violated', $msg);
-            self::assertStringContainsString('extend/implement "App\\Banana"', $msg, 'bound must be grounded to the receiver arg Banana');
-            self::assertStringNotContainsString('"E"', $msg, 'must not report the literal type parameter E');
+            self::assertSame(
+                "Generic bound violated while instantiating App\\Box::contains<App\\Fruit>.\n"
+                . "  type parameter U is bounded by App\\Banana\n"
+                . "  but the supplied concrete type is App\\Fruit\n"
+                . "\n"
+                . "  \"App\\Fruit\" does not extend/implement \"App\\Banana\".",
+                $e->getMessage(),
+            );
         }
     }
 
@@ -1847,7 +1851,7 @@ public function testGenericClosureDoesNotLeakAcrossScopes(): void
                 declare(strict_types=1);
                 namespace App;
                 class C {
-                    public function a(): void { $f = function<T>(T $x): T { return $x; }; }
+                    public function a(): void { $f = function<T>(T $x): T { return $x; }; $f::<int>(1); }
                     public function b(callable $f): mixed { return $f('x'); }
                 }
                 PHP,
diff --git a/test/Transpiler/Monomorphize/EnclosingParamBoundLimitationTest.php b/test/Transpiler/Monomorphize/EnclosingParamBoundLimitationTest.php
index 94b91d5..b314f5d 100644
--- a/test/Transpiler/Monomorphize/EnclosingParamBoundLimitationTest.php
+++ b/test/Transpiler/Monomorphize/EnclosingParamBoundLimitationTest.php
@@ -47,8 +47,14 @@ public function testBranchMergedReceiverIsGroundedAndRejectsAnElementViolation()
             $this->compileFixture('enclosing_param_bound_lenient_drop');
             self::fail('expected a bound violation for contains::<Rock> on a branch-merged Box<Fruit>');
         } catch (RuntimeException $e) {
-            self::assertStringContainsString('Generic bound violated', $e->getMessage());
-            self::assertStringContainsString('extend/implement "App\\Fruit"', $e->getMessage());
+            self::assertSame(
+                "Generic bound violated while instantiating App\\Box::contains<App\\Rock>.\n"
+                . "  type parameter U is bounded by App\\Fruit\n"
+                . "  but the supplied concrete type is App\\Rock\n"
+                . "\n"
+                . "  \"App\\Rock\" does not extend/implement \"App\\Fruit\".",
+                $e->getMessage(),
+            );
         }
     }
 
@@ -70,8 +76,14 @@ public function testTheSameElementViolationIsCaughtWhenTheReceiverIsGroundable()
             ]);
             self::fail('expected a bound violation for contains::<Rock> on Box<Fruit>');
         } catch (RuntimeException $e) {
-            self::assertStringContainsString('Generic bound violated', $e->getMessage());
-            self::assertStringContainsString('extend/implement "App\\Fruit"', $e->getMessage());
+            self::assertSame(
+                "Generic bound violated while instantiating App\\Box::contains<App\\Rock>.\n"
+                . "  type parameter U is bounded by App\\Fruit\n"
+                . "  but the supplied concrete type is App\\Rock\n"
+                . "\n"
+                . "  \"App\\Rock\" does not extend/implement \"App\\Fruit\".",
+                $e->getMessage(),
+            );
         }
     }
 
@@ -87,8 +99,14 @@ public function testBranchMergedReceiverIsGroundedAndRejectsACompoundViolation()
             $this->compileFixture('enclosing_param_bound_compound_drop');
             self::fail('expected a bound violation for register::<Banana> on a branch-merged Box<Fruit>');
         } catch (RuntimeException $e) {
-            self::assertStringContainsString('Generic bound violated', $e->getMessage());
-            self::assertStringContainsString('Stringable', $e->getMessage());
+            self::assertSame(
+                "Generic bound violated while instantiating App\\Box::register<App\\Banana>.\n"
+                . "  type parameter U is bounded by Stringable & App\\Fruit\n"
+                . "  but the supplied concrete type is App\\Banana\n"
+                . "\n"
+                . "  \"App\\Banana\" does not satisfy \"Stringable & App\\Fruit\".",
+                $e->getMessage(),
+            );
         }
     }
 
@@ -111,8 +129,14 @@ public function testTheStringableOperandIsEnforcedWhenTheReceiverIsGroundable():
             ]);
             self::fail('expected a bound violation for register::<Banana> on Box<Fruit>');
         } catch (RuntimeException $e) {
-            self::assertStringContainsString('Generic bound violated', $e->getMessage());
-            self::assertStringContainsString('Stringable', $e->getMessage());
+            self::assertSame(
+                "Generic bound violated while instantiating App\\Box::register<App\\Banana>.\n"
+                . "  type parameter U is bounded by Stringable & App\\Fruit\n"
+                . "  but the supplied concrete type is App\\Banana\n"
+                . "\n"
+                . "  \"App\\Banana\" does not satisfy \"Stringable & App\\Fruit\".",
+                $e->getMessage(),
+            );
         }
     }
 
diff --git a/test/Transpiler/Monomorphize/FreeSymbolRequalifyTest.php b/test/Transpiler/Monomorphize/FreeSymbolRequalifyTest.php
new file mode 100644
index 0000000..1953ce6
--- /dev/null
+++ b/test/Transpiler/Monomorphize/FreeSymbolRequalifyTest.php
@@ -0,0 +1,94 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+use PHPUnit\Framework\Attributes\RunInSeparateProcess;
+use PHPUnit\Framework\TestCase;
+use XPHP\TestSupport\CompiledFixture;
+
+/**
+ * A generic class body is relocated out of its origin namespace into XPHP\Generated\… when it
+ * specializes, so an unqualified free-function call or const fetch would rebind against the
+ * generated namespace (then the global fallback) instead of the origin — a wrong symbol or a
+ * runtime fatal. The Specializer re-qualifies each such reference to the FQN the resolver
+ * recorded, but only when the compilation unit defines it; builtins, magic constants, and any
+ * unknown name keep PHP's global resolution. These tests compile AND execute the output.
+ */
+final class FreeSymbolRequalifyTest extends TestCase
+{
+    #[RunInSeparateProcess]
+    public function testBareQualifiedConstAndBuiltinReferencesBindCorrectlyAtRuntime(): void
+    {
+        // scale(1)=10 + BONUS=5 + Sub\tweak(2)=3 + strlen('ab')=2 + (true?0:99)=0 = 20.
+        // Proves: bare fn + bare const + qualified fn re-qualify to the App symbols, while the
+        // builtin `strlen` and magic constant `true` stay on the global fallback (a wrong bind
+        // would fatal with "undefined function XPHP\Generated\…\scale" or miscompute).
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/free_symbol_requalify/source',
+            'free-symbol-requalify',
+        );
+        try {
+            $fixture->registerAutoload('App\\FreeSym');
+            require __DIR__ . '/../../fixture/compile/free_symbol_requalify/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testUseFunctionAndUseConstImportsBindTheImportedNamespaceAtRuntime(): void
+    {
+        // `use function Vendor\make; use const Vendor\RATE;` in an App-namespaced template:
+        // make(3)=6 + RATE=100 = 106. The imports do not travel with the relocated body, so the
+        // references are fully-qualified to Vendor's symbols — a naive `App\make` would fatal.
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/free_symbol_use_import/source',
+            'free-symbol-use-import',
+        );
+        try {
+            $fixture->registerAutoload('App', 'Vendor');
+            require __DIR__ . '/../../fixture/compile/free_symbol_use_import/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testGroupUseFunctionAndConstImportsBindTheImportedNamespaceAtRuntime(): void
+    {
+        // `use function Vendor\{make, scale}; use Vendor\{const RATE, const STEP};` in an App template:
+        // make(3)=6 + scale(1)=10 + RATE=100 + STEP=7 = 123. Group-form imports must reach the same
+        // function/const symbol maps as the single-import form, or the relocated body fatals on `make`.
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/free_symbol_group_use_import/source',
+            'free-symbol-group-use-import',
+        );
+        try {
+            $fixture->registerAutoload('App', 'Vendor');
+            require __DIR__ . '/../../fixture/compile/free_symbol_group_use_import/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testGapFilledCovariantMembersReQualifyTheirFreeSymbolsAtRuntime(): void
+    {
+        // A covariant diamond gap-fills `contains`/`indexOf` onto the concrete specs (Lst, Bag) AFTER the
+        // Phase 2.3 relocation sweep. Those erasable bodies call an in-unit free function `tally` and read
+        // an in-unit const `OFFSET`; without a re-qualify pass over the gap-filled members the bare names
+        // rebind to XPHP\Generated and fatal on the upcast call. contains(absent)=true, indexOf(absent)=1.
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/covariant_gapfill_free_symbol/source',
+            'covariant-gapfill-free-symbol',
+        );
+        try {
+            $fixture->registerAutoload('App');
+            require __DIR__ . '/../../fixture/compile/covariant_gapfill_free_symbol/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+}
diff --git a/test/Transpiler/Monomorphize/GenericTraitAdaptationTest.php b/test/Transpiler/Monomorphize/GenericTraitAdaptationTest.php
new file mode 100644
index 0000000..7c158d0
--- /dev/null
+++ b/test/Transpiler/Monomorphize/GenericTraitAdaptationTest.php
@@ -0,0 +1,54 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+use PHPUnit\Framework\Attributes\RunInSeparateProcess;
+use PHPUnit\Framework\TestCase;
+use XPHP\TestSupport\CompiledFixture;
+
+/**
+ * A generic trait used with an adaptation block (`insteadof` / `as`) specializes its
+ * `use`-LIST names but used to leave the adaptation OPERAND names bare, so they resolved
+ * to the removed template (`App\A`) and fataled at class load behind a clean compile.
+ * These tests compile AND execute the adapted class, so a bare operand would fatal here.
+ */
+final class GenericTraitAdaptationTest extends TestCase
+{
+    #[RunInSeparateProcess]
+    public function testCrossStatementInsteadofAndAliasResolveAtRuntime(): void
+    {
+        // Two generic traits used in SEPARATE `use` statements; the conflict is resolved
+        // in the second block, whose operands name traits from BOTH statements (the
+        // class-scoped map). insteadof picks A::pick, `as` re-exposes B::pick as bpick.
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/generic_trait_adaptation/source',
+            'generic-trait-adaptation',
+        );
+        try {
+            $fixture->registerAutoload('App');
+            require __DIR__ . '/../../fixture/compile/generic_trait_adaptation/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testMixedGenericAndPlainTraitAdaptationResolvesAtRuntime(): void
+    {
+        // A plain trait mixed with two generic traits, both generics excluded in one
+        // `insteadof`. The plain operand must stay bare (a real trait); the generic
+        // operands rewrite to their specializations.
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/generic_trait_adaptation_mixed/source',
+            'generic-trait-adaptation-mixed',
+        );
+        try {
+            $fixture->registerAutoload('App');
+            require __DIR__ . '/../../fixture/compile/generic_trait_adaptation_mixed/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+}
diff --git a/test/Transpiler/Monomorphize/GroupImportClassRequalifyTest.php b/test/Transpiler/Monomorphize/GroupImportClassRequalifyTest.php
new file mode 100644
index 0000000..9925dd0
--- /dev/null
+++ b/test/Transpiler/Monomorphize/GroupImportClassRequalifyTest.php
@@ -0,0 +1,37 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+use PHPUnit\Framework\Attributes\RunInSeparateProcess;
+use PHPUnit\Framework\TestCase;
+use XPHP\TestSupport\CompiledFixture;
+
+/**
+ * A generic class body is relocated out of its origin namespace into XPHP\Generated\…, so a class
+ * reference in that body must be re-qualified to the import target. A SINGLE `use Vendor\Tool;` was
+ * re-qualified correctly, but a GROUP `use Vendor\{Tool};` was not — its member was never stored in
+ * the class/namespace use-map, so the reference fell back to the current namespace (`\App\Tool`) and
+ * fataled at runtime ("Class App\Tool not found") behind a clean compile. This test compiles AND
+ * executes the output.
+ */
+final class GroupImportClassRequalifyTest extends TestCase
+{
+    #[RunInSeparateProcess]
+    public function testGroupImportedClassReQualifiesInARelocatedBodyAtRuntime(): void
+    {
+        // Box<int>::run() calls a group-imported Tool::ping() ('pong') and a single-imported
+        // Widget::spin() ('spin') -> 'pongspin'. A group form that fell back to \App\Tool would fatal.
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/group_import_class_requalify/source',
+            'group-import-class-requalify',
+        );
+        try {
+            $fixture->registerAutoload('App', 'Vendor');
+            require __DIR__ . '/../../fixture/compile/group_import_class_requalify/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+}
diff --git a/test/Transpiler/Monomorphize/KeywordNamedGenericMethodTest.php b/test/Transpiler/Monomorphize/KeywordNamedGenericMethodTest.php
new file mode 100644
index 0000000..793b2e4
--- /dev/null
+++ b/test/Transpiler/Monomorphize/KeywordNamedGenericMethodTest.php
@@ -0,0 +1,57 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+use PHPUnit\Framework\Attributes\RunInSeparateProcess;
+use PHPUnit\Framework\TestCase;
+use XPHP\TestSupport\CompiledFixture;
+
+/**
+ * A generic method may carry a name that is a PHP keyword (`list`, `print`, …) — PHP permits every
+ * semi-reserved word as a method name. The declaration scanner used to require a `T_STRING` name, so
+ * the `<T>` clause after a keyword name was never stripped and reached php-parser as a raw parse
+ * error; and the static call-site scanner rejected a keyword name after `::`, so `Reg::print::<int>()`
+ * parse-errored too (the instance form `$r->list::<int>()` already worked, because `list`
+ * re-tokenizes as `T_STRING` after `->`). Both gates now accept keyword names. This test compiles AND
+ * executes the output to prove the specialized keyword-named methods are declared and callable.
+ */
+final class KeywordNamedGenericMethodTest extends TestCase
+{
+    #[RunInSeparateProcess]
+    public function testKeywordNamedGenericMethodSpecializesAndRunsViaBothCallSites(): void
+    {
+        // Instance `$r->list::<int>(41)` returns 41; static `Reg::print::<int>(7)` returns 7. A gate
+        // that still rejected the keyword name would parse-error at compile, not reach this assertion.
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/keyword_named_generic_method/source',
+            'keyword-named-generic-method',
+        );
+        try {
+            $fixture->registerAutoload('App');
+            require __DIR__ . '/../../fixture/compile/keyword_named_generic_method/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testKeywordNamedNonGenericMethodsAndListDestructuringPassThroughUnchanged(): void
+    {
+        // Must-keep: the keyword-turbofish support fires only for `keyword::<…>` after `::`, so an
+        // ordinary keyword-named non-generic method (`R::print(20)`, `$r->list(10)`) and a `list()`
+        // destructuring must be untouched — never routed into the closure-signature / array-sugar
+        // sub-branches, which would throw or mis-parse. list(10)+1=11, print(20)+2=22, unpack=7.
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/keyword_nongeneric_passthrough/source',
+            'keyword-nongeneric-passthrough',
+        );
+        try {
+            $fixture->registerAutoload('App');
+            require __DIR__ . '/../../fixture/compile/keyword_nongeneric_passthrough/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+}
diff --git a/test/Transpiler/Monomorphize/MarkerAlignmentIntegrationTest.php b/test/Transpiler/Monomorphize/MarkerAlignmentIntegrationTest.php
new file mode 100644
index 0000000..6e1dd39
--- /dev/null
+++ b/test/Transpiler/Monomorphize/MarkerAlignmentIntegrationTest.php
@@ -0,0 +1,79 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+use PHPUnit\Framework\Attributes\RunInSeparateProcess;
+use PHPUnit\Framework\TestCase;
+use XPHP\TestSupport\CompiledFixture;
+
+/**
+ * End-to-end pins for generic-marker/AST alignment: every declaration that
+ * FOLLOWS a stripped span (a multi-line `<…>` clause, turbofish arg list, or
+ * `T[]` sugar span) must still specialize, and the emitted program must run.
+ * Misalignment is silent — compile and check both pass while the output
+ * carries raw un-erased type-parameter hints that fatal at runtime.
+ */
+final class MarkerAlignmentIntegrationTest extends TestCase
+{
+    #[RunInSeparateProcess]
+    public function testDeclarationsAfterMultiLineSpansStillSpecializeAndRun(): void
+    {
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/multiline_generic_markers/source',
+            'multiline-generic-markers',
+        );
+        $fixture->registerAutoload('App\\MultilineMarkers');
+        try {
+            require __DIR__ . '/../../fixture/compile/multiline_generic_markers/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testAttributedAndStaticGenericClosuresSpecializeAndRun(): void
+    {
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/attributed_generic_closures/source',
+            'attributed-generic-closures',
+        );
+        $fixture->registerAutoload('App\\AttributedClosures');
+        try {
+            require __DIR__ . '/../../fixture/compile/attributed_generic_closures/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testSameLineSameSpellingPairsBindTheirOwnMarkersAndRun(): void
+    {
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/same_line_marker_pairs/source',
+            'same-line-marker-pairs',
+        );
+        $fixture->registerAutoload('App\\SameLinePairs');
+        try {
+            require __DIR__ . '/../../fixture/compile/same_line_marker_pairs/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testSplitDeclarationHeadersSpecializeAndRun(): void
+    {
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/split_declaration_headers/source',
+            'split-declaration-headers',
+        );
+        $fixture->registerAutoload('App\\SplitHeaders');
+        try {
+            require __DIR__ . '/../../fixture/compile/split_declaration_headers/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+}
diff --git a/test/Transpiler/Monomorphize/NamespaceContextTest.php b/test/Transpiler/Monomorphize/NamespaceContextTest.php
index 2890826..850b9a7 100644
--- a/test/Transpiler/Monomorphize/NamespaceContextTest.php
+++ b/test/Transpiler/Monomorphize/NamespaceContextTest.php
@@ -6,6 +6,7 @@
 
 use PhpParser\Node\Identifier;
 use PhpParser\Node\Name;
+use PhpParser\Node\Stmt\GroupUse;
 use PhpParser\Node\Stmt\Use_;
 use PhpParser\Node\UseItem;
 use PHPUnit\Framework\TestCase;
@@ -20,6 +21,39 @@ public function testBareNameResolvesToCurrentNamespacePrefix(): void
         self::assertSame('App\\Containers\\Box', $ctx->resolveAgainstContext('Box'));
     }
 
+    public function testResolveNameHonorsAFullyQualifiedNodeDespiteAnAlias(): void
+    {
+        // A `\App\Box` node must resolve to `App\Box` — never alias-captured,
+        // never doubled with the current namespace (both are what flattening
+        // it with `toString()` used to produce).
+        $ctx = new NamespaceContext();
+        $ctx->enterNamespace('App');
+        $ctx->indexUse(self::makeUse('Other\\Box'));
+
+        self::assertSame('App\\Box', $ctx->resolveName(new Name\FullyQualified('App\\Box')));
+    }
+
+    public function testResolveNameBindsARelativeNodeToTheCurrentNamespaceDespiteAnAlias(): void
+    {
+        // `namespace\Box` binds to the CURRENT namespace by PHP's rules; the
+        // `use Other\Box` alias never applies to a relative name.
+        $ctx = new NamespaceContext();
+        $ctx->enterNamespace('App');
+        $ctx->indexUse(self::makeUse('Other\\Box'));
+
+        self::assertSame('App\\Box', $ctx->resolveName(new Name\Relative('Box')));
+    }
+
+    public function testResolveNamePlainNodeStillUsesTheAliasMap(): void
+    {
+        $ctx = new NamespaceContext();
+        $ctx->enterNamespace('App');
+        $ctx->indexUse(self::makeUse('Other\\Box'));
+
+        self::assertSame('Other\\Box', $ctx->resolveName(new Name('Box')));
+        self::assertSame('Other\\Box', $ctx->resolveName(new Identifier('Box')));
+    }
+
     public function testLeadingBackslashStripsAndShortCircuits(): void
     {
         $ctx = new NamespaceContext();
@@ -46,6 +80,54 @@ public function testUseAliasOverridesShortName(): void
         self::assertSame('Other\\Vendor\\LongName', $ctx->resolveAgainstContext('B'));
     }
 
+    public function testRelativeNamespaceNameBindsToCurrentNamespace(): void
+    {
+        // `namespace\Box` is PHP's explicit current-namespace reference; it
+        // must NOT fall into the bare-name path (which would produce the
+        // impossible `App\Containers\namespace\Box`).
+        $ctx = new NamespaceContext();
+        $ctx->enterNamespace('App\\Containers');
+
+        self::assertSame('App\\Containers\\Box', $ctx->resolveAgainstContext('namespace\\Box'));
+    }
+
+    public function testRelativeNamespaceNameIsNeverCapturedByAUseAlias(): void
+    {
+        // A colliding `use Other\Box` must not rewrite `namespace\Box` — PHP
+        // never applies aliases to relative references.
+        $ctx = new NamespaceContext();
+        $ctx->enterNamespace('App');
+        $ctx->indexUse(self::makeUse('Other\\Box'));
+
+        self::assertSame('App\\Box', $ctx->resolveAgainstContext('namespace\\Box'));
+    }
+
+    public function testRelativeNamespaceNameInGlobalNamespace(): void
+    {
+        $ctx = new NamespaceContext();
+
+        self::assertSame('Box', $ctx->resolveAgainstContext('namespace\\Box'));
+    }
+
+    public function testRelativeNamespaceKeywordIsCaseInsensitive(): void
+    {
+        $ctx = new NamespaceContext();
+        $ctx->enterNamespace('App');
+
+        self::assertSame('App\\Box', $ctx->resolveAgainstContext('NAMESPACE\\Box'));
+    }
+
+    public function testNameMerelyStartingWithNamespaceIsNotRelative(): void
+    {
+        // Only the exact `namespace\` keyword segment is relative —
+        // `Namespaced\Utils` is an ordinary (legal) class path and must take
+        // the bare-name route, keyword-prefix match notwithstanding.
+        $ctx = new NamespaceContext();
+        $ctx->enterNamespace('App');
+
+        self::assertSame('App\\Namespaced\\Utils', $ctx->resolveAgainstContext('Namespaced\\Utils'));
+    }
+
     public function testUseMapResolutionPreservesTailSegments(): void
     {
         $ctx = new NamespaceContext();
@@ -128,13 +210,235 @@ public function testIsImportedResetsWithNamespace(): void
         self::assertFalse($ctx->isImported('Box'));
     }
 
-    private static function makeUse(string $fqn, ?string $alias = null): Use_
+    public function testFunctionNameUnqualifiedBindsCurrentNamespace(): void
+    {
+        $ctx = new NamespaceContext();
+        $ctx->enterNamespace('App');
+
+        self::assertSame('App\\helper', $ctx->resolveFunctionName(new Name('helper')));
+    }
+
+    public function testFunctionNameUnqualifiedBindsUseFunctionImport(): void
+    {
+        $ctx = new NamespaceContext();
+        $ctx->enterNamespace('Lib');
+        $ctx->indexUse(self::makeUse('App\\helper', type: Use_::TYPE_FUNCTION));
+
+        self::assertSame('App\\helper', $ctx->resolveFunctionName(new Name('helper')));
+    }
+
+    public function testAClassImportNeverCapturesAFunctionCall(): void
+    {
+        // A class `use App\helper;` must NOT bind a `helper()` call — PHP keeps class
+        // and function symbol namespaces separate. Without a `use function`, the call
+        // binds the current namespace.
+        $ctx = new NamespaceContext();
+        $ctx->enterNamespace('Lib');
+        $ctx->indexUse(self::makeUse('App\\helper')); // class import
+
+        self::assertSame('Lib\\helper', $ctx->resolveFunctionName(new Name('helper')));
+    }
+
+    public function testFunctionNameFullyQualifiedAndRelativeAndQualified(): void
+    {
+        $ctx = new NamespaceContext();
+        $ctx->enterNamespace('App');
+        $ctx->indexUse(self::makeUse('Vendor\\Pkg', alias: 'V')); // namespace import
+
+        self::assertSame('Other\\f', $ctx->resolveFunctionName(new Name\FullyQualified('Other\\f')));
+        self::assertSame('App\\f', $ctx->resolveFunctionName(new Name\Relative('f')));
+        // Qualified: leading segment resolves via the class/namespace map, not function imports.
+        self::assertSame('Vendor\\Pkg\\f', $ctx->resolveFunctionName(new Name('V\\f')));
+        // Qualified with no matching import falls to the current namespace.
+        self::assertSame('App\\Sub\\f', $ctx->resolveFunctionName(new Name('Sub\\f')));
+        // A name merely STARTING with `namespace` is an ordinary qualified path, not the
+        // relative `namespace\` keyword — it must take the qualified route, not bind relative.
+        self::assertSame('App\\Namespaced\\f', $ctx->resolveFunctionName(new Name('Namespaced\\f')));
+    }
+
+    public function testConstNameUsesItsOwnImportMapSeparateFromFunctions(): void
+    {
+        $ctx = new NamespaceContext();
+        $ctx->enterNamespace('Lib');
+        $ctx->indexUse(self::makeUse('App\\FACTOR', type: Use_::TYPE_CONSTANT));
+        $ctx->indexUse(self::makeUse('App\\helper', type: Use_::TYPE_FUNCTION));
+
+        self::assertSame('App\\FACTOR', $ctx->resolveConstName(new Name('FACTOR')));
+        // A `use const` does not bind a function call, and vice-versa.
+        self::assertSame('Lib\\FACTOR', $ctx->resolveFunctionName(new Name('FACTOR')));
+        self::assertSame('Lib\\helper', $ctx->resolveConstName(new Name('helper')));
+    }
+
+    public function testMixedGroupItemTypesRouteToTheRightMaps(): void
+    {
+        // `use App\{function f, const C, D}` — item-level types partition the maps.
+        $ctx = new NamespaceContext();
+        $ctx->enterNamespace('Lib');
+        $ctx->indexUse(self::makeMultiTypedUse('App', [
+            ['name' => 'App\\f', 'type' => Use_::TYPE_FUNCTION],
+            ['name' => 'App\\C', 'type' => Use_::TYPE_CONSTANT],
+            ['name' => 'App\\D', 'type' => Use_::TYPE_NORMAL],
+        ]));
+
+        self::assertSame('App\\f', $ctx->resolveFunctionName(new Name('f')));
+        self::assertSame('App\\C', $ctx->resolveConstName(new Name('C')));
+        // The class item `D` is not a function/const import.
+        self::assertSame('Lib\\f2', $ctx->resolveFunctionName(new Name('f2')));
+    }
+
+    public function testFunctionAndConstMapsResetOnNamespaceChange(): void
+    {
+        $ctx = new NamespaceContext();
+        $ctx->enterNamespace('Lib');
+        $ctx->indexUse(self::makeUse('App\\helper', type: Use_::TYPE_FUNCTION));
+        self::assertSame('App\\helper', $ctx->resolveFunctionName(new Name('helper')));
+
+        $ctx->enterNamespace('Other');
+        self::assertSame('Other\\helper', $ctx->resolveFunctionName(new Name('helper')));
+    }
+
+    public function testIndexGroupUseFunctionImportsRouteToFunctionMap(): void
+    {
+        // `use function Vendor\{make, scale};` — statement-level FUNCTION type governs both members.
+        $ctx = new NamespaceContext();
+        $ctx->enterNamespace('App');
+        $ctx->indexGroupUse(self::makeGroupUse('Vendor', [
+            ['name' => 'make', 'alias' => null, 'type' => Use_::TYPE_UNKNOWN],
+            ['name' => 'scale', 'alias' => null, 'type' => Use_::TYPE_UNKNOWN],
+        ], Use_::TYPE_FUNCTION));
+
+        self::assertSame('Vendor\\make', $ctx->resolveFunctionName(new Name('make')));
+        self::assertSame('Vendor\\scale', $ctx->resolveFunctionName(new Name('scale')));
+        // A group `use function` must not leak into const resolution.
+        self::assertSame('App\\make', $ctx->resolveConstName(new Name('make')));
+    }
+
+    public function testIndexGroupUseMixedItemTypesRouteToTheRightMaps(): void
+    {
+        // `use Vendor\{function make, const RATE, Box};` — per-item types partition the maps.
+        $ctx = new NamespaceContext();
+        $ctx->enterNamespace('App');
+        $ctx->indexGroupUse(self::makeGroupUse('Vendor', [
+            ['name' => 'make', 'alias' => null, 'type' => Use_::TYPE_FUNCTION],
+            ['name' => 'RATE', 'alias' => null, 'type' => Use_::TYPE_CONSTANT],
+            ['name' => 'Box', 'alias' => null, 'type' => Use_::TYPE_NORMAL],
+        ], Use_::TYPE_UNKNOWN));
+
+        self::assertSame('Vendor\\make', $ctx->resolveFunctionName(new Name('make')));
+        self::assertSame('Vendor\\RATE', $ctx->resolveConstName(new Name('RATE')));
+        // The class item `Box` is neither a function nor a const import.
+        self::assertSame('App\\Box', $ctx->resolveFunctionName(new Name('Box')));
+        self::assertSame('App\\Box', $ctx->resolveConstName(new Name('Box')));
+    }
+
+    public function testIndexGroupUseHonoursMemberAlias(): void
+    {
+        // `use function Vendor\{make as mk};` binds the alias, not the member name.
+        $ctx = new NamespaceContext();
+        $ctx->enterNamespace('App');
+        $ctx->indexGroupUse(self::makeGroupUse('Vendor', [
+            ['name' => 'make', 'alias' => 'mk', 'type' => Use_::TYPE_UNKNOWN],
+        ], Use_::TYPE_FUNCTION));
+
+        self::assertSame('Vendor\\make', $ctx->resolveFunctionName(new Name('mk')));
+        // The un-aliased member name does not resolve to the import.
+        self::assertSame('App\\make', $ctx->resolveFunctionName(new Name('make')));
+    }
+
+    public function testIndexGroupUseClassImportRoutesToClassMapNotSymbolMaps(): void
+    {
+        // A plain class group-import `use Vendor\{Box, Crate};` is stored in the class/namespace
+        // useMap (so a relocated body re-qualifies it to the import target, exactly like a single
+        // `use Vendor\Box;`), but contributes NO callable/const alias — the separate-symbol-namespace
+        // invariant still holds.
+        $ctx = new NamespaceContext();
+        $ctx->enterNamespace('App');
+        $ctx->indexGroupUse(self::makeGroupUse('Vendor', [
+            ['name' => 'Box', 'alias' => null, 'type' => Use_::TYPE_UNKNOWN],
+            ['name' => 'Crate', 'alias' => null, 'type' => Use_::TYPE_UNKNOWN],
+        ], Use_::TYPE_NORMAL));
+
+        // Class map: the import target, and counts as imported.
+        self::assertSame('Vendor\\Box', $ctx->resolveName(new Name('Box')));
+        self::assertSame('Vendor\\Crate', $ctx->resolveName(new Name('Crate')));
+        self::assertTrue($ctx->isImported('Box'));
+        self::assertTrue($ctx->isImported('Crate'));
+        // Symbol maps: untouched — an unqualified function/const name still falls to the current ns.
+        self::assertSame('App\\Box', $ctx->resolveFunctionName(new Name('Box')));
+        self::assertSame('App\\Crate', $ctx->resolveConstName(new Name('Crate')));
+    }
+
+    public function testIndexGroupUseClassImportHonoursAliasInClassMap(): void
+    {
+        // `use Vendor\{Tool as T};` — the alias resolves to the import target in the class map.
+        $ctx = new NamespaceContext();
+        $ctx->enterNamespace('App');
+        $ctx->indexGroupUse(self::makeGroupUse('Vendor', [
+            ['name' => 'Tool', 'alias' => 'T', 'type' => Use_::TYPE_UNKNOWN],
+        ], Use_::TYPE_NORMAL));
+
+        self::assertSame('Vendor\\Tool', $ctx->resolveName(new Name('T')));
+        self::assertTrue($ctx->isImported('T'));
+        // The un-aliased member name is NOT imported.
+        self::assertSame('App\\Tool', $ctx->resolveName(new Name('Tool')));
+        self::assertFalse($ctx->isImported('Tool'));
+    }
+
+    public function testIndexGroupUseNamespaceImportResolvesQualifiedNames(): void
+    {
+        // `use Vendor\{Sub};` then `Sub\Thing` resolves through the class/namespace map — the case a
+        // class-only split would have missed.
+        $ctx = new NamespaceContext();
+        $ctx->enterNamespace('App');
+        $ctx->indexGroupUse(self::makeGroupUse('Vendor', [
+            ['name' => 'Sub', 'alias' => null, 'type' => Use_::TYPE_UNKNOWN],
+        ], Use_::TYPE_NORMAL));
+
+        self::assertSame('Vendor\\Sub\\Thing', $ctx->resolveName(new Name('Sub\\Thing')));
+        self::assertTrue($ctx->isImported('Sub'));
+    }
+
+    private static function makeUse(string $fqn, ?string $alias = null, int $type = Use_::TYPE_NORMAL): Use_
     {
         $useItem = new UseItem(
             new Name($fqn),
             $alias !== null ? new Identifier($alias) : null,
         );
-        return new Use_([$useItem]);
+        return new Use_([$useItem], type: $type);
+    }
+
+    /**
+     * A single group-style `Use_` whose items carry their own per-item type.
+     *
+     * @param list<array{name: string, type: int}> $entries
+     */
+    private static function makeMultiTypedUse(string $prefix, array $entries): Use_
+    {
+        $items = array_map(
+            static fn (array $e): UseItem => new UseItem(new Name($e['name']), null, $e['type']),
+            $entries,
+        );
+        // Statement type UNKNOWN so the per-item types govern (as a mixed group parses).
+        return new Use_($items, type: Use_::TYPE_UNKNOWN);
+    }
+
+    /**
+     * A `GroupUse` (`use PREFIX\{ ... }`). Each member name is the RELATIVE part; the
+     * per-item type governs a mixed group, else the statement type applies.
+     *
+     * @param list<array{name: string, alias: ?string, type: int}> $members
+     */
+    private static function makeGroupUse(string $prefix, array $members, int $type = Use_::TYPE_NORMAL): GroupUse
+    {
+        $items = array_map(
+            static fn (array $m): UseItem => new UseItem(
+                new Name($m['name']),
+                $m['alias'] !== null ? new Identifier($m['alias']) : null,
+                $m['type'],
+            ),
+            $members,
+        );
+        return new GroupUse(new Name($prefix), $items, $type);
     }
 
     /**
diff --git a/test/Transpiler/Monomorphize/QualifiedCallSiteIntegrationTest.php b/test/Transpiler/Monomorphize/QualifiedCallSiteIntegrationTest.php
new file mode 100644
index 0000000..85a2fe0
--- /dev/null
+++ b/test/Transpiler/Monomorphize/QualifiedCallSiteIntegrationTest.php
@@ -0,0 +1,64 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+use PHPUnit\Framework\Attributes\RunInSeparateProcess;
+use PHPUnit\Framework\TestCase;
+use XPHP\TestSupport\CompiledFixture;
+
+/**
+ * End-to-end pins for fully-qualified (`\App\Box`) and relative
+ * (`namespace\Box`) spellings at generic call sites — turbofish, empty
+ * turbofish, bare generic type hints, in-template references, and generic
+ * function calls. Every spelling must reach the same specialization as the
+ * bare form and the emitted program must run.
+ */
+final class QualifiedCallSiteIntegrationTest extends TestCase
+{
+    #[RunInSeparateProcess]
+    public function testQualifiedSpellingsSpecializeAndRun(): void
+    {
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/qualified_generic_call_sites/source',
+            'qualified-generic-call-sites',
+        );
+        $fixture->registerAutoload('App\\QualifiedCalls');
+        try {
+            require __DIR__ . '/../../fixture/compile/qualified_generic_call_sites/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testRelativeNamesInTemplatesBindToTheCurrentNamespaceAndRun(): void
+    {
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/relative_names_in_templates/source',
+            'relative-names-in-templates',
+        );
+        $fixture->registerAutoload('App\\RelativeTemplates', 'Other');
+        try {
+            require __DIR__ . '/../../fixture/compile/relative_names_in_templates/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+
+    #[RunInSeparateProcess]
+    public function testQualifiedBareNewsSynthesizeDefaultsAndRun(): void
+    {
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/qualified_bare_new_defaults/source',
+            'qualified-bare-new-defaults',
+        );
+        $fixture->registerAutoload('App\\QualifiedDefaults', 'Other');
+        try {
+            require __DIR__ . '/../../fixture/compile/qualified_bare_new_defaults/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+}
diff --git a/test/Transpiler/Monomorphize/RegistryBoundsDiagnosticTest.php b/test/Transpiler/Monomorphize/RegistryBoundsDiagnosticTest.php
index a7e28d3..0f113d0 100644
--- a/test/Transpiler/Monomorphize/RegistryBoundsDiagnosticTest.php
+++ b/test/Transpiler/Monomorphize/RegistryBoundsDiagnosticTest.php
@@ -39,8 +39,16 @@ public function testBoundViolationIsCollectedNotThrownWhenCollectorPresent(): vo
         self::assertSame(Registry::CODE_BOUND_VIOLATION, $d->code);
         self::assertSame(DiagnosticSource::Xphp, $d->source);
         self::assertSame($loc, $d->location);
-        self::assertStringContainsString('Generic bound violated', $d->message);
-        self::assertStringContainsString('"int" does not extend/implement "Stringable"', $d->message);
+        self::assertSame(
+            <<<'TXT'
+            Generic bound violated while instantiating App\Box<int>.
+              type parameter T is bounded by Stringable
+              but the supplied concrete type is int
+
+              "int" does not extend/implement "Stringable".
+            TXT,
+            $d->message,
+        );
 
         // Recording still completed (continue-safely): the instantiation is on file.
         self::assertCount(1, $registry->instantiations());
diff --git a/test/Transpiler/Monomorphize/RegistryCollectorFreeSymbolTest.php b/test/Transpiler/Monomorphize/RegistryCollectorFreeSymbolTest.php
new file mode 100644
index 0000000..b32dee4
--- /dev/null
+++ b/test/Transpiler/Monomorphize/RegistryCollectorFreeSymbolTest.php
@@ -0,0 +1,63 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+use PhpParser\ParserFactory;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * The definitions pass records free functions and free constants defined in the compilation
+ * unit (namespace-qualified) so the Specializer can re-qualify unqualified calls/fetches in a
+ * relocated template body only when the target is known. Class methods and class constants are
+ * different node types and must NOT be collected as free symbols.
+ */
+final class RegistryCollectorFreeSymbolTest extends TestCase
+{
+    public function testFreeFunctionsAndConstsAreCollectedButClassMembersAreNot(): void
+    {
+        $registry = new Registry();
+        $collector = new RegistryCollector($registry);
+
+        $ast = (new ParserFactory())->createForHostVersion()->parse(<<<'PHP'
+            <?php
+            namespace App;
+            function helper(int $x): int { return $x; }
+            const FACTOR = 10, SCALE = 2;
+            class Box {
+                const NOT_FREE = 1;
+                public function method(): void {}
+            }
+            PHP);
+        self::assertNotNull($ast);
+        $collector->collectDefinitions($ast, 'test.xphp');
+
+        self::assertTrue($registry->hasFunction('App\\helper'));
+        self::assertTrue($registry->hasConst('App\\FACTOR'));
+        self::assertTrue($registry->hasConst('App\\SCALE'), 'every const in a multi-const declaration');
+
+        // A class method is not a free function; a class constant is not a free constant.
+        self::assertFalse($registry->hasFunction('App\\method'));
+        self::assertFalse($registry->hasConst('App\\NOT_FREE'));
+        self::assertFalse($registry->hasConst('App\\Box\\NOT_FREE'));
+    }
+
+    public function testGlobalNamespaceFreeSymbolsAreCollectedWithoutPrefix(): void
+    {
+        $registry = new Registry();
+        $collector = new RegistryCollector($registry);
+
+        $ast = (new ParserFactory())->createForHostVersion()->parse(<<<'PHP'
+            <?php
+            function toplevel(): void {}
+            const TOP = 1;
+            PHP);
+        self::assertNotNull($ast);
+        $collector->collectDefinitions($ast, 'test.xphp');
+
+        self::assertTrue($registry->hasFunction('toplevel'));
+        self::assertTrue($registry->hasConst('TOP'));
+        self::assertFalse($registry->hasFunction('App\\toplevel'));
+    }
+}
diff --git a/test/Transpiler/Monomorphize/RegistryInnerVarianceTest.php b/test/Transpiler/Monomorphize/RegistryInnerVarianceTest.php
index 013304e..9b75293 100644
--- a/test/Transpiler/Monomorphize/RegistryInnerVarianceTest.php
+++ b/test/Transpiler/Monomorphize/RegistryInnerVarianceTest.php
@@ -150,7 +150,10 @@ public function testCollectModeGathersInnerVarianceDiagnosticInsteadOfThrowing()
 
         self::assertCount(1, $collector->all());
         self::assertSame(InnerVarianceValidator::CODE_INNER_VARIANCE, $collector->all()[0]->code);
-        self::assertStringContainsString('Variance violation in template P', $collector->all()[0]->message);
+        self::assertSame(
+            'Variance violation in template P: type-parameter out T appears in invariant-only position (via slot 0 of Container).',
+            $collector->all()[0]->message,
+        );
     }
 
     public function testCovariantOuterInInvariantInnerSlotIsRejected(): void
diff --git a/test/Transpiler/Monomorphize/RegistryTest.php b/test/Transpiler/Monomorphize/RegistryTest.php
index 28162f0..e9628ee 100644
--- a/test/Transpiler/Monomorphize/RegistryTest.php
+++ b/test/Transpiler/Monomorphize/RegistryTest.php
@@ -30,8 +30,8 @@ public function testDifferentTemplateNamespacesProduceDifferentFqns(): void
         $b = Registry::generatedFqn('App\\RegistryTest\\Other\\Box', [new TypeRef('App\\RegistryTest\\Models\\Plastic')]);
 
         self::assertNotSame($a, $b);
-        self::assertStringContainsString('App\\RegistryTest\\Containers\\Box', $a);
-        self::assertStringContainsString('App\\RegistryTest\\Other\\Box', $b);
+        self::assertStringStartsWith('XPHP\\Generated\\App\\RegistryTest\\Containers\\Box\\T_', $a);
+        self::assertStringStartsWith('XPHP\\Generated\\App\\RegistryTest\\Other\\Box\\T_', $b);
     }
 
     public function testDifferentArgsProduceDifferentHashes(): void
@@ -87,6 +87,49 @@ public function testDistinctTypesProduceDistinctEntries(): void
         }
     }
 
+    public function testFunctionMembershipIsCaseInsensitive(): void
+    {
+        $registry = new Registry();
+        $registry->recordFunction('App\\helper');
+
+        // Function names AND namespace segments are case-insensitive in PHP.
+        self::assertTrue($registry->hasFunction('App\\helper'));
+        self::assertTrue($registry->hasFunction('app\\HELPER'));
+        self::assertFalse($registry->hasFunction('App\\other'));
+        self::assertFalse($registry->hasFunction('Other\\helper'));
+    }
+
+    public function testConstMembershipHasCaseInsensitiveNamespaceButSensitiveShortName(): void
+    {
+        $registry = new Registry();
+        $registry->recordConst('App\\FACTOR');
+
+        // Namespace case-insensitive, const short-name case-sensitive.
+        self::assertTrue($registry->hasConst('App\\FACTOR'));
+        self::assertTrue($registry->hasConst('app\\FACTOR'));
+        self::assertFalse($registry->hasConst('App\\factor'));
+        self::assertFalse($registry->hasConst('App\\Factor'));
+    }
+
+    public function testGlobalFunctionAndConstMembership(): void
+    {
+        $registry = new Registry();
+        $registry->recordFunction('helper');
+        $registry->recordConst('FACTOR');
+
+        self::assertTrue($registry->hasFunction('HELPER'));
+        self::assertTrue($registry->hasConst('FACTOR'));
+        self::assertFalse($registry->hasConst('factor'));
+    }
+
+    public function testUnrecordedFunctionAndConstAreAbsent(): void
+    {
+        $registry = new Registry();
+
+        self::assertFalse($registry->hasFunction('App\\strlen'));
+        self::assertFalse($registry->hasConst('App\\PHP_EOL'));
+    }
+
     public function testRecordInstantiationRecursivelyRegistersNestedInstantiations(): void
     {
         $registry = new Registry();
@@ -257,7 +300,15 @@ public function testCollisionMessageSuggestsMaxWhenAlreadyAtHigherLength(): void
             self::fail('expected collision exception');
         } catch (\RuntimeException $e) {
             // 48 * 2 = 96, clamped to MAX (64)
-            self::assertStringContainsString('XPHP_HASH_LENGTH=64 bin/xphp compile', $e->getMessage());
+            $expected = "Hash collision detected while monomorphizing generics.\n\n"
+                . "Two distinct instantiations produced the same specialized FQCN:\n"
+                . "  existing : App\\RegistryTest\\Containers\\Box<App\\RegistryTest\\Models\\Plastic>\n"
+                . "  new      : App\\RegistryTest\\Containers\\Box<App\\RegistryTest\\Models\\Metal>\n"
+                . "  collision: {$collidingFqn}\n\n"
+                . "The current XPHP_HASH_LENGTH = 48 is too short for this codebase.\n"
+                . "Increase it (max 64, the full sha256 digest) and re-run, e.g.:\n\n"
+                . "    XPHP_HASH_LENGTH=64 bin/xphp compile <source> <target> <cache>\n";
+            self::assertSame($expected, $e->getMessage());
         }
     }
 
diff --git a/test/Transpiler/Monomorphize/RegistryVarianceEdgeDiagnosticTest.php b/test/Transpiler/Monomorphize/RegistryVarianceEdgeDiagnosticTest.php
index fd26f0c..0060c08 100644
--- a/test/Transpiler/Monomorphize/RegistryVarianceEdgeDiagnosticTest.php
+++ b/test/Transpiler/Monomorphize/RegistryVarianceEdgeDiagnosticTest.php
@@ -63,7 +63,16 @@ public function testContravariantOverUnprovableLeafIsWarnedWithInMarker(): void
         $this->registry($collector)->recordInstantiation('App\\Consumer', [new TypeRef('App\\Book')]);
 
         self::assertCount(1, $collector->all());
-        self::assertStringContainsString('type parameter in T is contravariant', $collector->all()[0]->message);
+        self::assertSame(
+            <<<'TXT'
+            Variance edge cannot be proven while instantiating App\Consumer<App\Book>.
+              type parameter in T is contravariant, but App\Book is not in the source set the hierarchy was built from (and is not a recognized PHP built-in),
+              so the compiler cannot prove its subtype edges — this specialization is not linked to related ones and the contravariant relationship silently does not apply at runtime.
+
+              Add App\Book to the source set the hierarchy is built from to enable the edge.
+            TXT,
+            $collector->all()[0]->message,
+        );
     }
 
     public function testProvableDeclaredLeafIsSilent(): void
@@ -138,7 +147,16 @@ public function testLeadingBackslashTemplateNameResolvesAndIsNormalisedInMessage
         $this->registry($collector)->recordInstantiation('\\App\\Producer', [new TypeRef('App\\Book')]);
 
         self::assertCount(1, $collector->all());
-        self::assertStringContainsString('instantiating App\\Producer<App\\Book>', $collector->all()[0]->message);
+        self::assertSame(
+            <<<'TXT'
+            Variance edge cannot be proven while instantiating App\Producer<App\Book>.
+              type parameter out T is covariant, but App\Book is not in the source set the hierarchy was built from (and is not a recognized PHP built-in),
+              so the compiler cannot prove its subtype edges — this specialization is not linked to related ones and the covariant relationship silently does not apply at runtime.
+
+              Add App\Book to the source set the hierarchy is built from to enable the edge.
+            TXT,
+            $collector->all()[0]->message,
+        );
     }
 
     public function testEarlierInvariantPositionDoesNotShortCircuitLaterVariant(): void
@@ -152,7 +170,16 @@ public function testEarlierInvariantPositionDoesNotShortCircuitLaterVariant(): v
         );
 
         self::assertCount(1, $collector->all());
-        self::assertStringContainsString('App\\Author', $collector->all()[0]->message);
+        self::assertSame(
+            <<<'TXT'
+            Variance edge cannot be proven while instantiating App\Mixed<App\Book, App\Author>.
+              type parameter out B is covariant, but App\Author is not in the source set the hierarchy was built from (and is not a recognized PHP built-in),
+              so the compiler cannot prove its subtype edges — this specialization is not linked to related ones and the covariant relationship silently does not apply at runtime.
+
+              Add App\Author to the source set the hierarchy is built from to enable the edge.
+            TXT,
+            $collector->all()[0]->message,
+        );
     }
 
     public function testEarlierScalarPositionDoesNotShortCircuitLaterVariant(): void
@@ -166,7 +193,16 @@ public function testEarlierScalarPositionDoesNotShortCircuitLaterVariant(): void
         );
 
         self::assertCount(1, $collector->all());
-        self::assertStringContainsString('App\\Book', $collector->all()[0]->message);
+        self::assertSame(
+            <<<'TXT'
+            Variance edge cannot be proven while instantiating App\Pair<int, App\Book>.
+              type parameter out B is covariant, but App\Book is not in the source set the hierarchy was built from (and is not a recognized PHP built-in),
+              so the compiler cannot prove its subtype edges — this specialization is not linked to related ones and the covariant relationship silently does not apply at runtime.
+
+              Add App\Book to the source set the hierarchy is built from to enable the edge.
+            TXT,
+            $collector->all()[0]->message,
+        );
     }
 
     public function testEarlierDeclaredPositionDoesNotShortCircuitLaterVariant(): void
@@ -180,7 +216,16 @@ public function testEarlierDeclaredPositionDoesNotShortCircuitLaterVariant(): vo
         );
 
         self::assertCount(1, $collector->all());
-        self::assertStringContainsString('App\\Book', $collector->all()[0]->message);
+        self::assertSame(
+            <<<'TXT'
+            Variance edge cannot be proven while instantiating App\Pair<App\Banana, App\Book>.
+              type parameter out B is covariant, but App\Book is not in the source set the hierarchy was built from (and is not a recognized PHP built-in),
+              so the compiler cannot prove its subtype edges — this specialization is not linked to related ones and the covariant relationship silently does not apply at runtime.
+
+              Add App\Book to the source set the hierarchy is built from to enable the edge.
+            TXT,
+            $collector->all()[0]->message,
+        );
     }
 
     public function testCompileModeNeverThrowsAndEmitsNothing(): void
diff --git a/test/Transpiler/Monomorphize/SpecializerClosureSignatureTest.php b/test/Transpiler/Monomorphize/SpecializerClosureSignatureTest.php
new file mode 100644
index 0000000..d5a8e25
--- /dev/null
+++ b/test/Transpiler/Monomorphize/SpecializerClosureSignatureTest.php
@@ -0,0 +1,141 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+use PHPUnit\Framework\TestCase;
+
+/**
+ * {@see Specializer::substituteClosureSignature} grounds a `Closure(...)` target's
+ * type-parameter leaves with their concrete types during specialization, while
+ * carrying every non-type-parameter leaf, structural flag, and gradual raw leaf
+ * through untouched. This is what turns `Closure(T $x): T` into
+ * `Closure(int $x): int` for the post-specialization conformance pass.
+ */
+final class SpecializerClosureSignatureTest extends TestCase
+{
+    public function testTypeParameterLeavesInParametersAndReturnAreSubstituted(): void
+    {
+        $sig = new ClosureSignature(
+            [new ClosureSignatureParam(new SigTypeRef(self::typeParam('T')))],
+            new SigTypeRef(self::typeParam('T')),
+        );
+
+        $grounded = Specializer::substituteClosureSignature($sig, ['T' => self::scalar('int')]);
+
+        self::assertSame('int', self::leafName($grounded->params[0]->type));
+        self::assertSame('int', self::leafName($grounded->return));
+    }
+
+    public function testNonTypeParameterLeavesAreUnchanged(): void
+    {
+        $sig = new ClosureSignature(
+            [new ClosureSignatureParam(new SigTypeRef(self::scalar('string')))],
+            new SigTypeRef(new TypeRef('App\\Fruit')),
+        );
+
+        $grounded = Specializer::substituteClosureSignature($sig, ['T' => self::scalar('int')]);
+
+        self::assertSame('string', self::leafName($grounded->params[0]->type));
+        self::assertSame('App\\Fruit', self::leafName($grounded->return));
+    }
+
+    public function testNestedClosureLeafIsSubstitutedRecursively(): void
+    {
+        // A parameter whose own type is `Closure(T): T` — the inner type parameter
+        // must ground too.
+        $inner = new ClosureSignature(
+            [new ClosureSignatureParam(new SigTypeRef(self::typeParam('T')))],
+            new SigTypeRef(self::typeParam('T')),
+        );
+        $sig = new ClosureSignature([new ClosureSignatureParam(new SigClosure($inner))], null);
+
+        $grounded = Specializer::substituteClosureSignature($sig, ['T' => self::scalar('int')]);
+
+        $outerParam = $grounded->params[0]->type;
+        self::assertInstanceOf(SigClosure::class, $outerParam);
+        self::assertSame('int', self::leafName($outerParam->signature->params[0]->type));
+        self::assertSame('int', self::leafName($outerParam->signature->return));
+    }
+
+    public function testTypeParameterInsideUnionMemberIsSubstituted(): void
+    {
+        // Closure(T|int $x) grounds the T member alongside the concrete int member.
+        $sig = new ClosureSignature(
+            [new ClosureSignatureParam(new SigUnion([
+                new SigTypeRef(self::typeParam('T')),
+                new SigTypeRef(self::scalar('int')),
+            ]))],
+            null,
+        );
+
+        $grounded = Specializer::substituteClosureSignature($sig, ['T' => new TypeRef('App\\Apple')]);
+
+        $param = $grounded->params[0]->type;
+        self::assertInstanceOf(SigUnion::class, $param);
+        self::assertSame('App\\Apple', self::leafName($param->members[0]));
+        self::assertSame('int', self::leafName($param->members[1]));
+    }
+
+    public function testTypeParameterInsideIntersectionMemberIsSubstituted(): void
+    {
+        $sig = new ClosureSignature([], new SigIntersection([
+            new SigTypeRef(self::typeParam('T')),
+            new SigTypeRef(new TypeRef('App\\Countable')),
+        ]));
+
+        $grounded = Specializer::substituteClosureSignature($sig, ['T' => new TypeRef('App\\Apple')]);
+
+        $ret = $grounded->return;
+        self::assertInstanceOf(SigIntersection::class, $ret);
+        self::assertSame('App\\Apple', self::leafName($ret->members[0]));
+        self::assertSame('App\\Countable', self::leafName($ret->members[1]));
+    }
+
+    public function testRawLeafIsCarriedThroughUnchanged(): void
+    {
+        $raw = new SigRaw('int|string');
+        $sig = new ClosureSignature([new ClosureSignatureParam($raw)], null);
+
+        $grounded = Specializer::substituteClosureSignature($sig, ['T' => self::scalar('int')]);
+
+        self::assertSame($raw, $grounded->params[0]->type, 'a gradual raw leaf is untouched');
+    }
+
+    public function testStructuralFlagsAndNullabilityArePreserved(): void
+    {
+        $sig = new ClosureSignature(
+            [
+                new ClosureSignatureParam(new SigTypeRef(self::typeParam('T')), byRef: true),
+                new ClosureSignatureParam(new SigTypeRef(self::scalar('int')), variadic: true),
+            ],
+            null,
+            nullable: true,
+        );
+
+        $grounded = Specializer::substituteClosureSignature($sig, ['T' => self::scalar('int')]);
+
+        self::assertTrue($grounded->params[0]->byRef);
+        self::assertTrue($grounded->params[1]->variadic);
+        self::assertTrue($grounded->nullable);
+        self::assertNull($grounded->return, 'an absent return stays absent');
+    }
+
+    // ---- Helpers ---------------------------------------------------------
+
+    private static function typeParam(string $name): TypeRef
+    {
+        return new TypeRef($name, [], isScalar: false, isTypeParam: true);
+    }
+
+    private static function scalar(string $name): TypeRef
+    {
+        return new TypeRef($name, [], isScalar: true);
+    }
+
+    private static function leafName(?SigType $type): ?string
+    {
+        return $type instanceof SigTypeRef ? $type->type->name : null;
+    }
+}
diff --git a/test/Transpiler/Monomorphize/SpecializerMethodGenericArgsTest.php b/test/Transpiler/Monomorphize/SpecializerMethodGenericArgsTest.php
new file mode 100644
index 0000000..41b5ff9
--- /dev/null
+++ b/test/Transpiler/Monomorphize/SpecializerMethodGenericArgsTest.php
@@ -0,0 +1,82 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+use PhpParser\Node\Arg;
+use PhpParser\Node\Expr\FuncCall;
+use PhpParser\Node\Expr\Variable;
+use PhpParser\Node\Param;
+use PhpParser\Node\Stmt\Function_;
+use PhpParser\Node\Stmt\Return_;
+use PhpParser\NodeFinder;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * When a generic template specializes, an inner variable-turbofish call
+ * (`$inner::<S>(...)`) inside its body carries the enclosing type parameter in
+ * ATTR_METHOD_GENERIC_ARGS. {@see Specializer::specializeFunction} must ground those
+ * recorded type arguments (`S` → `int`) so the per-specialization closure-grounding pass
+ * sees `$inner::<int>` rather than the abstract `$inner::<S>` — otherwise the inner
+ * closure keeps a raw hint and fatals at runtime.
+ *
+ * This substitution is end-to-end inert on its own (nothing consumes the grounded args
+ * until the re-entry pass lands); the assertion is on the recorded attribute directly.
+ */
+final class SpecializerMethodGenericArgsTest extends TestCase
+{
+    public function testInnerTurbofishArgsAreGroundedOnFunctionSpecialization(): void
+    {
+        $call = new FuncCall(new Variable('inner'), [new Arg(new Variable('v'))]);
+        $call->setAttribute(
+            XphpSourceParser::ATTR_METHOD_GENERIC_ARGS,
+            [new TypeRef('S', [], isScalar: false, isTypeParam: true)],
+        );
+        $template = new Function_('relay', [
+            'params' => [new Param(new Variable('v'))],
+            'stmts'  => [new Return_($call)],
+        ]);
+
+        $specialized = (new Specializer())->specializeFunction(
+            $template,
+            ['S' => new TypeRef('int', [], isScalar: true)],
+            'relay_T_int',
+        );
+
+        $calls = (new NodeFinder())->findInstanceOf($specialized, FuncCall::class);
+        self::assertCount(1, $calls);
+        $grounded = $calls[0]->getAttribute(XphpSourceParser::ATTR_METHOD_GENERIC_ARGS);
+        self::assertIsArray($grounded);
+        self::assertCount(1, $grounded);
+        self::assertInstanceOf(TypeRef::class, $grounded[0]);
+        self::assertSame('int', $grounded[0]->name);
+        self::assertFalse($grounded[0]->isTypeParam, 'the grounded arg is concrete, not a type parameter');
+    }
+
+    public function testConcreteInnerTurbofishArgsSurviveSpecializationUnchanged(): void
+    {
+        // An inner turbofish already concrete (`$inner::<int>`) is not a type param of the
+        // enclosing template, so substitution leaves it exactly as-is.
+        $call = new FuncCall(new Variable('inner'), [new Arg(new Variable('v'))]);
+        $call->setAttribute(
+            XphpSourceParser::ATTR_METHOD_GENERIC_ARGS,
+            [new TypeRef('int', [], isScalar: true)],
+        );
+        $template = new Function_('keep', [
+            'params' => [new Param(new Variable('v'))],
+            'stmts'  => [new Return_($call)],
+        ]);
+
+        $specialized = (new Specializer())->specializeFunction(
+            $template,
+            ['S' => new TypeRef('string', [], isScalar: true)],
+            'keep_T_string',
+        );
+
+        $calls = (new NodeFinder())->findInstanceOf($specialized, FuncCall::class);
+        $grounded = $calls[0]->getAttribute(XphpSourceParser::ATTR_METHOD_GENERIC_ARGS);
+        self::assertIsArray($grounded);
+        self::assertSame('int', $grounded[0]->name);
+    }
+}
diff --git a/test/Transpiler/Monomorphize/TypeHierarchyTest.php b/test/Transpiler/Monomorphize/TypeHierarchyTest.php
index 37fa461..38cd193 100644
--- a/test/Transpiler/Monomorphize/TypeHierarchyTest.php
+++ b/test/Transpiler/Monomorphize/TypeHierarchyTest.php
@@ -21,6 +21,15 @@ public function testBuiltinInterfaceIsItsOwnSubtype(): void
         self::assertTrue($hierarchy->isSubtype('Stringable', 'Stringable'));
     }
 
+    public function testIsBuiltinRecognisesBuiltinsAndStripsLeadingBackslash(): void
+    {
+        $hierarchy = new TypeHierarchy([]);
+        self::assertTrue($hierarchy->isBuiltin('Throwable'));
+        self::assertTrue($hierarchy->isBuiltin('\\Throwable'), 'a leading-backslash builtin still matches');
+        self::assertFalse($hierarchy->isBuiltin('App\\Throwable'), 'a namespaced look-alike is not the builtin');
+        self::assertFalse($hierarchy->isBuiltin('App\\Fruit'));
+    }
+
     public function testUnknownConcreteTypeReturnsNull(): void
     {
         // Reject-by-uncertainty: caller can't prove SomeRandomClass satisfies anything because
@@ -107,6 +116,70 @@ public function testLeadingBackslashIsNormalised(): void
         self::assertTrue($hierarchy->isSubtype('\\App\\Bar', '\\Stringable'));
     }
 
+    public function testFromAstPerFileCollectsEnumClausesAndImplicitEdges(): void
+    {
+        // An enum's `implements` clauses AND PHP's implicit edges must be
+        // modeled: every enum is a UnitEnum, a backed enum also a BackedEnum.
+        // Without them an enum masquerades as a parentless plain class and
+        // closed-world reasoning would falsely prove it unrelated to built-in
+        // interfaces it genuinely implements at runtime.
+        $parser = (new ParserFactory())->createForHostVersion();
+        $src = <<<'PHP'
+<?php
+namespace App;
+
+enum Pure implements \Countable
+{
+    case A;
+    public function count(): int { return 1; }
+}
+
+enum Backed: string
+{
+    case A = 'a';
+}
+PHP;
+        $ast = $parser->parse($src);
+        self::assertNotNull($ast);
+
+        $hierarchy = TypeHierarchy::fromAstPerFile(['/x.php' => $ast]);
+
+        self::assertTrue($hierarchy->isSubtype('App\\Pure', 'Countable'), 'enum implements clause collected');
+        self::assertTrue($hierarchy->isSubtype('App\\Pure', 'UnitEnum'), 'every enum is a UnitEnum');
+        self::assertNotTrue($hierarchy->isSubtype('App\\Pure', 'BackedEnum'), 'a pure enum is NOT a BackedEnum');
+        self::assertTrue($hierarchy->isSubtype('App\\Backed', 'UnitEnum'));
+        self::assertTrue($hierarchy->isSubtype('App\\Backed', 'BackedEnum'), 'a backed enum is a BackedEnum');
+    }
+
+    public function testHasClosedUserAncestryRequiresFullyModeledBuiltinFreeChain(): void
+    {
+        $parser = (new ParserFactory())->createForHostVersion();
+        $src = <<<'PHP'
+<?php
+namespace App;
+
+class Plain extends Base {}
+class Base {}
+class OpenAncestor extends Unknown {}
+class ViaBuiltin implements \Countable {}
+class MysteryIface implements SomethingUndeclared {}
+enum E { case A; }
+PHP;
+        $ast = $parser->parse($src);
+        self::assertNotNull($ast);
+
+        $hierarchy = TypeHierarchy::fromAstPerFile(['/x.php' => $ast]);
+
+        self::assertTrue($hierarchy->hasClosedUserAncestry('App\\Plain'), 'fully-modeled user chain is closed');
+        self::assertTrue($hierarchy->hasClosedUserAncestry('\\App\\Plain'), 'leading backslash tolerated');
+        self::assertFalse($hierarchy->hasClosedUserAncestry('App\\OpenAncestor'), 'an unknown ancestor opens the world');
+        self::assertFalse($hierarchy->hasClosedUserAncestry('App\\ViaBuiltin'), 'a built-in in the chain opens the world');
+        self::assertFalse($hierarchy->hasClosedUserAncestry('App\\MysteryIface'), 'an undeclared interface opens the world');
+        self::assertFalse($hierarchy->hasClosedUserAncestry('App\\E'), 'an enum carries built-in edges (UnitEnum)');
+        self::assertFalse($hierarchy->hasClosedUserAncestry('App\\NotDeclared'), 'an unknown class is never closed');
+        self::assertFalse($hierarchy->hasClosedUserAncestry('Throwable'), 'a built-in itself is never closed');
+    }
+
     public function testFromAstPerFileCollectsClassExtendsImplements(): void
     {
         $parser = (new ParserFactory())->createForHostVersion();
diff --git a/test/Transpiler/Monomorphize/UseImportGenericClauseTest.php b/test/Transpiler/Monomorphize/UseImportGenericClauseTest.php
new file mode 100644
index 0000000..af3e50f
--- /dev/null
+++ b/test/Transpiler/Monomorphize/UseImportGenericClauseTest.php
@@ -0,0 +1,211 @@
+<?php
+
+declare(strict_types=1);
+
+namespace XPHP\Transpiler\Monomorphize;
+
+use PhpParser\ParserFactory;
+use PhpParser\PrettyPrinter\Standard as StandardPrinter;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\Attributes\RunInSeparateProcess;
+use PHPUnit\Framework\TestCase;
+use RuntimeException;
+use XPHP\Diagnostics\DiagnosticCollector;
+use XPHP\FileSystem\FileFinder\NativeFileFinder;
+use XPHP\FileSystem\FilepathArray;
+use XPHP\FileSystem\FileReader\NativeFileReader;
+use XPHP\FileSystem\FileWriter\NativeFileWriter;
+use XPHP\TestSupport\CompiledFixture;
+
+/**
+ * A generic clause on a namespace-import `use` (`use App\Box<int>;`, aliased, `use const`,
+ * grouped, or the clause-on-prefix `use App<int>\{…}`) has no valid xphp meaning. Left alone
+ * the single/aliased/const forms mis-blamed a double-qualified phantom template (`Main\App\Box`)
+ * at a null line, and the grouped form emitted an absolute specialized name inside a `use N\{…}`
+ * prefix group — unparseable PHP produced silently, escaping the check gate. Each form now
+ * rejects with ONE diagnostic naming the real symbol at the import's real line, in both
+ * `check` (collected) and `compile` (thrown). Ordinary imports and generic **trait-use**
+ * (a `Stmt\TraitUse`, a different node) are unaffected.
+ */
+final class UseImportGenericClauseTest extends TestCase
+{
+    /**
+     * @return iterable<string, array{string, string, int}>
+     */
+    public static function rejectedForms(): iterable
+    {
+        // fixture => [expected-symbol-in-message, offending line]
+        yield 'single'          => ['use_generic_import_single', 'App\\Box', 7];
+        yield 'aliased'         => ['use_generic_import_aliased', 'App\\Box', 7];
+        yield 'const'           => ['use_generic_import_const', 'App\\BOX', 7];
+        yield 'grouped member'  => ['use_generic_import_grouped', 'App\\Box', 7];
+        yield 'grouped prefix'  => ['use_generic_import_grouped_prefix', 'App', 7];
+    }
+
+    #[DataProvider('rejectedForms')]
+    public function testCheckRejectsGenericClauseOnImportWithRightSymbolAndLine(
+        string $fixture,
+        string $symbol,
+        int $line,
+    ): void {
+        $diagnostics = $this->check($fixture);
+
+        self::assertCount(1, $diagnostics->all());
+        $d = $diagnostics->all()[0];
+        self::assertSame(Compiler::CODE_PARSE_ERROR, $d->code);
+        // Names the source spelling, never the requalified phantom (`Main\App\Box`).
+        self::assertSame(
+            sprintf(
+                'A generic clause is not allowed on a `use` import. Import the template with a '
+                . 'plain `use %s;` and apply the type arguments at the use site (the hint '
+                . '`%s<...>` or the call `%s::<...>()`).',
+                $symbol,
+                $symbol,
+                $symbol,
+            ),
+            $d->message,
+        );
+        self::assertStringNotContainsString('Main\\App', $d->message);
+        self::assertNotNull($d->location);
+        self::assertSame($line, $d->location->line);
+    }
+
+    public function testMessageNamesTheSymbolAndBothUseSiteForms(): void
+    {
+        // Pin the full message so a reordered or truncated build is caught (the parts are
+        // otherwise only substring-checked): it names the source symbol and shows both the
+        // hint and the turbofish-call use-site forms.
+        $d = $this->check('use_generic_import_single')->all()[0];
+
+        self::assertSame(
+            'A generic clause is not allowed on a `use` import. Import the template with a '
+            . 'plain `use App\\Box;` and apply the type arguments at the use site (the hint '
+            . '`App\\Box<...>` or the call `App\\Box::<...>()`).',
+            $d->message,
+        );
+    }
+
+    public function testAClauselessImportSharingASpellingIsNotRejected(): void
+    {
+        // Two imports of the SAME qualified name via distinct aliases (`use App\Box as B1;`
+        // then `use App\Box<int> as B2;`): the clause-less first import must NOT be rejected.
+        // Matching is byte-exact, not by spelling alone — a name-only match would cross-fire
+        // and blame the wrong (clause-less) import. Exactly one diagnostic, at the
+        // clause-bearing import (line 9), naming `App\Box`.
+        $diagnostics = $this->check('use_generic_import_shadowed_name');
+
+        self::assertCount(1, $diagnostics->all());
+        $d = $diagnostics->all()[0];
+        self::assertSame(Compiler::CODE_PARSE_ERROR, $d->code);
+        self::assertNotNull($d->location);
+        self::assertSame(9, $d->location->line);
+        self::assertSame(
+            'A generic clause is not allowed on a `use` import. Import the template with a '
+            . 'plain `use App\\Box;` and apply the type arguments at the use site (the hint '
+            . '`App\\Box<...>` or the call `App\\Box::<...>()`).',
+            $d->message,
+        );
+    }
+
+    public function testCompileThrowsOnGenericClauseImport(): void
+    {
+        // Compile mode: XphpParseException (a RuntimeException) propagates out of parse()
+        // before any emit — the grouped silent fatal can no longer reach the writer.
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessage('not allowed on a `use` import');
+        $this->compileFixture('use_generic_import_grouped');
+    }
+
+    public function testOrdinaryImportIsUnaffected(): void
+    {
+        self::assertSame([], $this->check('use_ordinary_import_clean')->all());
+    }
+
+    public function testGroupedImportWithoutClauseIsUnaffected(): void
+    {
+        self::assertSame([], $this->check('use_grouped_import_clean')->all());
+    }
+
+    #[RunInSeparateProcess]
+    public function testGenericTraitUseStillSpecializesAndRuns(): void
+    {
+        // The must-keep guard: a generic trait-use is a Stmt\TraitUse, never a Stmt\Use_/
+        // GroupUse, so the import reject never sees it. It still specializes, emits valid
+        // PHP, and executes end-to-end.
+        $fixture = CompiledFixture::compile(
+            __DIR__ . '/../../fixture/compile/use_trait_generic/source',
+            'use-trait-generic',
+        );
+        try {
+            $fixture->registerAutoload('App\\UseTraitGeneric');
+            require __DIR__ . '/../../fixture/compile/use_trait_generic/verify/runtime.php';
+        } finally {
+            $fixture->cleanup();
+        }
+    }
+
+    private function check(string $fixture): DiagnosticCollector
+    {
+        return $this->buildCompiler()->check($this->sources($fixture));
+    }
+
+    private function compileFixture(string $fixture): void
+    {
+        $work = sys_get_temp_dir() . '/xphp-useimport-' . uniqid('', true);
+        mkdir($work, 0o755, true);
+        try {
+            $this->buildCompiler()->compile(
+                $this->sources($fixture),
+                $this->sourceDir($fixture),
+                $work . '/dist',
+                $work . '/cache',
+            );
+        } finally {
+            self::rrmdir($work);
+        }
+    }
+
+    private function sources(string $fixture): FilepathArray
+    {
+        return (new NativeFileFinder())
+            ->find($this->sourceDir($fixture))
+            ->filter(static fn (string $f): bool => str_ends_with($f, '.xphp'));
+    }
+
+    private function sourceDir(string $fixture): string
+    {
+        return realpath(__DIR__ . '/../../fixture/check/' . $fixture . '/source')
+            ?: throw new RuntimeException("Fixture missing: {$fixture}");
+    }
+
+    private static function rrmdir(string $dir): void
+    {
+        if (!is_dir($dir)) {
+            return;
+        }
+        foreach (scandir($dir) ?: [] as $entry) {
+            if ($entry === '.' || $entry === '..') {
+                continue;
+            }
+            $path = $dir . '/' . $entry;
+            is_dir($path) ? self::rrmdir($path) : unlink($path);
+        }
+        rmdir($dir);
+    }
+
+    private function buildCompiler(): Compiler
+    {
+        $phpParser = (new ParserFactory())->createForHostVersion();
+        $printer = new StandardPrinter();
+        $writer = new NativeFileWriter();
+
+        return new Compiler(
+            new NativeFileReader(),
+            $writer,
+            new XphpSourceParser($phpParser),
+            new Specializer(),
+            new SpecializedClassGenerator($printer, $writer),
+            $printer,
+        );
+    }
+}
diff --git a/test/Transpiler/Monomorphize/VariancePositionPhaseTest.php b/test/Transpiler/Monomorphize/VariancePositionPhaseTest.php
index 9c1bb9c..feeda9e 100644
--- a/test/Transpiler/Monomorphize/VariancePositionPhaseTest.php
+++ b/test/Transpiler/Monomorphize/VariancePositionPhaseTest.php
@@ -20,25 +20,25 @@
 final class VariancePositionPhaseTest extends TestCase
 {
     /**
-     * @return iterable<string, array{string, list<string>}>
+     * @return iterable<string, array{string, string}>
      */
     public static function rejectedSources(): iterable
     {
         yield 'covariant in method parameter' => [
             "<?php\nnamespace App;\nclass Producer<out T>\n{\n    public function set(T \$x): void {}\n}\n",
-            ['out T', 'method parameter'],
+            'Generic parameter `out T` appears in method parameter position, which is not allowed for covariant variance.',
         ];
         yield 'contravariant in method return' => [
             "<?php\nnamespace App;\nclass Consumer<in T>\n{\n    public function get(): T { throw new \\LogicException; }\n}\n",
-            ['in T', 'method return'],
+            'Generic parameter `in T` appears in method return position, which is not allowed for contravariant variance.',
         ];
         yield 'covariant in mutable property' => [
             "<?php\nnamespace App;\nclass Producer<out T>\n{\n    public T \$item;\n}\n",
-            ['mutable property'],
+            'Generic parameter `out T` appears in mutable property position, which is not allowed for covariant variance.',
         ];
         yield 'covariant in readonly property' => [
             "<?php\nnamespace App;\nclass Producer<out T>\n{\n    public readonly T \$item;\n    public function get(): T { return \$this->item; }\n}\n",
-            ['readonly property'],
+            'Generic parameter `out T` appears in readonly property position, which is not allowed for covariant variance.',
         ];
         // NOTE: a NESTED type-param in a bound (`out T : Box<T>`) is owned by the composing
         // inner-variance pass, not this direct-position pass — see
@@ -48,7 +48,7 @@ public static function rejectedSources(): iterable
         // supported method-level `contains<U : E>` shape, where U is a *method* type parameter.)
         yield 'covariant in sibling bare bound' => [
             "<?php\nnamespace App;\nclass Pair<out T, U : T>\n{\n    public function get(): T { throw new \\LogicException; }\n}\n",
-            ['bound'],
+            'Generic parameter `out T` appears inside the bound of generic parameter `U`, which is not allowed for covariant variance.',
         ];
         // NOTE: `out T` in a *non-promoted* constructor parameter of a variant class is
         // ALLOWED — a constructor parameter is variance-exempt (constructors aren't
@@ -58,7 +58,7 @@ public static function rejectedSources(): iterable
         // strictly invariant (a `T`-typed property would PHP-fatal across the chain):
         yield 'covariant in promoted constructor property' => [
             "<?php\nnamespace App;\nclass Producer<out T>\n{\n    public function __construct(public T \$item) {}\n}\n",
-            ['constructor parameter'],
+            'Generic parameter `out T` appears in constructor parameter position, which is not allowed for covariant variance.',
         ];
         // A *protected* property/promoted property is also a visible property (PHP
         // enforces invariant types across the chain for it), so it stays rejected —
@@ -66,11 +66,11 @@ public static function rejectedSources(): iterable
         // mutant that swaps the visibility bit for PROTECTED.
         yield 'covariant in protected promoted constructor property' => [
             "<?php\nnamespace App;\nclass Producer<out T>\n{\n    public function __construct(protected T \$item) {}\n}\n",
-            ['constructor parameter'],
+            'Generic parameter `out T` appears in constructor parameter position, which is not allowed for covariant variance.',
         ];
         yield 'covariant in protected mutable property' => [
             "<?php\nnamespace App;\nclass Producer<out T>\n{\n    protected T \$item;\n}\n",
-            ['mutable property'],
+            'Generic parameter `out T` appears in mutable property position, which is not allowed for covariant variance.',
         ];
         // Asymmetric visibility (PHP 8.4): a `public private(set)` property is
         // externally *readable* through an upcast reference (PRIVATE_SET sets a
@@ -79,45 +79,45 @@ public static function rejectedSources(): iterable
         // pin the PRIVATE-bit detection against a mutant that swaps it for PRIVATE_SET.
         yield 'covariant in public private(set) promoted constructor property' => [
             "<?php\nnamespace App;\nclass Producer<out T>\n{\n    public function __construct(public private(set) T \$item) {}\n}\n",
-            ['constructor parameter'],
+            'Generic parameter `out T` appears in constructor parameter position, which is not allowed for covariant variance.',
         ];
         yield 'covariant in public private(set) declared property' => [
             "<?php\nnamespace App;\nclass Producer<out T>\n{\n    public private(set) T \$item;\n}\n",
-            ['mutable property'],
+            'Generic parameter `out T` appears in mutable property position, which is not allowed for covariant variance.',
         ];
         yield 'covariant in nested closure parameter' => [
             "<?php\nnamespace App;\nclass Producer<out T>\n{\n    public function emit(): array\n    {\n        \$f = function (T \$x) {};\n        return [];\n    }\n}\n",
-            ['nested closure/arrow parameter'],
+            'Generic parameter `out T` appears in nested closure/arrow parameter position, which is not allowed for covariant variance.',
         ];
         yield 'contravariant in nested arrow return' => [
             "<?php\nnamespace App;\nclass Consumer<in T>\n{\n    public function pipe(): array\n    {\n        \$f = fn (): T => null;\n        return [];\n    }\n}\n",
-            ['nested closure/arrow return'],
+            'Generic parameter `in T` appears in nested closure/arrow return position, which is not allowed for contravariant variance.',
         ];
         // NOTE: a NESTED type-param in a method parameter/return (`Box<T>`) is owned by the
         // composing inner-variance pass — see testNestedTypeParamIsRejectedByTheComposingPass.
         yield 'interface method signature' => [
             "<?php\nnamespace App;\ninterface Producer<out T>\n{\n    public function feed(T \$x): void;\n}\n",
-            ['out T'],
+            'Generic parameter `out T` appears in method parameter position, which is not allowed for covariant variance.',
         ];
         // A by-reference parameter is read AND written back, so it is an
         // invariant position — neither +T nor -T is allowed there.
         yield 'contravariant in by-reference parameter' => [
             "<?php\nnamespace App;\nclass Consumer<in T>\n{\n    public function swap(T &\$x): void {}\n}\n",
-            ['in T', 'by-reference parameter'],
+            'Generic parameter `in T` appears in by-reference parameter position, which is not allowed for contravariant variance.',
         ];
         yield 'covariant in by-reference parameter' => [
             "<?php\nnamespace App;\nclass Producer<out T>\n{\n    public function swap(T &\$x): void {}\n}\n",
-            ['out T', 'by-reference parameter'],
+            'Generic parameter `out T` appears in by-reference parameter position, which is not allowed for covariant variance.',
         ];
         yield 'contravariant in nested closure by-reference parameter' => [
             "<?php\nnamespace App;\nclass Consumer<in T>\n{\n    public function pipe(): array\n    {\n        \$f = function (T &\$x) {};\n        return [];\n    }\n}\n",
-            ['by-reference parameter'],
+            'Generic parameter `in T` appears in by-reference parameter position, which is not allowed for contravariant variance.',
         ];
         // A variant class can't be `final`: its specializations are linked by
         // real `extends` edges, which a `final` class can't anchor.
         yield 'final variant class' => [
             "<?php\nnamespace App;\nfinal class Producer<out T>\n{\n    public function get(): T { throw new \\LogicException; }\n}\n",
-            ['cannot be declared `final`'],
+            'A variant class cannot be declared `final`: its specializations participate in `extends` subtype edges that a `final` class cannot anchor. Remove `final`.',
         ];
     }
 
@@ -157,11 +157,8 @@ public static function allowedSources(): iterable
         ];
     }
 
-    /**
-     * @param list<string> $fragments
-     */
     #[DataProvider('rejectedSources')]
-    public function testVariancePositionIsRejectedInCompileMode(string $source, array $fragments): void
+    public function testVariancePositionIsRejectedInCompileMode(string $source, string $expectedMessage): void
     {
         $registry = $this->registryFor($source);
 
@@ -169,9 +166,7 @@ public function testVariancePositionIsRejectedInCompileMode(string $source, arra
             $registry->validateVariancePositions();
             self::fail('expected a variance-position violation');
         } catch (RuntimeException $e) {
-            foreach ($fragments as $fragment) {
-                self::assertStringContainsString($fragment, $e->getMessage());
-            }
+            self::assertSame($expectedMessage, $e->getMessage());
         }
     }
 
@@ -183,10 +178,9 @@ public function testVariancePositionIsRejectedInCompileMode(string $source, arra
      * into type-constructor args, so these are reported by `validateInnerVariance` with the composing
      * "via slot N of …" message — never double-reported by both passes.
      *
-     * @param list<string> $fragments
      */
     #[DataProvider('nestedComposingRejections')]
-    public function testNestedTypeParamIsRejectedByTheComposingPass(string $source, array $fragments): void
+    public function testNestedTypeParamIsRejectedByTheComposingPass(string $source, string $expectedMessage): void
     {
         $registry = $this->registryFor($source);
         // The direct-position pass must stay SILENT on a purely-nested violation (no double-report).
@@ -196,28 +190,26 @@ public function testNestedTypeParamIsRejectedByTheComposingPass(string $source,
             $registry->validateInnerVariance();
             self::fail('expected an inner-variance composition violation');
         } catch (RuntimeException $e) {
-            foreach ($fragments as $fragment) {
-                self::assertStringContainsString($fragment, $e->getMessage());
-            }
+            self::assertSame($expectedMessage, $e->getMessage());
         }
     }
 
     /**
-     * @return iterable<string, array{string, list<string>}>
+     * @return iterable<string, array{string, string}>
      */
     public static function nestedComposingRejections(): iterable
     {
         yield 'covariant nested in method parameter' => [
             "<?php\nnamespace App;\nclass Producer<out T>\n{\n    public function set(Box<T> \$x): void {}\n}\n",
-            ['out T', 'invariant-only position', 'via slot 0 of'],
+            'Variance violation in template Producer: type-parameter out T appears in invariant-only position (via slot 0 of Box).',
         ];
         yield 'contravariant nested in method return' => [
             "<?php\nnamespace App;\nclass Consumer<in T>\n{\n    public function fetch(): Box<T> { throw new \\LogicException; }\n}\n",
-            ['in T', 'invariant-only position', 'via slot 0 of'],
+            'Variance violation in template Consumer: type-parameter in T appears in invariant-only position (via slot 0 of Box).',
         ];
         yield 'covariant nested in bound' => [
             "<?php\nnamespace App;\nclass Sortable<out T : Box<T>>\n{\n    public function get(): T { throw new \\LogicException; }\n}\n",
-            ['out T', 'invariant-only position', 'via slot 0 of'],
+            'Variance violation in template Sortable: type-parameter out T appears in invariant-only position (via slot 0 of App\Box).',
         ];
         // A NESTED type-param in a VISIBLE (non-promoted) declared property — `public Box<T> $item` on
         // `out T`. The property's outer position is invariant; Box's invariant slot composes to invariant,
@@ -225,20 +217,20 @@ public static function nestedComposingRejections(): iterable
         // would be exempt — only visible ones are walked).
         yield 'covariant nested in visible declared property' => [
             "<?php\nnamespace App;\nclass Producer<out T>\n{\n    public Box<T> \$item;\n}\n",
-            ['out T', 'invariant-only position', 'via slot 0 of'],
+            'Variance violation in template Producer: type-parameter out T appears in invariant-only position (via slot 0 of Box).',
         ];
         // Composition through a NON-invariant inner slot. `Producer<out X>` as a method PARAMETER:
         // compose(contravariant param, covariant slot) = contravariant → a covariant `out E` is rejected.
         yield 'covariant Producer param composes to contravariant' => [
             "<?php\nnamespace App;\ninterface Producer<out X> { public function get(): X; }\nclass Box<out E>\n{\n    public function take(Producer<E> \$p): void {}\n}\n",
-            ['out E', 'contravariant-only position', 'via slot 0 of'],
+            'Variance violation in template Box: type-parameter out E appears in contravariant-only position (via slot 0 of Producer).',
         ];
         // The mirror that confirms the composing pass owns the unsound direction too: `Sink<in E>` with a
         // `Comparator<in T>` parameter — compose(contravariant param, contravariant slot) = covariant → a
         // contravariant `in E` is rejected. (The sound covariant case is the accept test below.)
         yield 'contravariant Sink with Comparator composes to covariant' => [
             "<?php\nnamespace App;\ninterface Comparator<in T> { public function compare(T \$a, T \$b): int; }\nclass Sink<in E>\n{\n    public function pick(Comparator<E> \$c): void {}\n}\n",
-            ['in E', 'covariant-only position', 'via slot 0 of'],
+            'Variance violation in template Sink: type-parameter in E appears in covariant-only position (via slot 0 of Comparator).',
         ];
     }
 
@@ -359,7 +351,10 @@ public function testViolationIsCollectedWithMemberLineInCheckMode(): void
         self::assertNotNull($d->location);
         self::assertSame('/T.xphp', $d->location->file);
         self::assertSame(5, $d->location->line);
-        self::assertStringContainsString('method parameter', $d->message);
+        self::assertSame(
+            'Generic parameter `out T` appears in method parameter position, which is not allowed for covariant variance.',
+            $d->message,
+        );
     }
 
     public function testAllViolationsAcrossDefinitionsCollectedInOneRun(): void
@@ -402,9 +397,13 @@ public function testByReferenceParamDoesNotShortCircuitLaterParams(): void
         $registry->validateVariancePositions();
 
         $messages = array_map(static fn ($d): string => $d->message, $collector->all());
-        self::assertCount(2, $messages);
-        self::assertStringContainsString('by-reference parameter', implode("\n", $messages));
-        self::assertStringContainsString('method parameter', implode("\n", $messages));
+        self::assertEqualsCanonicalizing(
+            [
+                'Generic parameter `out T` appears in by-reference parameter position, which is not allowed for covariant variance.',
+                'Generic parameter `out T` appears in method parameter position, which is not allowed for covariant variance.',
+            ],
+            $messages,
+        );
     }
 
     private function registryFor(string $source, ?DiagnosticCollector $collector = null): Registry
diff --git a/test/Transpiler/Monomorphize/VisitorGuardsTest.php b/test/Transpiler/Monomorphize/VisitorGuardsTest.php
index 7bca360..512737f 100644
--- a/test/Transpiler/Monomorphize/VisitorGuardsTest.php
+++ b/test/Transpiler/Monomorphize/VisitorGuardsTest.php
@@ -15,6 +15,8 @@
 use PhpParser\Node\Stmt\ClassMethod;
 use PhpParser\Node\Stmt\Property;
 use PHPUnit\Framework\TestCase;
+use RuntimeException;
+use XPHP\Diagnostics\DiagnosticCollector;
 
 /**
  * Targets the LogicalAnd → LogicalOr guard-condition mutations in the three Monomorphize
@@ -31,17 +33,28 @@ final class VisitorGuardsTest extends TestCase
     // CallSiteRewriter
     // =====================================================================
 
-    public function testCallSiteRewriterIgnoresFullyQualifiedNames(): void
+    public function testCallSiteRewriterRewritesFullyQualifiedGenericNamesExactlyOnce(): void
     {
+        // A fully-qualified name carrying generic attributes is a real call
+        // site (`new \App\Box::<int>` after stripping) and MUST rewrite —
+        // skipping it would leave the emitted code newing the stripped marker
+        // interface. Idempotence across the specialized-AST re-rewrite comes
+        // from stripping the generic attributes off the replacement node, not
+        // from skipping FullyQualified names.
         $registry = new Registry();
-        $fq = new FullyQualified('App\\Models\\Plastic');
+        $fq = new FullyQualified('App\\Containers\\Box');
         $fq->setAttribute(XphpSourceParser::ATTR_GENERIC_ARGS, [new TypeRef('App\\Plastic')]);
         $fq->setAttribute(XphpSourceParser::ATTR_TEMPLATE_FQN, 'App\\Containers\\Box');
 
         $ast = self::wrapNameInStmt($fq);
-        (new CallSiteRewriter($registry))->rewrite($ast);
+        $result = (new CallSiteRewriter($registry))->rewrite($ast);
+
+        self::assertCount(1, $registry->instantiations(), 'the FQ call site must record its instantiation');
 
-        self::assertSame([], $registry->instantiations(), 'already-FullyQualified nodes must not be re-rewritten');
+        // The replacement must carry no generic attributes, so a second pass
+        // (the Phase-3.5 re-rewrite of specialized ASTs) records nothing new.
+        (new CallSiteRewriter($registry))->rewrite($result);
+        self::assertCount(1, $registry->instantiations(), 'the rewrite must be idempotent');
     }
 
     public function testCallSiteRewriterIgnoresNameWithoutGenericArgs(): void
@@ -183,23 +196,56 @@ public function testCollectorIgnoresNameWithNonConcreteArgs(): void
         self::assertSame([], $registry->instantiations());
     }
 
-    public function testCollectorBareNewSynthesisSkipsTemplatesWithRequiredParams(): void
+    public function testCollectorBareNewOnNonDefaultsTemplateThrowsInCompileMode(): void
     {
-        // `class Box<T>` (no default) -- a bare `new Box;` must NOT synthesize
-        // a zero-arg instantiation. Only all-defaults templates are eligible.
+        // `class Box<T>` (no default) -- a bare `new Box;` cannot pad from defaults, so it
+        // is a hard error, NOT a silent skip (the old behavior left the site pointing at
+        // the stripped marker interface -> a runtime fatal). Compile mode (no collector)
+        // throws, and nothing is recorded.
         $registry = new Registry();
+
+        try {
+            (new RegistryCollector($registry))->collect(self::classAndBareNew(), '/x.xphp');
+            self::fail('expected a RuntimeException for a bare new of a non-defaults generic');
+        } catch (RuntimeException $e) {
+            self::assertSame(
+                'Generic template "Box" was instantiated with 0 type argument(s) but parameter `T` (position 1) has no default; supply it explicitly or add defaults to every preceding required parameter.',
+                $e->getMessage(),
+            );
+        }
+
+        self::assertSame([], $registry->instantiations(), 'a rejected bare new records no instantiation');
+    }
+
+    public function testCollectorBareNewOnNonDefaultsTemplateCollectsInCheckMode(): void
+    {
+        // Check mode (with a collector) reports the missing-type-argument diagnostic and
+        // continues -- still recording no instantiation for the rejected site.
+        $diagnostics = new DiagnosticCollector();
+        $registry = new Registry(Registry::DEFAULT_HASH_HEX_LENGTH, null, $diagnostics);
+
+        (new RegistryCollector($registry))->collect(self::classAndBareNew(), '/x.xphp');
+
+        self::assertCount(1, $diagnostics->all());
+        self::assertSame(Registry::CODE_MISSING_TYPE_ARGUMENT, $diagnostics->all()[0]->code);
+        self::assertSame([], $registry->instantiations());
+    }
+
+    /**
+     * `class Box<T>` (required param, no default) followed by a bare `new Box;`.
+     *
+     * @return list<Node\Stmt>
+     */
+    private static function classAndBareNew(): array
+    {
         $class = new Class_(new Identifier('Box'));
         $class->setAttribute(XphpSourceParser::ATTR_GENERIC_PARAMS, [new TypeParam('T')]);
         $class->setAttribute(XphpSourceParser::ATTR_TEMPLATE_FQN, 'Box');
-        $bareNew = new \PhpParser\Node\Expr\New_(new Name('Box'));
-        $ast = [
+
+        return [
             $class,
-            new \PhpParser\Node\Stmt\Expression($bareNew),
+            new \PhpParser\Node\Stmt\Expression(new \PhpParser\Node\Expr\New_(new Name('Box'))),
         ];
-
-        (new RegistryCollector($registry))->collect($ast, '/x.xphp');
-
-        self::assertSame([], $registry->instantiations(), 'bare new on a non-defaulted template must not synthesize an instantiation');
     }
 
     public function testCollectorBareNewSynthesisRecordsAllDefaultsTemplate(): void
@@ -259,11 +305,13 @@ public function testCollectorBareNewSynthesisSkipsNameWithExistingGenericArgs():
         self::assertTrue($only->concreteTypes[0]->isScalar);
     }
 
-    public function testCollectorBareNewSynthesisSkipsFullyQualifiedName(): void
+    public function testCollectorBareNewSynthesisIncludesFullyQualifiedName(): void
     {
-        // FullyQualified Name nodes already point at an explicit class -- no
-        // namespace + use-map resolution needed, and they're not a synthesis
-        // target. Pin that the collector ignores them.
+        // A FullyQualified bare new of an all-defaults generic is a real
+        // instantiation: skipping it emitted the stripped marker interface
+        // and KEPT the `new \Cache(...)` call site — a guaranteed runtime
+        // fatal behind a clean gate. It must synthesize the defaults tuple
+        // exactly like the bare spelling (without doubling the namespace).
         $registry = new Registry();
         $class = new Class_(new Identifier('Cache'));
         $class->setAttribute(
@@ -279,7 +327,14 @@ public function testCollectorBareNewSynthesisSkipsFullyQualifiedName(): void
 
         (new RegistryCollector($registry))->collect($ast, '/x.xphp');
 
-        self::assertSame([], $registry->instantiations(), 'FullyQualified bare new must not be synthesized');
+        $instantiations = $registry->instantiations();
+        self::assertCount(1, $instantiations, 'FQ bare new of an all-defaults generic must synthesize');
+        self::assertSame('Cache', reset($instantiations)->templateFqn);
+        self::assertSame(
+            [],
+            $bareNew->class->getAttribute(XphpSourceParser::ATTR_GENERIC_ARGS),
+            'the synthesized marker must attach so the call-site rewriter fires',
+        );
     }
 
     // =====================================================================
diff --git a/test/Transpiler/Monomorphize/XphpSourceParserTest.php b/test/Transpiler/Monomorphize/XphpSourceParserTest.php
index 3b06c90..b35b9d2 100644
--- a/test/Transpiler/Monomorphize/XphpSourceParserTest.php
+++ b/test/Transpiler/Monomorphize/XphpSourceParserTest.php
@@ -560,7 +560,205 @@ public function testAnonymousClassWithAngleBracketsIsNotRecognizedAsTemplate():
         // survive into the cleaned source so any downstream tooling sees the
         // form as invalid PHP rather than xphp silently specializing it.
         $stripped = $parser->strip($source);
-        self::assertStringContainsString('class<T>', $stripped, 'anon-class `<T>` must be left un-stripped');
+        self::assertSame($source, $stripped);
+    }
+
+    public function testMultiLineTypeParamClauseKeepsLaterLineKeyedMarkersAligned(): void
+    {
+        // The `<…>` strip used to collapse newlines to spaces, shifting every
+        // later LINE-KEYED marker: `class Wide<\n T\n>` before `class Box<T>`
+        // left Box un-generic — raw `T` hints in the emitted code, a silent
+        // runtime fatal. Blanking must preserve BOTH byte length and line count.
+        $source = <<<'PHP'
+<?php
+namespace App;
+
+class Wide<
+    T
+> {
+    public function __construct(public T $v) {}
+}
+
+class Box<T> {
+    public function __construct(public T $v) {}
+}
+PHP;
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+        $stripped = $parser->strip($source);
+        self::assertSame(strlen($source), strlen($stripped), 'blanking must preserve byte length');
+        self::assertSame(
+            substr_count($source, "\n"),
+            substr_count($stripped, "\n"),
+            'blanking must preserve line count',
+        );
+
+        $ast = $parser->parse($source);
+        $byName = self::classesByName($ast);
+        self::assertSame(['T'], self::paramNames($byName['Wide']));
+        self::assertSame(
+            ['T'],
+            self::paramNames($byName['Box']),
+            'the class declared AFTER a multi-line clause must keep its type params',
+        );
+    }
+
+    public function testMultiLineTurbofishArgListKeepsLaterMarkersAligned(): void
+    {
+        $source = <<<'PHP'
+<?php
+namespace App;
+
+class Box<T> {
+    public function __construct(public T $v) {}
+}
+
+$b = new Box::<
+    int
+>(1);
+
+class Pair<U> {
+    public function __construct(public U $u) {}
+}
+PHP;
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+        $stripped = $parser->strip($source);
+        self::assertSame(strlen($source), strlen($stripped));
+        self::assertSame(substr_count($source, "\n"), substr_count($stripped, "\n"));
+
+        $ast = $parser->parse($source);
+        self::assertNotNull(
+            self::firstNameAttr($ast, 'Box', XphpSourceParser::ATTR_GENERIC_ARGS),
+            'the multi-line turbofish itself must still attach',
+        );
+        self::assertSame(
+            ['U'],
+            self::paramNames(self::classesByName($ast)['Pair']),
+            'the class declared AFTER a multi-line turbofish must keep its type params',
+        );
+    }
+
+    public function testMultibyteInsideStrippedClauseBlanksPerByte(): void
+    {
+        // A multibyte character inside the blanked span (here in a comment the
+        // clause tolerates) must blank to one space PER BYTE — a /u-flagged
+        // blanking would shrink the file and shift every later byte-keyed marker.
+        $source = <<<'PHP'
+<?php
+namespace App;
+
+class Wide<
+    T // café
+> {}
+
+class Box<T> {
+    public function __construct(public T $v) {}
+}
+PHP;
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+        $stripped = $parser->strip($source);
+        self::assertSame(strlen($source), strlen($stripped), 'multibyte spans must blank per byte');
+
+        $ast = $parser->parse($source);
+        self::assertSame(['T'], self::paramNames(self::classesByName($ast)['Box']));
+    }
+
+    public function testCrlfInsideStrippedClauseIsPreserved(): void
+    {
+        $source = "<?php\r\nnamespace App;\r\nclass Wide<\r\n    T\r\n> {}\r\nclass Box<T> {\r\n"
+            . "    public function __construct(public T \$v) {}\r\n}\r\n";
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+        $stripped = $parser->strip($source);
+        self::assertSame(strlen($source), strlen($stripped));
+        self::assertSame(substr_count($source, "\r\n"), substr_count($stripped, "\r\n"));
+
+        $ast = $parser->parse($source);
+        self::assertSame(['T'], self::paramNames(self::classesByName($ast)['Box']));
+    }
+
+    public function testArraySugarSpanWithNewlineKeepsLineCount(): void
+    {
+        // The sugar rewrite is length-CHANGING (`Rec[\n]` -> `array`), so byte
+        // length cannot be preserved — but the span's newlines must be
+        // re-appended or every later line-keyed marker shifts.
+        $source = <<<'PHP'
+<?php
+namespace App;
+
+class Rec {}
+
+function tally(Rec[
+] $rs): int {
+    return \count($rs);
+}
+
+class Box<T> {
+    public function __construct(public T $v) {}
+}
+PHP;
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+        $stripped = $parser->strip($source);
+        self::assertSame(
+            substr_count($source, "\n"),
+            substr_count($stripped, "\n"),
+            'a length-changing sugar rewrite must still keep the line count',
+        );
+        self::assertSame(
+            strpos($source, 'Rec['),
+            strpos($stripped, 'array'),
+            'the lowered type must start where the original type started — the '
+            . 'span\'s newlines belong AFTER it, or positions stop rounding-trip',
+        );
+
+        $ast = $parser->parse($source);
+        self::assertSame(
+            ['T'],
+            self::paramNames(self::classesByName($ast)['Box']),
+            'the class declared AFTER a newline-bearing sugar span must keep its type params',
+        );
+    }
+
+    public function testMultibyteIdentifierAdjacentToMarkerBlanksPerByteAndKeepsLaterMarkers(): void
+    {
+        // A genuine multibyte identifier (`Café`, bytes >= 0x80) sitting directly
+        // against its `<T>` marker, with a SECOND generic class after it. The
+        // blanked `<T>` must stay byte-for-byte the same length or the byte-keyed
+        // marker for `Box` shifts off its node — and multibyte name bytes must NOT
+        // be blanked (they're the identifier, outside the span).
+        $source = "<?php\nnamespace App;\nclass Café<T> {\n"
+            . "    public function __construct(public T \$v) {}\n}\n"
+            . "class Box<U> {\n    public function __construct(public U \$w) {}\n}\n";
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+
+        $stripped = $parser->strip($source);
+        self::assertSame(strlen($source), strlen($stripped), 'multibyte-adjacent span must stay byte-exact');
+
+        $ast = $parser->parse($source);
+        $classes = self::classesByName($ast);
+        self::assertSame(['T'], self::paramNames($classes['Café']), 'the multibyte-named template keeps its param');
+        self::assertSame(
+            ['U'],
+            self::paramNames($classes['Box']),
+            'the template declared AFTER a multibyte-adjacent marker keeps its own param',
+        );
+    }
+
+    public function testByteKeyedTurbofishAfterArraySugarSpanStillAttaches(): void
+    {
+        // The `Rec[\n]` -> `array` sugar is length-CHANGING, so it shrinks the
+        // stripped source. A byte-keyed turbofish marker (`Box::<int>`) that comes
+        // AFTER the sugar span on the same scope must still bind its args — the
+        // marker is byte-matched in stripped space, so the shrink must not desync it.
+        $source = "<?php\nnamespace App;\nclass Rec {}\n"
+            . "class Box<T> { public function __construct(public T \$v) {} }\n"
+            . "function tally(Rec[\n] \$rs): int { return \\count(\$rs); }\n"
+            . "\$b = new Box::<int>(5);\n";
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+
+        $ast = $parser->parse($source);
+        $args = self::firstNameAttr($ast, 'Box', XphpSourceParser::ATTR_GENERIC_ARGS);
+        self::assertIsArray($args, 'the turbofish after a length-changing sugar span must still attach its args');
+        self::assertCount(1, $args);
+        self::assertSame('int', $args[0]->canonical(), 'the turbofish arg after the sugar span must be <int>');
     }
 
     public function testForwardReferenceToEarlierTypeParamAsBoundIsAllowed(): void
@@ -1756,7 +1954,7 @@ public function testBareNewCallSiteIsRejectedAndLeftUnstripped(): void
         $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
         $stripped = $parser->strip($source);
 
-        self::assertStringContainsString('<Plastic>', $stripped, 'bare `new Name<…>()` must be left un-stripped');
+        self::assertSame($source, $stripped);
     }
 
     public function testBareNewWithoutParensIsRejectedAndLeftUnstripped(): void
@@ -1775,7 +1973,7 @@ public function testBareNewWithoutParensIsRejectedAndLeftUnstripped(): void
         $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
         $stripped = $parser->strip($source);
 
-        self::assertStringContainsString('<Plastic>', $stripped, 'parenless `new Name<…>` must be left un-stripped');
+        self::assertSame($source, $stripped);
     }
 
     public function testBareFreeFunctionCallIsRejectedAndLeftUnstripped(): void
@@ -1787,7 +1985,7 @@ public function testBareFreeFunctionCallIsRejectedAndLeftUnstripped(): void
         $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
         $stripped = $parser->strip($source);
 
-        self::assertStringContainsString('<int>', $stripped, 'bare `name<…>()` free-function call must be left un-stripped');
+        self::assertSame($source, $stripped);
     }
 
     public function testBareStaticMethodCallIsRejectedAndLeftUnstripped(): void
@@ -1799,7 +1997,7 @@ public function testBareStaticMethodCallIsRejectedAndLeftUnstripped(): void
         $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
         $stripped = $parser->strip($source);
 
-        self::assertStringContainsString('<int>', $stripped, 'bare `Recv::method<…>()` static call must be left un-stripped');
+        self::assertSame($source, $stripped);
     }
 
     public function testWhitespaceBetweenDoubleColonAndAngleDefeatsTurbofish(): void
@@ -1815,15 +2013,15 @@ public function testWhitespaceBetweenDoubleColonAndAngleDefeatsTurbofish(): void
         $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
         $stripped = $parser->strip($source);
 
-        self::assertStringContainsString('<int>', $stripped, 'whitespace between `::` and `<` must defeat turbofish recognition');
+        self::assertSame($source, $stripped);
     }
 
     public function testTypeHintPositionAcceptsFullyQualifiedOuterName(): void
     {
-        // Locks the ltrim('\\') on the bare-`<…>` (type-hint) branch: when the
-        // outer Name is fully qualified (`\App\Containers\Box`), the marker
-        // must be keyed by the trimmed form so the resolver -- which sees the
-        // AST Name's `toString()` (no leading backslash) -- can match.
+        // A fully-qualified outer Name (`\App\Containers\Box<Plastic>`) in a
+        // type-hint slot: the marker records the raw source spelling (leading
+        // `\` kept) and the resolver compares the node's `toCodeString()`, so
+        // the two agree and the generic args attach.
         $source = <<<'PHP'
 <?php
 namespace App;
@@ -1839,6 +2037,206 @@ class Holder {
         self::assertSame('App\\Models\\Plastic', $args[0]->name);
     }
 
+    public function testFullyQualifiedTurbofishResolvesWithoutDoublingTheNamespace(): void
+    {
+        // `new \App\Box::<int>` used to record ATTR_TEMPLATE_FQN = `App\App\Box`
+        // (the leading `\` was trimmed before namespace resolution), which
+        // hard-failed as an undefined template.
+        $source = <<<'PHP'
+<?php
+namespace App;
+class Box<T> { public function __construct(public T $v) {} }
+$b = new \App\Box::<int>(1);
+PHP;
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+        $ast = $parser->parse($source);
+
+        $finder = new \PhpParser\NodeFinder();
+        $fq = null;
+        foreach ($finder->findInstanceOf($ast, Name::class) as $n) {
+            if ($n->isFullyQualified()) {
+                $fq = $n;
+            }
+        }
+        self::assertNotNull($fq);
+        self::assertSame('App\\Box', $fq->getAttribute(XphpSourceParser::ATTR_TEMPLATE_FQN));
+        $args = $fq->getAttribute(XphpSourceParser::ATTR_GENERIC_ARGS);
+        self::assertIsArray($args);
+        self::assertSame('int', $args[0]->name);
+    }
+
+    public function testSameLineRelativeReturnAndBareTurbofishKeepTheirOwnMarkers(): void
+    {
+        // On ONE line, the relative return type's marker and the body
+        // turbofish's marker both spell a bare `Box` after toString() — the
+        // return-type node used to steal the body's marker (specializing the
+        // wrong site) while its own `namespace\Box` marker never bound.
+        $source = <<<'PHP'
+<?php
+namespace App;
+class Box<T> { public function __construct(public T $v) {} }
+function f(): namespace\Box<int> { return new Box::<string>('s'); }
+PHP;
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+        $ast = $parser->parse($source);
+
+        $finder = new \PhpParser\NodeFinder();
+        $relative = null;
+        $bare = null;
+        foreach ($finder->findInstanceOf($ast, Name::class) as $n) {
+            if ($n->isRelative()) {
+                $relative = $n;
+            } elseif (!$n->isFullyQualified() && $n->toString() === 'Box'
+                && $n->getAttribute(XphpSourceParser::ATTR_GENERIC_ARGS) !== null
+            ) {
+                $bare = $n;
+            }
+        }
+
+        self::assertNotNull($relative, 'relative return-type Name missing');
+        self::assertSame('App\\Box', $relative->getAttribute(XphpSourceParser::ATTR_TEMPLATE_FQN));
+        $relArgs = $relative->getAttribute(XphpSourceParser::ATTR_GENERIC_ARGS);
+        self::assertIsArray($relArgs);
+        self::assertSame('int', $relArgs[0]->name, 'the return type must keep its OWN args');
+
+        self::assertNotNull($bare, 'body turbofish Name missing its args');
+        $bareArgs = $bare->getAttribute(XphpSourceParser::ATTR_GENERIC_ARGS);
+        self::assertIsArray($bareArgs);
+        self::assertSame('string', $bareArgs[0]->name, 'the body turbofish must keep its OWN args');
+    }
+
+    public function testUppercaseRelativePrefixStillMatchesItsMarker(): void
+    {
+        // The `namespace` keyword is case-insensitive in source, but
+        // `toCodeString()` always emits it lowercase — the marker spelling
+        // must fold the prefix or `NAMESPACE\Box::<int>` silently loses
+        // its marker.
+        $source = <<<'PHP'
+<?php
+namespace App;
+class Box<T> { public function __construct(public T $v) {} }
+$b = new NAMESPACE\Box::<int>(1);
+PHP;
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+        $ast = $parser->parse($source);
+
+        $finder = new \PhpParser\NodeFinder();
+        $relative = null;
+        foreach ($finder->findInstanceOf($ast, Name::class) as $n) {
+            if ($n->isRelative()) {
+                $relative = $n;
+            }
+        }
+        self::assertNotNull($relative);
+        self::assertSame('App\\Box', $relative->getAttribute(XphpSourceParser::ATTR_TEMPLATE_FQN));
+        $args = $relative->getAttribute(XphpSourceParser::ATTR_GENERIC_ARGS);
+        self::assertIsArray($args);
+        self::assertSame('int', $args[0]->name);
+    }
+
+    public function testRelativeNamesResolveToTheCurrentNamespaceNotTheAliasMap(): void
+    {
+        // `namespace\Thing` binds to App\Thing even with `use Other\Thing` in
+        // scope, and — being an explicit class reference — is never flagged as
+        // a suspect undeclared type parameter.
+        $source = <<<'PHP'
+<?php
+namespace App;
+
+use Other\Thing;
+
+class Gen<T> {
+    public function m(namespace\Thing $x): void {}
+}
+PHP;
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+        $ast = $parser->parse($source);
+
+        $finder = new \PhpParser\NodeFinder();
+        $relative = null;
+        foreach ($finder->findInstanceOf($ast, Name::class) as $n) {
+            if ($n->isRelative()) {
+                $relative = $n;
+            }
+        }
+        self::assertNotNull($relative);
+        self::assertSame(
+            'App\\Thing',
+            $relative->getAttribute(XphpSourceParser::ATTR_RESOLVED_FQN),
+            'the alias must not capture a relative name',
+        );
+        self::assertNull(
+            $relative->getAttribute(XphpSourceParser::ATTR_SUSPECT_UNDECLARED_TYPE),
+            'a relative name is an explicit class reference, never a suspect type param',
+        );
+    }
+
+    public function testRelativeNameCollidingWithATypeParamIsStillAClassReference(): void
+    {
+        // Inside `Gen<T>`, `namespace\T` spells the CLASS App\T — it must get
+        // a resolved FQN (so the specializer swaps it to `\App\T`), never be
+        // treated as the type parameter.
+        $source = <<<'PHP'
+<?php
+namespace App;
+
+class Gen<T> {
+    public function m(namespace\T $x): void {}
+}
+PHP;
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+        $ast = $parser->parse($source);
+
+        $finder = new \PhpParser\NodeFinder();
+        $relative = null;
+        foreach ($finder->findInstanceOf($ast, Name::class) as $n) {
+            if ($n->isRelative()) {
+                $relative = $n;
+            }
+        }
+        self::assertNotNull($relative);
+        self::assertSame('App\\T', $relative->getAttribute(XphpSourceParser::ATTR_RESOLVED_FQN));
+        self::assertNull(
+            $relative->getAttribute(XphpSourceParser::ATTR_SUSPECT_UNDECLARED_TYPE),
+            'an explicit relative reference must not be flagged as a suspect type param'
+            . ' — here there is no alias, so only the relative exclusion protects it',
+        );
+    }
+
+    public function testQualifiedFunctionTurbofishesResolveAndAttach(): void
+    {
+        // `\App\make::<int>(…)` used to double the namespace in
+        // ATTR_TEMPLATE_FQN (stripping the generic function with no dispatcher
+        // emitted — a silent undefined-function fatal); `namespace\make::<…>`
+        // never matched its marker at all and false-rejected as a
+        // missing-type-argument call.
+        $source = <<<'PHP'
+<?php
+namespace App;
+function make<T>(T $x): T { return $x; }
+$a = \App\make::<int>(1);
+$b = namespace\make::<string>('s');
+PHP;
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+        $ast = $parser->parse($source);
+
+        $finder = new \PhpParser\NodeFinder();
+        $calls = $finder->findInstanceOf($ast, Node\Expr\FuncCall::class);
+        self::assertCount(2, $calls);
+
+        $fqCall = $calls[0];
+        self::assertSame('App\\make', $fqCall->getAttribute(XphpSourceParser::ATTR_TEMPLATE_FQN));
+        $fqArgs = $fqCall->getAttribute(XphpSourceParser::ATTR_METHOD_GENERIC_ARGS);
+        self::assertIsArray($fqArgs);
+        self::assertSame('int', $fqArgs[0]->name);
+
+        $relCall = $calls[1];
+        self::assertSame('App\\make', $relCall->getAttribute(XphpSourceParser::ATTR_TEMPLATE_FQN));
+        $relArgs = $relCall->getAttribute(XphpSourceParser::ATTR_METHOD_GENERIC_ARGS);
+        self::assertIsArray($relArgs);
+        self::assertSame('string', $relArgs[0]->name);
+    }
+
     public function testTypeHintPositionStillAcceptsBareGenericArgs(): void
     {
         // Regression: type-hint sites (property type, return type, params,
@@ -2615,6 +3013,366 @@ public function testGenericArrowFunctionIsParsed(): void
         self::assertSame('T', $params[0]->name);
     }
 
+    public function testGenericStaticArrowAttachesItsMarker(): void
+    {
+        // The node starts at `static`, not at `fn` — the marker must anchor
+        // there or the arrow silently loses its params (raw `T` in the output).
+        $source = <<<'PHP'
+<?php
+namespace App;
+$id = static fn<T>(T $x): T => $x;
+PHP;
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+        $ast = $parser->parse($source);
+        $arrow = self::findFirstNodeOfType($ast, \PhpParser\Node\Expr\ArrowFunction::class);
+        self::assertNotNull($arrow);
+        self::assertTrue($arrow->static);
+        $params = $arrow->getAttribute(XphpSourceParser::ATTR_METHOD_GENERIC_PARAMS);
+        self::assertIsArray($params);
+        self::assertSame('T', $params[0]->name);
+    }
+
+    public function testAttributedGenericClosureAttachesItsMarker(): void
+    {
+        // The node starts at the first `#[`, not at `function`.
+        $source = <<<'PHP'
+<?php
+namespace App;
+$f = #[Marked] function<T>(T $x): T {
+    return $x;
+};
+PHP;
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+        $ast = $parser->parse($source);
+        $closure = self::findFirstNodeOfType($ast, \PhpParser\Node\Expr\Closure::class);
+        self::assertNotNull($closure);
+        $params = $closure->getAttribute(XphpSourceParser::ATTR_METHOD_GENERIC_PARAMS);
+        self::assertIsArray($params);
+        self::assertSame('T', $params[0]->name);
+    }
+
+    public function testAttributedStaticGenericArrowAttachesItsMarker(): void
+    {
+        // Two ADJACENT attribute groups (no whitespace between them) — one
+        // with an array argument, so the walk back to the node start must
+        // balance the inner brackets AND resume exactly one token before
+        // each consumed group — plus `static`.
+        $source = <<<'PHP'
+<?php
+namespace App;
+$g = #[Marked]#[Tagged([1, 2])] static fn<U>(U $y): U => $y;
+PHP;
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+        $ast = $parser->parse($source);
+        $arrow = self::findFirstNodeOfType($ast, \PhpParser\Node\Expr\ArrowFunction::class);
+        self::assertNotNull($arrow);
+        self::assertTrue($arrow->static);
+        $params = $arrow->getAttribute(XphpSourceParser::ATTR_METHOD_GENERIC_PARAMS);
+        self::assertIsArray($params);
+        self::assertSame('U', $params[0]->name);
+    }
+
+    public function testSplitDeclarationHeadersKeepTheirMarkers(): void
+    {
+        // php-parser starts a node at its first attribute group or modifier —
+        // when that sits on a DIFFERENT line than the declaration's name, the
+        // marker (recorded at the name token's line) must still bind. Every
+        // shape here either silently lost its type params or false-rejected
+        // with "instantiated but never defined" when matched on the node line.
+        $source = <<<'PHP'
+<?php
+namespace App;
+
+#[Note]
+final class Box<T> {
+    public function __construct(public T $v) {}
+}
+
+final
+class Pair<U> {
+    public function __construct(public U $u) {}
+}
+
+class Wrap {
+    #[Note]
+    public function lift<T>(T $x): T { return $x; }
+
+    public static
+    function pick<T>(T $x): T { return $x; }
+}
+
+#[Note]
+function ident<T>(T $x): T { return $x; }
+
+function
+double<T>(T $x): array { return [$x, $x]; }
+PHP;
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+        $ast = $parser->parse($source);
+
+        $byName = self::classesByName($ast);
+        self::assertSame(['T'], self::paramNames($byName['Box']));
+        self::assertSame(['U'], self::paramNames($byName['Pair']));
+
+        foreach ($byName['Wrap']->getMethods() as $method) {
+            $params = $method->getAttribute(XphpSourceParser::ATTR_METHOD_GENERIC_PARAMS);
+            self::assertIsArray($params, "method {$method->name->toString()} lost its marker");
+            self::assertCount(1, $params);
+        }
+
+        $functions = [];
+        foreach ($ast as $stmt) {
+            if ($stmt instanceof Namespace_) {
+                foreach ($stmt->stmts as $s) {
+                    if ($s instanceof \PhpParser\Node\Stmt\Function_) {
+                        $functions[$s->name->toString()] = $s;
+                    }
+                }
+            }
+        }
+        self::assertSame(['ident', 'double'], array_keys($functions));
+        foreach ($functions as $name => $fn) {
+            $params = $fn->getAttribute(XphpSourceParser::ATTR_METHOD_GENERIC_PARAMS);
+            self::assertIsArray($params, "function {$name} lost its marker");
+            self::assertCount(1, $params);
+        }
+    }
+
+    public function testSplitInterfaceAndTraitHeadersKeepTheirMarkers(): void
+    {
+        $source = <<<'PHP'
+<?php
+namespace App;
+
+#[Note]
+interface Keeper<T> {
+    public function get(): T;
+}
+
+#[Note]
+trait Mixin<T> {
+}
+PHP;
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+        $ast = $parser->parse($source);
+
+        $iface = self::findFirstClassLike($ast, \PhpParser\Node\Stmt\Interface_::class);
+        self::assertNotNull($iface);
+        self::assertSame(['T'], self::paramNames($iface));
+
+        $trait = self::findFirstClassLike($ast, \PhpParser\Node\Stmt\Trait_::class);
+        self::assertNotNull($trait);
+        self::assertSame(['T'], self::paramNames($trait));
+    }
+
+    public function testVariableTurbofishStripPreservesByteLength(): void
+    {
+        // The `$var::<…>` strip must blank exactly its own span — byte length
+        // and line count of the whole file preserved.
+        $source = <<<'PHP'
+<?php
+namespace App;
+$id = fn<T>(T $x): T => $x;
+$r = $id::<int>(1) + $id::<int>(2);
+PHP;
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+        $stripped = $parser->strip($source);
+        self::assertSame(strlen($source), strlen($stripped));
+        self::assertSame(substr_count($source, "\n"), substr_count($stripped, "\n"));
+    }
+
+    public function testSameLinePlainAndGenericHintsKeepTheirOwnMarkers(): void
+    {
+        // Line-keyed matching let the first-traversed same-spelling Name steal
+        // the generic hint's marker — specializing the WRONG parameter.
+        $source = <<<'PHP'
+<?php
+namespace App;
+class Box<T> { public function __construct(public T $v) {} }
+function f(Box $a, Box<int> $b): int { return $b->v; }
+function g(Box<int> $a, Box $b): int { return $a->v; }
+PHP;
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+        $ast = $parser->parse($source);
+
+        $finder = new \PhpParser\NodeFinder();
+        $hints = [];
+        foreach ($finder->findInstanceOf($ast, Name::class) as $n) {
+            if ($n->toString() === 'Box') {
+                $hints[] = $n->getAttribute(XphpSourceParser::ATTR_GENERIC_ARGS) !== null;
+            }
+        }
+        self::assertSame(
+            [false, true, true, false],
+            $hints,
+            'each generic hint must keep its own marker regardless of same-line order',
+        );
+    }
+
+    public function testSameLineSameNameStaticCallsDoNotCrossClaim(): void
+    {
+        // `Plain::pick(5) + Util::pick::<int>(4)` on one line: the line-range
+        // match let the PLAIN call steal the generic call's marker — both then
+        // rejected (bogus unresolved-call + missing-type-argument errors).
+        $source = <<<'PHP'
+<?php
+namespace App;
+class Util { public static function pick<T>(T $x): T { return $x; } }
+class Plain { public static function pick(int $x): int { return $x; } }
+$r = Plain::pick(5) + Util::pick::<int>(4);
+PHP;
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+        $ast = $parser->parse($source);
+
+        $finder = new \PhpParser\NodeFinder();
+        $byClass = [];
+        foreach ($finder->findInstanceOf($ast, Node\Expr\StaticCall::class) as $call) {
+            assert($call->class instanceof Name);
+            $byClass[$call->class->toString()] =
+                $call->getAttribute(XphpSourceParser::ATTR_METHOD_GENERIC_ARGS);
+        }
+        self::assertNull($byClass['Plain'], 'the plain call must not claim the marker');
+        self::assertIsArray($byClass['Util'], 'the generic call must keep its marker');
+        self::assertSame('int', $byClass['Util'][0]->name);
+    }
+
+    public function testReturnHintDoesNotStealANewTurbofishMarker(): void
+    {
+        $source = <<<'PHP'
+<?php
+namespace App;
+class Box<T> { public function __construct(public T $v) {} }
+function mk(): Box { return new Box::<int>(1); }
+PHP;
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+        $ast = $parser->parse($source);
+
+        $finder = new \PhpParser\NodeFinder();
+        $fn = $finder->findFirstInstanceOf($ast, \PhpParser\Node\Stmt\Function_::class);
+        self::assertNotNull($fn);
+        assert($fn->returnType instanceof Name);
+        self::assertNull(
+            $fn->returnType->getAttribute(XphpSourceParser::ATTR_GENERIC_ARGS),
+            'the plain return hint must not claim the instantiation marker',
+        );
+        $new = $finder->findFirstInstanceOf($ast, Node\Expr\New_::class);
+        self::assertNotNull($new);
+        assert($new->class instanceof Name);
+        $args = $new->class->getAttribute(XphpSourceParser::ATTR_GENERIC_ARGS);
+        self::assertIsArray($args);
+        self::assertSame('int', $args[0]->name);
+    }
+
+    public function testOneLineConditionalSameNameClassesBindTheRightMarker(): void
+    {
+        $source = <<<'PHP'
+<?php
+namespace App;
+if ($flag) { class B { } } else { class B<T> { public T $v; } }
+PHP;
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+        $ast = $parser->parse($source);
+
+        $classes = self::collectClasses($ast);
+        self::assertCount(2, $classes);
+        self::assertNull(
+            $classes[0]->getAttribute(XphpSourceParser::ATTR_GENERIC_PARAMS),
+            'the plain class must not claim the generic clause',
+        );
+        self::assertSame(['T'], self::paramNames($classes[1]));
+    }
+
+    public function testUseFunctionImportNeverBecomesAGenericMarker(): void
+    {
+        // `use function b<T>;` is invalid code, but it must fail as PHP's own
+        // syntax error on the un-stripped `<` — not be silently swallowed
+        // (the clause used to strip, emitting `use function b ;`), and not be
+        // misreported as a transpiler bug by the unbound-marker backstop
+        // (an import never produces the Function_ node the marker binds to).
+        $parser = new XphpSourceParser((new ParserFactory())->createForHostVersion());
+
+        foreach (['use function b<T>;', 'use function b<T> as c;', 'use Foo\{function a<T>};'] as $import) {
+            $source = "<?php\nnamespace App;\n{$import}\n";
+            $stripped = $parser->strip($source);
+            self::assertMatchesRegularExpression(
+                '/<T>/',
+                $stripped,
+                "the clause in `{$import}` must survive into the cleaned source",
+            );
+            try {
+                $parser->parse($source);
+                self::fail("expected PHP's own parse error for `{$import}`");
+            } catch (\PhpParser\Error) {
+                // PHP's syntax error — the right blame, in both modes.
+            }
+        }
+
+        // Plain function imports keep compiling, including next to a genuine
+        // generic declaration.
+        $ast = $parser->parse("<?php\nnamespace App;\nuse function strlen;\nfunction f<T>(T \$x): T { return \$x; }\n");
+        self::assertNotEmpty($ast);
+    }
+
+    public function testUnboundDeclarationMarkerMessageIsNullWhenEverythingBound(): void
+    {
+        self::assertNull(XphpSourceParser::unboundDeclarationMarkerMessage([], []));
+    }
+
+    public function testUnboundClassMarkerProducesTheLoudBackstopError(): void
+    {
+        $msg = XphpSourceParser::unboundDeclarationMarkerMessage(
+            [['line' => 7, 'name' => 'Box']],
+            [],
+        );
+        self::assertSame(
+            'The generic type-parameter clause for `Box` (line 7) was recognized but never bound to '
+            . 'its declaration — compiling on would silently drop the type parameters from the '
+            . 'emitted code. This is a transpiler bug; please report it. As a workaround, keep the '
+            . 'declaration header (attributes, modifiers, and name) on a single line.',
+            $msg,
+        );
+    }
+
+    public function testUnboundMethodAndClosureMarkersProduceTheLoudBackstopError(): void
+    {
+        $named = XphpSourceParser::unboundDeclarationMarkerMessage(
+            [],
+            [['line' => 3, 'name' => 'wrap']],
+        );
+        self::assertSame(
+            'The generic type-parameter clause for `wrap` (line 3) was recognized but never bound to '
+            . 'its declaration — compiling on would silently drop the type parameters from the '
+            . 'emitted code. This is a transpiler bug; please report it. As a workaround, keep the '
+            . 'declaration header (attributes, modifiers, and name) on a single line.',
+            $named,
+        );
+
+        $anonymous = XphpSourceParser::unboundDeclarationMarkerMessage(
+            [],
+            [['line' => 9, 'name' => '']],
+        );
+        self::assertSame(
+            'The generic type-parameter clause for an anonymous closure (line 9) was recognized but '
+            . 'never bound to its declaration — compiling on would silently drop the type parameters '
+            . 'from the emitted code. This is a transpiler bug; please report it. As a workaround, '
+            . 'keep the declaration header (attributes, modifiers, and name) on a single line.',
+            $anonymous,
+        );
+
+        // Class markers are reported first when both kinds survive.
+        $both = XphpSourceParser::unboundDeclarationMarkerMessage(
+            [['line' => 1, 'name' => 'A']],
+            [['line' => 2, 'name' => 'b']],
+        );
+        self::assertSame(
+            'The generic type-parameter clause for `A` (line 1) was recognized but never bound to '
+            . 'its declaration — compiling on would silently drop the type parameters from the '
+            . 'emitted code. This is a transpiler bug; please report it. As a workaround, keep the '
+            . 'declaration header (attributes, modifiers, and name) on a single line.',
+            $both,
+        );
+    }
+
     public function testGenericClosureDefaultIsAccepted(): void
     {
         // P5.7: defaults now allowed on anonymous closures; GMC pads
@@ -2759,6 +3517,19 @@ private static function collectClasses(array $ast): array
         return $found;
     }
 
+    /**
+     * @param array<int, mixed> $ast
+     * @return array<string, Class_>
+     */
+    private static function classesByName(array $ast): array
+    {
+        $byName = [];
+        foreach (self::collectClasses($ast) as $class) {
+            $byName[$class->name?->toString() ?? ''] = $class;
+        }
+        return $byName;
+    }
+
     /**
      * Find the first Name node whose ->toString() matches and return the value of $attribute.
      *
diff --git a/test/fixture/check/bare_new_conditional_same_name/source/Use.xphp b/test/fixture/check/bare_new_conditional_same_name/source/Use.xphp
new file mode 100644
index 0000000..157bab6
--- /dev/null
+++ b/test/fixture/check/bare_new_conditional_same_name/source/Use.xphp
@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Check\BareNewConditionalSameName;
+
+// A plain `class B` (live branch) coexists with a generic `class B<T>` (dead branch).
+// A bare `new B` resolves to the instantiable plain class at runtime, so the bare-new
+// guard must NOT reject it -- rejecting would be a false reject. Expect 0 diagnostics.
+if (true) {
+    class B
+    {
+    }
+} else {
+    class B<T>
+    {
+        public T $v;
+    }
+}
+
+$b = new B();
diff --git a/test/fixture/check/bare_new_missing_arg/source/Box.xphp b/test/fixture/check/bare_new_missing_arg/source/Box.xphp
new file mode 100644
index 0000000..5b5942a
--- /dev/null
+++ b/test/fixture/check/bare_new_missing_arg/source/Box.xphp
@@ -0,0 +1,12 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Check\BareNewMissingArg;
+
+class Box<T>
+{
+    public function __construct(public T $v)
+    {
+    }
+}
diff --git a/test/fixture/check/bare_new_missing_arg/source/Use.xphp b/test/fixture/check/bare_new_missing_arg/source/Use.xphp
new file mode 100644
index 0000000..220602f
--- /dev/null
+++ b/test/fixture/check/bare_new_missing_arg/source/Use.xphp
@@ -0,0 +1,10 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Check\BareNewMissingArg;
+
+// Bare `new` of a non-defaults generic, no turbofish: cannot pad from defaults.
+// Silently emitting would leave the site pointing at the stripped marker
+// `interface Box {}` -> a runtime "cannot instantiate interface" fatal. Rejected.
+$b = new Box(5);
diff --git a/test/fixture/check/bare_new_missing_arg_qualified/source/Box.xphp b/test/fixture/check/bare_new_missing_arg_qualified/source/Box.xphp
new file mode 100644
index 0000000..d9f5523
--- /dev/null
+++ b/test/fixture/check/bare_new_missing_arg_qualified/source/Box.xphp
@@ -0,0 +1,12 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Check\BareNewMissingArgQualified;
+
+class Box<T>
+{
+    public function __construct(public T $v)
+    {
+    }
+}
diff --git a/test/fixture/check/bare_new_missing_arg_qualified/source/Use.xphp b/test/fixture/check/bare_new_missing_arg_qualified/source/Use.xphp
new file mode 100644
index 0000000..4f98c42
--- /dev/null
+++ b/test/fixture/check/bare_new_missing_arg_qualified/source/Use.xphp
@@ -0,0 +1,11 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Check\BareNewMissingArgQualified;
+
+// Fully-qualified and relative spellings must reject with the SAME verdict as the
+// bare spelling -- both resolve to the same non-defaults template. Two diagnostics
+// in one run (check collects, does not throw-on-first).
+$a = new \App\Check\BareNewMissingArgQualified\Box(5);
+$b = new namespace\Box(6);
diff --git a/test/fixture/check/closure_conformance/source/Use.xphp b/test/fixture/check/closure_conformance/source/Use.xphp
new file mode 100644
index 0000000..36007ab
--- /dev/null
+++ b/test/fixture/check/closure_conformance/source/Use.xphp
@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\ClosureCheck;
+
+// The returned literal declares a `string` parameter where the target
+// guarantees only `int` — a provable contravariance violation that
+// `xphp check` must collect (not throw).
+function make(): Closure(int $x): int
+{
+    return fn(string $x): int => 0;
+}
diff --git a/test/fixture/check/closure_static_attributed/source/Use.xphp b/test/fixture/check/closure_static_attributed/source/Use.xphp
new file mode 100644
index 0000000..978580f
--- /dev/null
+++ b/test/fixture/check/closure_static_attributed/source/Use.xphp
@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Check\ClosureStaticAttributed;
+
+#[\Attribute]
+class Marked
+{
+}
+
+// An ATTRIBUTED static generic closure: the attribute moves the closure
+// node's start to `#[`, and the static-closure reject must still fire —
+// silently emitting the closure raw would be far worse than the loud gate.
+$f = #[Marked] static function<T>(T $x): T {
+    return $x;
+};
+
+$r = $f::<int>(1);
diff --git a/test/fixture/check/closure_unspecialized/source/Use.xphp b/test/fixture/check/closure_unspecialized/source/Use.xphp
new file mode 100644
index 0000000..21f34f8
--- /dev/null
+++ b/test/fixture/check/closure_unspecialized/source/Use.xphp
@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Check\Unspecialized;
+
+// Every generic closure below is declared but never turbofish-called —
+// its type-param hints would reach the output as references to
+// non-existent classes. Each draws one diagnostic; the called twin at
+// the bottom draws none.
+
+$f = static fn<T>(T $x): T => $x;
+
+function makes(): callable
+{
+    return fn<U>(U $y): U => $y;
+}
+
+$mapped = array_map(function<V>(V $z): V { return $z; }, [1]);
+
+$w = 5;
+$g = function<W>(W $q) use ($w) { return $q; };
+
+$h = function<X = int>(X $r): X { return $r; };
+
+// Unused type param — dead syntax, rejected uniformly.
+$i = fn<Y>(int $s): int => $s + 1;
+
+// Conditional twins: the if-arm is grounded, the else-arm is an orphan.
+if ($w > 0) { $c = fn<Q>(Q $a): Q => $a; $c::<int>(1); } else { $c = fn<R>(R $b): R => $b; }
+
+// Called — must NOT be flagged.
+$ok = fn<Z>(Z $v): Z => $v;
+$ok::<int>(1);
+
+// Turbofish with a NON-CONCRETE argument (the enclosing template's own
+// parameter): the author wrote a call, so this is not an orphan either.
+function relay<S>(S $v): S
+{
+    $inner = fn<I>(I $x): I => $x;
+    return $inner::<S>($v);
+}
diff --git a/test/fixture/check/dynamic_turbofish_instance/source/Use.xphp b/test/fixture/check/dynamic_turbofish_instance/source/Use.xphp
new file mode 100644
index 0000000..e12045c
--- /dev/null
+++ b/test/fixture/check/dynamic_turbofish_instance/source/Use.xphp
@@ -0,0 +1,10 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App;
+
+function run(object $o, string $m): void
+{
+    $o->$m::<int>(4);
+}
diff --git a/test/fixture/check/dynamic_turbofish_nullsafe/source/Use.xphp b/test/fixture/check/dynamic_turbofish_nullsafe/source/Use.xphp
new file mode 100644
index 0000000..086d927
--- /dev/null
+++ b/test/fixture/check/dynamic_turbofish_nullsafe/source/Use.xphp
@@ -0,0 +1,10 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App;
+
+function run(?object $o, string $m): void
+{
+    $o?->$m::<int>(4);
+}
diff --git a/test/fixture/check/dynamic_turbofish_static/source/Use.xphp b/test/fixture/check/dynamic_turbofish_static/source/Use.xphp
new file mode 100644
index 0000000..de2be77
--- /dev/null
+++ b/test/fixture/check/dynamic_turbofish_static/source/Use.xphp
@@ -0,0 +1,10 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App;
+
+function run(string $m): void
+{
+    Foo::$m::<int>(4);
+}
diff --git a/test/fixture/check/dynamic_turbofish_varvar/source/Use.xphp b/test/fixture/check/dynamic_turbofish_varvar/source/Use.xphp
new file mode 100644
index 0000000..14ebc23
--- /dev/null
+++ b/test/fixture/check/dynamic_turbofish_varvar/source/Use.xphp
@@ -0,0 +1,10 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App;
+
+function run(string $g): void
+{
+    $$g::<int>(4);
+}
diff --git a/test/fixture/check/generic_trait_ambiguous_operand/source/Use.xphp b/test/fixture/check/generic_trait_ambiguous_operand/source/Use.xphp
new file mode 100644
index 0000000..045ea51
--- /dev/null
+++ b/test/fixture/check/generic_trait_ambiguous_operand/source/Use.xphp
@@ -0,0 +1,15 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App;
+
+trait A<T> { public function m(T $x): T { return $x; } }
+trait B<T> { public function m(T $x): T { return $x; } }
+
+class C
+{
+    use A<int>, A<string>, B<int> {
+        A::m insteadof B;
+    }
+}
diff --git a/test/fixture/check/parse_error/source/ClosureVariance.xphp b/test/fixture/check/parse_error/source/ClosureVariance.xphp
index 9b2efed..9f25955 100644
--- a/test/fixture/check/parse_error/source/ClosureVariance.xphp
+++ b/test/fixture/check/parse_error/source/ClosureVariance.xphp
@@ -5,7 +5,7 @@ declare(strict_types=1);
 namespace App\Check\ParseError;
 
 // xphp-specific parse-time rejection (not a PHP syntax error): variance markers
-// are not allowed on closures. Throws a RuntimeException during parse, with no line.
+// are not allowed on closures. Throws during parse, carrying this token's line.
 $f = function <out T>(T $x): T {
     return $x;
 };
diff --git a/test/fixture/check/parse_line_default_ordering/source/Pair.xphp b/test/fixture/check/parse_line_default_ordering/source/Pair.xphp
new file mode 100644
index 0000000..5fbd61d
--- /dev/null
+++ b/test/fixture/check/parse_line_default_ordering/source/Pair.xphp
@@ -0,0 +1,11 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\ParseLine;
+
+
+
+class Pair<T = int, U>
+{
+}
diff --git a/test/fixture/check/parse_line_invalid_default/source/Holder.xphp b/test/fixture/check/parse_line_invalid_default/source/Holder.xphp
new file mode 100644
index 0000000..1994224
--- /dev/null
+++ b/test/fixture/check/parse_line_invalid_default/source/Holder.xphp
@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\ParseLine;
+
+class Holder<T = ?int>
+{
+}
diff --git a/test/fixture/check/parse_line_legacy_variance/source/Box.xphp b/test/fixture/check/parse_line_legacy_variance/source/Box.xphp
new file mode 100644
index 0000000..c786f97
--- /dev/null
+++ b/test/fixture/check/parse_line_legacy_variance/source/Box.xphp
@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\ParseLine;
+
+class Box<+T>
+{
+}
diff --git a/test/fixture/check/parse_line_union_default/source/Slot.xphp b/test/fixture/check/parse_line_union_default/source/Slot.xphp
new file mode 100644
index 0000000..94a11b2
--- /dev/null
+++ b/test/fixture/check/parse_line_union_default/source/Slot.xphp
@@ -0,0 +1,11 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\ParseLine;
+
+
+
+class Slot<T = Foo | Bar>
+{
+}
diff --git a/test/fixture/check/parse_line_variance_method/source/Animal.xphp b/test/fixture/check/parse_line_variance_method/source/Animal.xphp
new file mode 100644
index 0000000..836c942
--- /dev/null
+++ b/test/fixture/check/parse_line_variance_method/source/Animal.xphp
@@ -0,0 +1,12 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\ParseLine;
+
+class Animal
+{
+    public function eat<out T>(T $food): void
+    {
+    }
+}
diff --git a/test/fixture/check/parse_self_bound/source/SelfBound.xphp b/test/fixture/check/parse_self_bound/source/SelfBound.xphp
new file mode 100644
index 0000000..fbbd942
--- /dev/null
+++ b/test/fixture/check/parse_self_bound/source/SelfBound.xphp
@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\ParseLine;
+
+class SelfBound<T : T>
+{
+}
diff --git a/test/fixture/check/undeclared_type_param_method/source/Util.xphp b/test/fixture/check/undeclared_type_param_method/source/Util.xphp
index 5a8dcaa..8197dbe 100644
--- a/test/fixture/check/undeclared_type_param_method/source/Util.xphp
+++ b/test/fixture/check/undeclared_type_param_method/source/Util.xphp
@@ -20,9 +20,13 @@ function wrap<A>(C $x): A
     return $x;
 }
 
-// Generic closure and arrow: `D` and `E` are stray parameters.
+// Generic closure and arrow: `D` and `E` are stray parameters. Both are
+// turbofish-called so the only diagnostics here stay the undeclared-type
+// ones (an uncalled generic closure draws its own, different error).
 $closure = function<A>(D $x): A {
     return $x;
 };
+$closure::<int>(1);
 
 $arrow = fn<A>(E $x): A => $x;
+$arrow::<int>(2);
diff --git a/test/fixture/check/use_generic_import_aliased/source/C.xphp b/test/fixture/check/use_generic_import_aliased/source/C.xphp
new file mode 100644
index 0000000..7df0966
--- /dev/null
+++ b/test/fixture/check/use_generic_import_aliased/source/C.xphp
@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Main;
+
+use App\Box<int> as B;
+
+class C {}
diff --git a/test/fixture/check/use_generic_import_const/source/C.xphp b/test/fixture/check/use_generic_import_const/source/C.xphp
new file mode 100644
index 0000000..8bd9155
--- /dev/null
+++ b/test/fixture/check/use_generic_import_const/source/C.xphp
@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Main;
+
+use const App\BOX<int>;
+
+class C {}
diff --git a/test/fixture/check/use_generic_import_grouped/source/C.xphp b/test/fixture/check/use_generic_import_grouped/source/C.xphp
new file mode 100644
index 0000000..1a368ac
--- /dev/null
+++ b/test/fixture/check/use_generic_import_grouped/source/C.xphp
@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Main;
+
+use App\{Box<int>, Bag};
+
+class C {}
diff --git a/test/fixture/check/use_generic_import_grouped_prefix/source/C.xphp b/test/fixture/check/use_generic_import_grouped_prefix/source/C.xphp
new file mode 100644
index 0000000..3ce4576
--- /dev/null
+++ b/test/fixture/check/use_generic_import_grouped_prefix/source/C.xphp
@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Main;
+
+use App<int>\{Box};
+
+class C {}
diff --git a/test/fixture/check/use_generic_import_shadowed_name/source/C.xphp b/test/fixture/check/use_generic_import_shadowed_name/source/C.xphp
new file mode 100644
index 0000000..3cbfe44
--- /dev/null
+++ b/test/fixture/check/use_generic_import_shadowed_name/source/C.xphp
@@ -0,0 +1,11 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Main;
+
+use App\Box as B1;
+
+use App\Box<int> as B2;
+
+class C {}
diff --git a/test/fixture/check/use_generic_import_single/source/C.xphp b/test/fixture/check/use_generic_import_single/source/C.xphp
new file mode 100644
index 0000000..e4ac40f
--- /dev/null
+++ b/test/fixture/check/use_generic_import_single/source/C.xphp
@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Main;
+
+use App\Box<int>;
+
+class C {}
diff --git a/test/fixture/check/use_grouped_import_clean/source/C.xphp b/test/fixture/check/use_grouped_import_clean/source/C.xphp
new file mode 100644
index 0000000..937c3df
--- /dev/null
+++ b/test/fixture/check/use_grouped_import_clean/source/C.xphp
@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Main;
+
+use App\{Box, Bag};
+
+class C {}
diff --git a/test/fixture/check/use_ordinary_import_clean/source/C.xphp b/test/fixture/check/use_ordinary_import_clean/source/C.xphp
new file mode 100644
index 0000000..2dc5a79
--- /dev/null
+++ b/test/fixture/check/use_ordinary_import_clean/source/C.xphp
@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Main;
+
+use App\Box;
+
+class C {}
diff --git a/test/fixture/compile/array_sugar_before_generic_closure/source/Use.xphp b/test/fixture/compile/array_sugar_before_generic_closure/source/Use.xphp
new file mode 100644
index 0000000..2836be0
--- /dev/null
+++ b/test/fixture/compile/array_sugar_before_generic_closure/source/Use.xphp
@@ -0,0 +1,25 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\ArraySugarMarkerOffset;
+
+// The `VeryLongRecordName[]` sugar rewrites to the shorter `array`,
+// shifting every byte after it; the generic closure below must still
+// specialize and route both turbofish calls.
+final class VeryLongRecordName
+{
+}
+
+function countRecords(VeryLongRecordName[] $records): int
+{
+    return \count($records);
+}
+
+$id = function<T>(T $x): T {
+    return $x;
+};
+
+$n = countRecords([new VeryLongRecordName()]);
+$a = $id::<int>(42);
+$b = $id::<string>('hello');
diff --git a/test/fixture/compile/array_sugar_before_generic_closure/verify/runtime.php b/test/fixture/compile/array_sugar_before_generic_closure/verify/runtime.php
new file mode 100644
index 0000000..64bf482
--- /dev/null
+++ b/test/fixture/compile/array_sugar_before_generic_closure/verify/runtime.php
@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `array_sugar_before_generic_closure`. The
+ * `VeryLongRecordName[]` rewrite shortens the file before the generic
+ * closure; the closure must still specialize and route both calls.
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope.
+ */
+
+use PHPUnit\Framework\Assert;
+
+require $fixture->targetDir . '/Use.php';
+
+Assert::assertSame(1, $n);
+Assert::assertSame(42, $a);
+Assert::assertSame('hello', $b);
diff --git a/test/fixture/compile/attributed_generic_closures/source/Use.xphp b/test/fixture/compile/attributed_generic_closures/source/Use.xphp
new file mode 100644
index 0000000..16c1a08
--- /dev/null
+++ b/test/fixture/compile/attributed_generic_closures/source/Use.xphp
@@ -0,0 +1,47 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\AttributedClosures;
+
+// Attribute groups and the `static` modifier precede the `function` / `fn`
+// keyword, but php-parser starts the closure node at its FIRST token — the
+// generic marker must anchor there too, or the closure silently loses its
+// type params and the emitted code keeps raw `T` hints that fatal at runtime.
+
+#[\Attribute]
+class Marked
+{
+}
+
+#[\Attribute]
+class Tagged
+{
+    public function __construct(public array $xs)
+    {
+    }
+}
+
+$plain = #[Marked] function<T>(T $x): T {
+    return $x;
+};
+
+$arrow = #[Marked] fn<T>(T $x): T => $x;
+
+$sfn = static fn<T>(T $x): T => $x;
+
+// Two groups, one with an array argument (inner brackets must balance),
+// plus `static` — the node starts at the first `#[`.
+$both = #[Marked] #[Tagged([1, 2])] static fn<T>(T $x): T => $x;
+
+// Attribute on its own line — the walk back to the node start crosses it.
+$split = #[Marked]
+function<T>(T $x): T {
+    return $x;
+};
+
+$a = $plain::<int>(7);
+$b = $arrow::<string>('b');
+$c = $sfn::<int>(3);
+$d = $both::<string>('d');
+$e = $split::<int>(11);
diff --git a/test/fixture/compile/attributed_generic_closures/verify/runtime.php b/test/fixture/compile/attributed_generic_closures/verify/runtime.php
new file mode 100644
index 0000000..31f7805
--- /dev/null
+++ b/test/fixture/compile/attributed_generic_closures/verify/runtime.php
@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `attributed_generic_closures`. Attributed and/or
+ * static generic closures and arrows must specialize (not silently keep
+ * raw type-param hints), and the emitted program must execute.
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope.
+ */
+
+use PHPUnit\Framework\Assert;
+
+require $fixture->targetDir . '/Use.php';
+
+Assert::assertSame(7, $a);
+Assert::assertSame('b', $b);
+Assert::assertSame(3, $c);
+Assert::assertSame('d', $d);
+Assert::assertSame(11, $e);
diff --git a/test/fixture/compile/bare_new_self_in_generic_body/source/Use.xphp b/test/fixture/compile/bare_new_self_in_generic_body/source/Use.xphp
new file mode 100644
index 0000000..7fda6ab
--- /dev/null
+++ b/test/fixture/compile/bare_new_self_in_generic_body/source/Use.xphp
@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\BareNewSelfInGenericBody;
+
+// `new self` (no turbofish) inside a NON-defaults generic body must NOT be rejected
+// by the bare-new guard: `self` resolves to no template, and the Specializer rewrites
+// it to the specialized class per instantiation. The guard only fires on a bare `new`
+// of the *template name*.
+class Node<T>
+{
+    public function __construct(public T $v)
+    {
+    }
+
+    public function copy(): self
+    {
+        return new self($this->v);
+    }
+}
+
+$n = new Node::<int>(5);
+$c = $n->copy();
diff --git a/test/fixture/compile/bare_new_self_in_generic_body/verify/runtime.php b/test/fixture/compile/bare_new_self_in_generic_body/verify/runtime.php
new file mode 100644
index 0000000..f4cf154
--- /dev/null
+++ b/test/fixture/compile/bare_new_self_in_generic_body/verify/runtime.php
@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `bare_new_self_in_generic_body`: a bare `new self` inside a
+ * non-defaults generic body compiles (not rejected by the WI-06 bare-new guard) and
+ * runs -- `$c` is a copy of `$n` produced by `new self`, carrying the same value.
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope, autoloader registered.
+ */
+
+use PHPUnit\Framework\Assert;
+
+require $fixture->targetDir . '/Use.php';
+
+Assert::assertSame(5, $n->v);
+Assert::assertSame(5, $c->v);
+Assert::assertNotSame($n, $c);
diff --git a/test/fixture/compile/closure_conformance_array_sugar_runtime/source/Use.xphp b/test/fixture/compile/closure_conformance_array_sugar_runtime/source/Use.xphp
new file mode 100644
index 0000000..913c7b0
--- /dev/null
+++ b/test/fixture/compile/closure_conformance_array_sugar_runtime/source/Use.xphp
@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\ClosureConformanceArraySugarRuntime;
+
+// Array-sugar inside `Closure(...)` signatures: the sugared parameter and
+// return leaves lower to `array`, the signatures erase to a bare `\Closure`,
+// arity checking holds (the factory literals below conform), and the
+// compiled output executes.
+final class Item
+{
+    public function __construct(public int $v)
+    {
+    }
+}
+
+function makeSummer(): Closure(Item[] $items): int
+{
+    return fn(array $items): int => array_sum(array_map(fn(Item $i): int => $i->v, $items));
+}
+
+function makeLister(): Closure(): int[]
+{
+    return fn(): array => [40, 2];
+}
+
+$sum = (makeSummer())([new Item(40), new Item(2)]);
+$list = (makeLister())();
diff --git a/test/fixture/compile/closure_conformance_array_sugar_runtime/verify/runtime.php b/test/fixture/compile/closure_conformance_array_sugar_runtime/verify/runtime.php
new file mode 100644
index 0000000..554aa70
--- /dev/null
+++ b/test/fixture/compile/closure_conformance_array_sugar_runtime/verify/runtime.php
@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `closure_conformance_array_sugar_runtime`.
+ *
+ * Array-sugar leaves in signature parameter and return positions lower to
+ * `array`, the signatures erase, and the compiled output executes.
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope.
+ */
+
+use PHPUnit\Framework\Assert;
+
+require $fixture->targetDir . '/Use.php';
+
+Assert::assertSame(42, $sum, 'sugared-parameter factory closure ran');
+Assert::assertSame([40, 2], $list, 'sugared-return factory closure ran');
+
+// Full erasure: no bracket-pair residue may survive into the emitted output
+// (the trailing `[40, 2]` array literal is body code, not a type).
+$emitted = file_get_contents($fixture->targetDir . '/Use.php');
+Assert::assertIsString($emitted);
+Assert::assertStringContainsString('\\Closure', $emitted);
+Assert::assertStringNotContainsString('Item[]', $emitted);
+Assert::assertStringNotContainsString('int[]', $emitted);
diff --git a/test/fixture/compile/closure_conformance_builtin_ok/source/Use.xphp b/test/fixture/compile/closure_conformance_builtin_ok/source/Use.xphp
new file mode 100644
index 0000000..3d715e6
--- /dev/null
+++ b/test/fixture/compile/closure_conformance_builtin_ok/source/Use.xphp
@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\ClosureBuiltinOk;
+
+// Regression: an exception factory. `MyException` is a user subclass of the
+// built-in `\Exception`, which is a `\Throwable`. The hierarchy models no edges
+// for PHP built-ins, so conformance must accept this gradually rather than
+// false-reject a valid, idiomatic factory.
+class MyException extends \Exception
+{
+}
+
+function makeThrower(): Closure(): \Throwable
+{
+    return fn(): MyException => new MyException('boom');
+}
+
+$factory = makeThrower();
+$thrown = $factory();
diff --git a/test/fixture/compile/closure_conformance_builtin_ok/verify/runtime.php b/test/fixture/compile/closure_conformance_builtin_ok/verify/runtime.php
new file mode 100644
index 0000000..bb7d61c
--- /dev/null
+++ b/test/fixture/compile/closure_conformance_builtin_ok/verify/runtime.php
@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `closure_conformance_builtin_ok`.
+ *
+ * The exception factory compiles (no false-reject against the built-in
+ * `\Throwable` target), erases to `\Closure`, and runs.
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope.
+ */
+
+use PHPUnit\Framework\Assert;
+
+require $fixture->targetDir . '/Use.php';
+
+Assert::assertInstanceOf(\Throwable::class, $thrown, 'the factory returned a Throwable');
+Assert::assertSame('boom', $thrown->getMessage());
diff --git a/test/fixture/compile/closure_conformance_dnf_runtime/source/Use.xphp b/test/fixture/compile/closure_conformance_dnf_runtime/source/Use.xphp
new file mode 100644
index 0000000..084ee26
--- /dev/null
+++ b/test/fixture/compile/closure_conformance_dnf_runtime/source/Use.xphp
@@ -0,0 +1,54 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\ClosureConformanceDnfRuntime;
+
+// DNF groups inside `Closure(...)` signatures: `(A&B)|C` leaves are gradual
+// (never checked for member variance) but the signature itself must scan,
+// erase to a bare `\Closure`, and keep its arity/return intact. Every literal
+// here conforms; the emitted PHP executes.
+interface Tagged
+{
+    public function tag(): string;
+}
+
+interface Counted
+{
+    public function count(): int;
+}
+
+final class Both implements Tagged, Counted
+{
+    public function tag(): string
+    {
+        return 'both';
+    }
+
+    public function count(): int
+    {
+        return 21;
+    }
+}
+
+final class Plain
+{
+}
+
+// S-A, leading DNF group in a PARAMETER: the grouped intersection-or-Plain
+// hint is ONE parameter — the factory's literal matches that arity.
+function makeCounter(): Closure((Tagged&Counted)|Plain $x): int
+{
+    return fn($x): int => $x instanceof Counted ? $x->count() * 2 : 0;
+}
+
+// S-A, trailing DNF group in the RETURN: the whole grouped union erases —
+// no residue may survive into the emitted return hint.
+function makeBoth(): Closure(): Plain|(Tagged&Counted)
+{
+    return fn(): Both => new Both();
+}
+
+$count = (makeCounter())(new Both());
+$made = (makeBoth())();
+$tag = $made->tag();
diff --git a/test/fixture/compile/closure_conformance_dnf_runtime/verify/runtime.php b/test/fixture/compile/closure_conformance_dnf_runtime/verify/runtime.php
new file mode 100644
index 0000000..46d9618
--- /dev/null
+++ b/test/fixture/compile/closure_conformance_dnf_runtime/verify/runtime.php
@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `closure_conformance_dnf_runtime`.
+ *
+ * DNF-grouped signature types scan as one gradual leaf, the signatures erase,
+ * and the compiled output executes. Asserts both factories' closures ran.
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope.
+ */
+
+use PHPUnit\Framework\Assert;
+
+require $fixture->targetDir . '/Use.php';
+
+Assert::assertSame(42, $count, 'DNF-parameter factory closure ran');
+Assert::assertSame('both', $tag, 'DNF-return factory closure ran');
+
+// Full erasure: no DNF residue may survive into the emitted output.
+$emitted = file_get_contents($fixture->targetDir . '/Use.php');
+Assert::assertIsString($emitted);
+Assert::assertStringContainsString('\\Closure', $emitted);
+Assert::assertStringNotContainsString('(Tagged&Counted)', $emitted);
+Assert::assertStringNotContainsString('|(', $emitted);
diff --git a/test/fixture/compile/closure_conformance_grounded_reject/source/Use.xphp b/test/fixture/compile/closure_conformance_grounded_reject/source/Use.xphp
new file mode 100644
index 0000000..796a366
--- /dev/null
+++ b/test/fixture/compile/closure_conformance_grounded_reject/source/Use.xphp
@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\ClosureGroundReject;
+
+// At the template `Closure(T $x): T` is gradual, so the `string`-parameter
+// literal is accepted. Specialized as `Box<int>` the target grounds to
+// `Closure(int $x): int`; now the literal's `string` parameter is provably not
+// wider than `int`, so compilation must fail.
+class Box<T>
+{
+    public function make(): Closure(T $x): T
+    {
+        return fn(string $x): int => 0;
+    }
+}
+
+$box = new Box::<int>();
diff --git a/test/fixture/compile/closure_conformance_grounded_runtime/source/Use.xphp b/test/fixture/compile/closure_conformance_grounded_runtime/source/Use.xphp
new file mode 100644
index 0000000..0d5a676
--- /dev/null
+++ b/test/fixture/compile/closure_conformance_grounded_runtime/source/Use.xphp
@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\ClosureGroundRuntime;
+
+// The `Closure(...)` return target references the class type parameter `T`. At
+// the template it is abstract (gradual); specialized as `Box<int>` it grounds to
+// `Closure(int $x): int`, and the returned literal `fn(int $x): int` conforms.
+class Box<T>
+{
+    public function make(): Closure(T $x): T
+    {
+        return fn(int $x): int => $x + 40;
+    }
+}
+
+$box = new Box::<int>();
+$factory = $box->make();
+$result = $factory(2); // 2 + 40 = 42
diff --git a/test/fixture/compile/closure_conformance_grounded_runtime/verify/runtime.php b/test/fixture/compile/closure_conformance_grounded_runtime/verify/runtime.php
new file mode 100644
index 0000000..cd10a58
--- /dev/null
+++ b/test/fixture/compile/closure_conformance_grounded_runtime/verify/runtime.php
@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `closure_conformance_grounded_runtime`.
+ *
+ * The type parameter grounds to `int`; the conforming factory closure compiles,
+ * its `Closure(...)` target erases to `\Closure`, and it runs.
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope.
+ */
+
+use PHPUnit\Framework\Assert;
+
+require $fixture->targetDir . '/Use.php';
+
+Assert::assertSame(42, $result, 'the grounded factory closure ran');
diff --git a/test/fixture/compile/closure_conformance_grounded_union_reject/source/Use.xphp b/test/fixture/compile/closure_conformance_grounded_union_reject/source/Use.xphp
new file mode 100644
index 0000000..a2ac0ae
--- /dev/null
+++ b/test/fixture/compile/closure_conformance_grounded_union_reject/source/Use.xphp
@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\ClosureUnionGround;
+
+class Fruit
+{
+}
+
+// At the template, `Closure(): T|int` has a gradual `T` member, so the class
+// return literal is accepted. Specialized as `Box<string>`, the union grounds to
+// `string|int` — the `Fruit` literal is provably neither, so compilation fails.
+class Box<T>
+{
+    public function make(): Closure(): T|int
+    {
+        return fn(): Fruit => new Fruit();
+    }
+}
+
+$box = new Box::<string>();
diff --git a/test/fixture/compile/closure_conformance_reject/source/Use.xphp b/test/fixture/compile/closure_conformance_reject/source/Use.xphp
new file mode 100644
index 0000000..ff8ecd1
--- /dev/null
+++ b/test/fixture/compile/closure_conformance_reject/source/Use.xphp
@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\ClosureConformanceReject;
+
+// The returned literal declares a `string` parameter where the target
+// `Closure(int $x): int` guarantees only `int` — a provable contravariance
+// violation. Compilation must fail; there is no valid runtime.
+function make(): Closure(int $x): int
+{
+    return fn(string $x): int => 0;
+}
diff --git a/test/fixture/compile/closure_conformance_runtime/source/Use.xphp b/test/fixture/compile/closure_conformance_runtime/source/Use.xphp
new file mode 100644
index 0000000..d9e9e8e
--- /dev/null
+++ b/test/fixture/compile/closure_conformance_runtime/source/Use.xphp
@@ -0,0 +1,48 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\ClosureConformanceRuntime;
+
+// Closure-signature types at their one statically decidable literal site: a
+// `Closure(...)` RETURN handing back a closure literal (a typed-closure factory).
+// Every literal here CONFORMS; the emitted PHP erases each `Closure(...)` to a
+// bare `\Closure` and runs unchanged.
+class Factory
+{
+    // A `Closure(...)`-typed property, assigned (not defaulted — a closure is not
+    // a constant expression) in the constructor. The assignment is a gradual site
+    // (unchecked); it exists to exercise a stored typed closure at runtime.
+    public Closure(int $x): int $scale;
+
+    public function __construct()
+    {
+        $this->scale = fn(int $x): int => $x * 2;
+    }
+
+    // S-A, return position (method): the returned arrow conforms to the target.
+    public function adder(): Closure(int $x): int
+    {
+        return fn(int $x): int => $x + 40;
+    }
+
+    public function scaled(int $n): int
+    {
+        return ($this->scale)($n);
+    }
+}
+
+// S-A, return position (free function).
+function makeAdder(): Closure(int $x): int
+{
+    return fn(int $x): int => $x + 1;
+}
+
+// S-A, arrow body: the arrow's own body IS the returned literal.
+$mulFactory = fn(): Closure(int $x): int => fn(int $x): int => $x * 3;
+
+$f = new Factory();
+$scaled = $f->scaled(21);        // 21 * 2 = 42
+$added = ($f->adder())(2);       // 2 + 40 = 42
+$incremented = (makeAdder())(41); // 41 + 1 = 42
+$tripled = ($mulFactory())(14);  // 14 * 3 = 42
diff --git a/test/fixture/compile/closure_conformance_runtime/verify/runtime.php b/test/fixture/compile/closure_conformance_runtime/verify/runtime.php
new file mode 100644
index 0000000..d117343
--- /dev/null
+++ b/test/fixture/compile/closure_conformance_runtime/verify/runtime.php
@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `closure_conformance_runtime`.
+ *
+ * Every `Closure(...)` return site holds a CONFORMING literal, so the file
+ * compiles clean and the erased-to-`\Closure` output executes. Asserts the
+ * factories' closures actually ran with the values they were built from.
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope.
+ */
+
+use PHPUnit\Framework\Assert;
+
+require $fixture->targetDir . '/Use.php';
+
+Assert::assertSame(42, $scaled, 'stored property closure ran');
+Assert::assertSame(42, $added, 'method-return factory closure ran');
+Assert::assertSame(42, $incremented, 'free-function factory closure ran');
+Assert::assertSame(42, $tripled, 'arrow-body factory closure ran');
+
+// The erased output must carry a bare \Closure, never a residual `Closure(int`.
+$emitted = file_get_contents($fixture->targetDir . '/Use.php');
+Assert::assertIsString($emitted);
+Assert::assertStringContainsString('\\Closure', $emitted);
+Assert::assertStringNotContainsString('Closure(int', $emitted);
diff --git a/test/fixture/compile/closure_named_user_function_runtime/source/Use.xphp b/test/fixture/compile/closure_named_user_function_runtime/source/Use.xphp
new file mode 100644
index 0000000..3433925
--- /dev/null
+++ b/test/fixture/compile/closure_named_user_function_runtime/source/Use.xphp
@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\ClosureNamedUserFunction;
+
+// A user function named `Closure` (legal in a namespace) called in the
+// expression positions whose `) :` token pair looks like a return-type slot —
+// ternary else, alt-syntax if, case label. None of these are type slots; the
+// calls must survive compilation untouched and execute. The arguments are
+// CONSTANT NAMES on purpose: a literal argument never even reaches the
+// position gate, a name-token argument does.
+const HALF = 21;
+const TEN = 10;
+const SIX = 6;
+
+function Closure(int $n): int
+{
+    return $n * 2;
+}
+
+$flag = false;
+$ternary = $flag ? strlen('x') : Closure(HALF);
+
+$alt = 0;
+if (!$flag): $alt = Closure(TEN); endif;
+
+$case = 0;
+switch (true) { case boolval(1): $case = Closure(SIX); }
diff --git a/test/fixture/compile/closure_named_user_function_runtime/verify/runtime.php b/test/fixture/compile/closure_named_user_function_runtime/verify/runtime.php
new file mode 100644
index 0000000..08f270d
--- /dev/null
+++ b/test/fixture/compile/closure_named_user_function_runtime/verify/runtime.php
@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `closure_named_user_function_runtime`.
+ *
+ * The user function named `Closure` is CALLED (not erased) in every
+ * expression position that shares a `) :` token pair with return-type slots.
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope.
+ */
+
+use PHPUnit\Framework\Assert;
+
+require $fixture->targetDir . '/Use.php';
+
+Assert::assertSame(42, $ternary, 'ternary-else call to App\\...\\Closure() executed');
+Assert::assertSame(20, $alt, 'alt-syntax-if call executed');
+Assert::assertSame(12, $case, 'case-label call executed');
+
+// The calls survive verbatim — no bare `\Closure` constant fetch anywhere.
+$emitted = file_get_contents($fixture->targetDir . '/Use.php');
+Assert::assertIsString($emitted);
+Assert::assertStringNotContainsString('\\Closure ', $emitted);
+Assert::assertStringContainsString('Closure(HALF)', $emitted);
diff --git a/test/fixture/compile/covariant_gapfill_free_symbol/source/AbstractColl.xphp b/test/fixture/compile/covariant_gapfill_free_symbol/source/AbstractColl.xphp
new file mode 100644
index 0000000..fb942ea
--- /dev/null
+++ b/test/fixture/compile/covariant_gapfill_free_symbol/source/AbstractColl.xphp
@@ -0,0 +1,21 @@
+<?php
+declare(strict_types=1);
+namespace App;
+abstract class AbstractColl<out E> implements Collection<E>, Lookup<E>
+{
+    /** @var list<mixed> */
+    protected array $items;
+    public function __construct(E ...$items) { $this->items = $items; }
+    // Erasable bodies reference an in-unit free function `tally` and an in-unit const `OFFSET`.
+    // After a covariant edge, `contains`/`indexOf` are gap-filled onto the concrete specs (Lst, Bag)
+    // in the relocated XPHP\Generated namespace; a bare `tally`/`OFFSET` would rebind there and fatal.
+    public function contains<S : E>(S $element): bool
+    {
+        return tally(OFFSET) === 10 && \in_array($element, $this->items, true) === false;
+    }
+    public function indexOf<S : E>(S $element): int
+    {
+        $i = \array_search($element, $this->items, true);
+        return $i === false ? -OFFSET + tally(3) : (int) $i;
+    }
+}
diff --git a/test/fixture/compile/covariant_gapfill_free_symbol/source/Bag.xphp b/test/fixture/compile/covariant_gapfill_free_symbol/source/Bag.xphp
new file mode 100644
index 0000000..d184fec
--- /dev/null
+++ b/test/fixture/compile/covariant_gapfill_free_symbol/source/Bag.xphp
@@ -0,0 +1,4 @@
+<?php
+declare(strict_types=1);
+namespace App;
+class Bag<out E> extends AbstractColl<E> implements Collection<E>, Lookup<E> {}
diff --git a/test/fixture/compile/covariant_gapfill_free_symbol/source/Book.xphp b/test/fixture/compile/covariant_gapfill_free_symbol/source/Book.xphp
new file mode 100644
index 0000000..4c87df5
--- /dev/null
+++ b/test/fixture/compile/covariant_gapfill_free_symbol/source/Book.xphp
@@ -0,0 +1,4 @@
+<?php
+declare(strict_types=1);
+namespace App;
+class Book extends Product {}
diff --git a/test/fixture/compile/covariant_gapfill_free_symbol/source/Collection.xphp b/test/fixture/compile/covariant_gapfill_free_symbol/source/Collection.xphp
new file mode 100644
index 0000000..05a44ae
--- /dev/null
+++ b/test/fixture/compile/covariant_gapfill_free_symbol/source/Collection.xphp
@@ -0,0 +1,7 @@
+<?php
+declare(strict_types=1);
+namespace App;
+interface Collection<out E>
+{
+    public function contains<S : E>(S $element): bool;
+}
diff --git a/test/fixture/compile/covariant_gapfill_free_symbol/source/Couple.xphp b/test/fixture/compile/covariant_gapfill_free_symbol/source/Couple.xphp
new file mode 100644
index 0000000..3aa2790
--- /dev/null
+++ b/test/fixture/compile/covariant_gapfill_free_symbol/source/Couple.xphp
@@ -0,0 +1,9 @@
+<?php
+declare(strict_types=1);
+namespace App;
+class Couple<out A, out B> implements Tuple<A, B>
+{
+    public function __construct(private A $a, private B $b) {}
+    public function first(): A { return $this->a; }
+    public function second(): B { return $this->b; }
+}
diff --git a/test/fixture/compile/covariant_gapfill_free_symbol/source/Lookup.xphp b/test/fixture/compile/covariant_gapfill_free_symbol/source/Lookup.xphp
new file mode 100644
index 0000000..0146582
--- /dev/null
+++ b/test/fixture/compile/covariant_gapfill_free_symbol/source/Lookup.xphp
@@ -0,0 +1,7 @@
+<?php
+declare(strict_types=1);
+namespace App;
+interface Lookup<out E>
+{
+    public function indexOf<S : E>(S $element): int;
+}
diff --git a/test/fixture/compile/covariant_gapfill_free_symbol/source/Lst.xphp b/test/fixture/compile/covariant_gapfill_free_symbol/source/Lst.xphp
new file mode 100644
index 0000000..0230069
--- /dev/null
+++ b/test/fixture/compile/covariant_gapfill_free_symbol/source/Lst.xphp
@@ -0,0 +1,4 @@
+<?php
+declare(strict_types=1);
+namespace App;
+class Lst<out E> extends AbstractColl<E> implements Collection<E>, Lookup<E> {}
diff --git a/test/fixture/compile/covariant_gapfill_free_symbol/source/Product.xphp b/test/fixture/compile/covariant_gapfill_free_symbol/source/Product.xphp
new file mode 100644
index 0000000..1a4843f
--- /dev/null
+++ b/test/fixture/compile/covariant_gapfill_free_symbol/source/Product.xphp
@@ -0,0 +1,4 @@
+<?php
+declare(strict_types=1);
+namespace App;
+class Product {}
diff --git a/test/fixture/compile/covariant_gapfill_free_symbol/source/Tuple.xphp b/test/fixture/compile/covariant_gapfill_free_symbol/source/Tuple.xphp
new file mode 100644
index 0000000..5fad2b4
--- /dev/null
+++ b/test/fixture/compile/covariant_gapfill_free_symbol/source/Tuple.xphp
@@ -0,0 +1,8 @@
+<?php
+declare(strict_types=1);
+namespace App;
+interface Tuple<out A, out B>
+{
+    public function first(): A;
+    public function second(): B;
+}
diff --git a/test/fixture/compile/covariant_gapfill_free_symbol/source/Use.xphp b/test/fixture/compile/covariant_gapfill_free_symbol/source/Use.xphp
new file mode 100644
index 0000000..8a259f5
--- /dev/null
+++ b/test/fixture/compile/covariant_gapfill_free_symbol/source/Use.xphp
@@ -0,0 +1,26 @@
+<?php
+declare(strict_types=1);
+namespace App;
+// Same diamond as covariant_upcast_multipath_diamond, but the erasable bodies call an in-unit free
+// function `tally` and read an in-unit const `OFFSET`. The post-edge gap-fill appends `contains`/`indexOf`
+// onto the CONCRETE specs (Lst<Tuple<Book,Book>>, Bag<Tuple<Book,Book>>) for the sibling element supertype
+// Tuple<Book,Product> AFTER the relocation sweep — so those bodies must still bind `tally`/`OFFSET` to App.
+// The upcast calls below dispatch to exactly those gap-filled members (not the base-carried ones).
+function has(Collection<Tuple<Book, Product>> $c): bool
+{
+    return $c->contains::<Tuple<Book, Product>>(new Couple::<Book, Product>(new Book(), new Product()));
+}
+function at(Lookup<Tuple<Book, Product>> $c): int
+{
+    return $c->indexOf::<Tuple<Book, Product>>(new Couple::<Book, Product>(new Book(), new Product()));
+}
+$lbb = new Lst::<Tuple<Book, Book>>(new Couple::<Book, Book>(new Book(), new Book()));
+$lbp = new Lst::<Tuple<Book, Product>>(new Couple::<Book, Product>(new Book(), new Product()));
+$lpb = new Lst::<Tuple<Product, Book>>(new Couple::<Product, Book>(new Product(), new Book()));
+$lpp = new Lst::<Tuple<Product, Product>>(new Couple::<Product, Product>(new Product(), new Product()));
+$bbb = new Bag::<Tuple<Book, Book>>(new Couple::<Book, Book>(new Book(), new Book()));
+$bbp = new Bag::<Tuple<Book, Product>>(new Couple::<Book, Product>(new Book(), new Product()));
+$bpb = new Bag::<Tuple<Product, Book>>(new Couple::<Product, Book>(new Product(), new Book()));
+$bpp = new Bag::<Tuple<Product, Product>>(new Couple::<Product, Product>(new Product(), new Product()));
+$found = has($lbb);
+$index = at($bbb);
diff --git a/test/fixture/compile/covariant_gapfill_free_symbol/source/helpers.xphp b/test/fixture/compile/covariant_gapfill_free_symbol/source/helpers.xphp
new file mode 100644
index 0000000..30e477c
--- /dev/null
+++ b/test/fixture/compile/covariant_gapfill_free_symbol/source/helpers.xphp
@@ -0,0 +1,5 @@
+<?php
+declare(strict_types=1);
+namespace App;
+const OFFSET = 5;
+function tally(int $n): int { return $n * 2; }
diff --git a/test/fixture/compile/covariant_gapfill_free_symbol/verify/runtime.php b/test/fixture/compile/covariant_gapfill_free_symbol/verify/runtime.php
new file mode 100644
index 0000000..7dbef1c
--- /dev/null
+++ b/test/fixture/compile/covariant_gapfill_free_symbol/verify/runtime.php
@@ -0,0 +1,23 @@
+<?php
+declare(strict_types=1);
+/**
+ * Runtime verify for `covariant_gapfill_free_symbol`.
+ *
+ * A covariant diamond forces `contains`/`indexOf` to be gap-filled onto the concrete specs (Lst, Bag)
+ * AFTER the relocation sweep runs. Their erasable bodies read an in-unit const `OFFSET` and call an
+ * in-unit free function `tally`; both live in `App` but the specialized bodies live in `XPHP\Generated`.
+ * The upcast `contains` (via Lst) returns true — tally(OFFSET)===10 AND the tuple is absent — and the
+ * upcast `indexOf` (via Bag) returns -OFFSET + tally(3) = 1 for the absent tuple. A bare reference that
+ * rebinds to the generated namespace would fatal ("undefined function XPHP\Generated\App\Lst\tally").
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope, autoload registered.
+ */
+use PHPUnit\Framework\Assert;
+
+// Free functions/consts aren't autoloadable, so define them before Use.php runs.
+require $fixture->targetDir . '/helpers.php';
+require $fixture->targetDir . '/Use.php';
+
+Assert::assertTrue($found, 'the upcast contains-call (via Lst) must bind the App free symbols and report the tuple absent');
+Assert::assertSame(1, $index, 'the upcast indexOf-call (via Bag) must compute -OFFSET + tally(3) = 1 for the absent tuple');
+echo "OK\n";
diff --git a/test/fixture/compile/free_symbol_group_use_import/source/Use.xphp b/test/fixture/compile/free_symbol_group_use_import/source/Use.xphp
new file mode 100644
index 0000000..a755f5f
--- /dev/null
+++ b/test/fixture/compile/free_symbol_group_use_import/source/Use.xphp
@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App;
+
+// Group-form imports: `use function Vendor\{make, scale}` and a mixed
+// `use Vendor\{const RATE, const STEP}`. Group-use was never indexed into the
+// function/const symbol maps, so after Wrap relocates into XPHP\Generated\App\Wrap
+// these references would rebind to the generated namespace (then global) and fatal.
+// They must fully-qualify to the Vendor symbols exactly like the single-import form.
+use function Vendor\{make, scale};
+use Vendor\{const RATE, const STEP};
+
+class Wrap<T>
+{
+    public function compute(T $seed): int
+    {
+        return make(3) + scale(1) + RATE + STEP;
+    }
+}
+
+$wrap = new Wrap::<int>();
+$computed = $wrap->compute(0);
diff --git a/test/fixture/compile/free_symbol_group_use_import/source/lib.xphp b/test/fixture/compile/free_symbol_group_use_import/source/lib.xphp
new file mode 100644
index 0000000..073cc91
--- /dev/null
+++ b/test/fixture/compile/free_symbol_group_use_import/source/lib.xphp
@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Vendor;
+
+function make(int $x): int
+{
+    return $x * 2;
+}
+
+function scale(int $x): int
+{
+    return $x * 10;
+}
+
+const RATE = 100;
+
+const STEP = 7;
diff --git a/test/fixture/compile/free_symbol_group_use_import/verify/runtime.php b/test/fixture/compile/free_symbol_group_use_import/verify/runtime.php
new file mode 100644
index 0000000..212ea91
--- /dev/null
+++ b/test/fixture/compile/free_symbol_group_use_import/verify/runtime.php
@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `free_symbol_group_use_import`: group-form `use function Vendor\{make, scale}`
+ * and `use Vendor\{const RATE, const STEP}` imports in the template resolve to Vendor's symbols, and
+ * the relocated specialization still binds them. make(3)=6 + scale(1)=10 + RATE=100 + STEP=7 = 123.
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope, autoloader registered.
+ */
+
+use PHPUnit\Framework\Assert;
+
+require $fixture->targetDir . '/lib.php';
+require $fixture->targetDir . '/Use.php';
+
+Assert::assertSame(123, $computed);
diff --git a/test/fixture/compile/free_symbol_requalify/source/Use.xphp b/test/fixture/compile/free_symbol_requalify/source/Use.xphp
new file mode 100644
index 0000000..fc062ad
--- /dev/null
+++ b/test/fixture/compile/free_symbol_requalify/source/Use.xphp
@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\FreeSym;
+
+// A generic class body that references free symbols every which way. After the class
+// specializes into XPHP\Generated\…, each App-defined reference must still bind App's
+// symbol (not a phantom in the generated namespace), while the builtin `strlen` and the
+// magic constant `true` keep PHP's global resolution.
+class Box<T>
+{
+    public function run(T $seed): int
+    {
+        return scale(1)            // bare free function  -> \App\FreeSym\scale
+            + BONUS                // bare const          -> \App\FreeSym\BONUS
+            + Sub\tweak(2)         // qualified function  -> \App\FreeSym\Sub\tweak
+            + strlen('ab')         // builtin             -> stays global
+            + (true ? 0 : 99);     // magic const         -> stays global (never rewritten)
+    }
+}
+
+$box = new Box::<int>();
+$result = $box->run(0);
diff --git a/test/fixture/compile/free_symbol_requalify/source/helpers.xphp b/test/fixture/compile/free_symbol_requalify/source/helpers.xphp
new file mode 100644
index 0000000..15180e8
--- /dev/null
+++ b/test/fixture/compile/free_symbol_requalify/source/helpers.xphp
@@ -0,0 +1,12 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\FreeSym;
+
+function scale(int $x): int
+{
+    return $x * 10;
+}
+
+const BONUS = 5;
diff --git a/test/fixture/compile/free_symbol_requalify/source/sub.xphp b/test/fixture/compile/free_symbol_requalify/source/sub.xphp
new file mode 100644
index 0000000..eaab1af
--- /dev/null
+++ b/test/fixture/compile/free_symbol_requalify/source/sub.xphp
@@ -0,0 +1,10 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\FreeSym\Sub;
+
+function tweak(int $x): int
+{
+    return $x + 1;
+}
diff --git a/test/fixture/compile/free_symbol_requalify/verify/runtime.php b/test/fixture/compile/free_symbol_requalify/verify/runtime.php
new file mode 100644
index 0000000..a05f165
--- /dev/null
+++ b/test/fixture/compile/free_symbol_requalify/verify/runtime.php
@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `free_symbol_requalify`: the specialized Box runs and its free-symbol
+ * references bind the App-defined function/const (not a phantom in XPHP\Generated), with the
+ * builtin and magic constant left to global resolution.
+ *   scale(1)=10, BONUS=5, Sub\tweak(2)=3, strlen('ab')=2, true?0 -> 10+5+3+2+0 = 20
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope, autoloader registered.
+ */
+
+use PHPUnit\Framework\Assert;
+
+// Free functions/consts aren't autoloadable, so define them before Use.php runs its
+// top-level instantiation (the specialized class itself autoloads via PSR-4).
+require $fixture->targetDir . '/helpers.php';
+require $fixture->targetDir . '/sub.php';
+require $fixture->targetDir . '/Use.php';
+
+Assert::assertSame(20, $result);
diff --git a/test/fixture/compile/free_symbol_use_import/source/Use.xphp b/test/fixture/compile/free_symbol_use_import/source/Use.xphp
new file mode 100644
index 0000000..e30bf07
--- /dev/null
+++ b/test/fixture/compile/free_symbol_use_import/source/Use.xphp
@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App;
+
+use function Vendor\make;
+use const Vendor\RATE;
+
+// The `use function` / `use const` imports resolve `make` / `RATE` to Vendor's symbols,
+// NOT App's. After Wrap specializes into XPHP\Generated\App\Wrap, the references must
+// still bind Vendor\make / Vendor\RATE — the file-level `use` imports do not travel with
+// the relocated body, so the reference is fully-qualified to the resolved target.
+class Wrap<T>
+{
+    public function compute(T $seed): int
+    {
+        return make(3) + RATE;
+    }
+}
+
+$wrap = new Wrap::<int>();
+$computed = $wrap->compute(0);
diff --git a/test/fixture/compile/free_symbol_use_import/source/lib.xphp b/test/fixture/compile/free_symbol_use_import/source/lib.xphp
new file mode 100644
index 0000000..5f1f420
--- /dev/null
+++ b/test/fixture/compile/free_symbol_use_import/source/lib.xphp
@@ -0,0 +1,12 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Vendor;
+
+function make(int $x): int
+{
+    return $x * 2;
+}
+
+const RATE = 100;
diff --git a/test/fixture/compile/free_symbol_use_import/verify/runtime.php b/test/fixture/compile/free_symbol_use_import/verify/runtime.php
new file mode 100644
index 0000000..c4a8a68
--- /dev/null
+++ b/test/fixture/compile/free_symbol_use_import/verify/runtime.php
@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `free_symbol_use_import`: a `use function` / `use const` import in the
+ * template resolves to another namespace's symbols, and the relocated specialization still
+ * binds them.  make(3)=6, RATE=100 -> 106.
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope, autoloader registered.
+ */
+
+use PHPUnit\Framework\Assert;
+
+require $fixture->targetDir . '/lib.php';
+require $fixture->targetDir . '/Use.php';
+
+Assert::assertSame(106, $computed);
diff --git a/test/fixture/compile/generic_trait_adaptation/source/Use.xphp b/test/fixture/compile/generic_trait_adaptation/source/Use.xphp
new file mode 100644
index 0000000..f7e7cbf
--- /dev/null
+++ b/test/fixture/compile/generic_trait_adaptation/source/Use.xphp
@@ -0,0 +1,53 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\GenericTraitAdaptation;
+
+// Two generic traits with a COLLIDING method (`pick`), each specialized to <int>
+// and used in SEPARATE `use` statements. The conflict is resolved in the second
+// statement's adaptation block, whose `insteadof` / `as` operands name a trait
+// from BOTH statements -- so the operand->specialization map must be class-scoped,
+// not per-`use`-node. Every operand (`A`, `B`) is a generic trait that specializes
+// out of `App\...` into `XPHP\Generated\...`; leaving an operand bare fatals at
+// class load with "Trait App\A not found".
+trait A<T>
+{
+    public function pick(T $x): string
+    {
+        return 'A:' . $x;
+    }
+
+    public function aOnly(T $x): T
+    {
+        return $x;
+    }
+}
+
+trait B<T>
+{
+    public function pick(T $x): string
+    {
+        return 'B:' . $x;
+    }
+
+    public function bOnly(T $x): T
+    {
+        return $x;
+    }
+}
+
+class C
+{
+    use A<int>;
+    use B<int> {
+        A::pick insteadof B;
+        B::pick as bpick;
+    }
+}
+
+$c = new C();
+$pick = $c->pick(5);
+$bpick = $c->bpick(6);
+$aOnly = $c->aOnly(3);
+$bOnly = $c->bOnly(4);
diff --git a/test/fixture/compile/generic_trait_adaptation/verify/runtime.php b/test/fixture/compile/generic_trait_adaptation/verify/runtime.php
new file mode 100644
index 0000000..6a2e7e4
--- /dev/null
+++ b/test/fixture/compile/generic_trait_adaptation/verify/runtime.php
@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `generic_trait_adaptation`: a class uses two generic traits in
+ * SEPARATE `use` statements and resolves their colliding `pick` method in the second
+ * statement's adaptation block. The `insteadof` picks A's `pick`; the `as` re-exposes
+ * B's `pick` as `bpick`; each trait's distinct method still runs. The adaptation
+ * operands (`A`, `B`) must have been rewritten to the SAME specialized FQNs as their
+ * `use`-list entries -- a bare operand would fatal at class load ("Trait App\... not
+ * found").
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope, autoloader registered.
+ */
+
+use PHPUnit\Framework\Assert;
+
+require $fixture->targetDir . '/Use.php';
+
+Assert::assertSame('A:5', $pick);   // insteadof: A's pick wins
+Assert::assertSame('B:6', $bpick);  // as: B's pick reachable under the alias
+Assert::assertSame(3, $aOnly);      // A's distinct method
+Assert::assertSame(4, $bOnly);      // B's distinct method
diff --git a/test/fixture/compile/generic_trait_adaptation_mixed/source/Use.xphp b/test/fixture/compile/generic_trait_adaptation_mixed/source/Use.xphp
new file mode 100644
index 0000000..4469716
--- /dev/null
+++ b/test/fixture/compile/generic_trait_adaptation_mixed/source/Use.xphp
@@ -0,0 +1,53 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\GenericTraitAdaptationMixed;
+
+// A generic-trait adaptation block that MIXES generic and non-generic traits, and
+// excludes TWO traits in one `insteadof`. `Plain` is a real, still-existing trait --
+// its operand must stay bare (mis-qualifying it to a specialized FQN would fatal).
+// `G` and `H` are generic operands that must be rewritten to their specializations.
+trait G<T>
+{
+    public function val(T $x): string
+    {
+        return 'G:' . $x;
+    }
+}
+
+trait H<T>
+{
+    public function val(T $x): string
+    {
+        return 'H:' . $x;
+    }
+}
+
+trait Plain
+{
+    public function val(int $x): string
+    {
+        return 'P:' . $x;
+    }
+
+    public function plainOnly(): string
+    {
+        return 'plain';
+    }
+}
+
+class C
+{
+    use G<int>, H<int>, Plain {
+        Plain::val insteadof G, H;
+        G::val as gval;
+        H::val as hval;
+    }
+}
+
+$c = new C();
+$val = $c->val(1);
+$gval = $c->gval(2);
+$hval = $c->hval(3);
+$plainOnly = $c->plainOnly();
diff --git a/test/fixture/compile/generic_trait_adaptation_mixed/verify/runtime.php b/test/fixture/compile/generic_trait_adaptation_mixed/verify/runtime.php
new file mode 100644
index 0000000..2580c51
--- /dev/null
+++ b/test/fixture/compile/generic_trait_adaptation_mixed/verify/runtime.php
@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `generic_trait_adaptation_mixed`: an adaptation block that mixes
+ * a plain trait (`Plain`) with two generic traits (`G`, `H`) and excludes both generics
+ * in one `insteadof`. The plain operand stays bare (mis-qualifying it would fatal); the
+ * generic operands rewrite to their specializations. Plain's `val` wins; the excluded
+ * generic `val`s are re-exposed under aliases; Plain's distinct method runs.
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope, autoloader registered.
+ */
+
+use PHPUnit\Framework\Assert;
+
+require $fixture->targetDir . '/Use.php';
+
+Assert::assertSame('P:1', $val);        // insteadof: Plain's val wins over G, H
+Assert::assertSame('G:2', $gval);       // as: excluded generic G::val under alias
+Assert::assertSame('H:3', $hval);       // as: excluded generic H::val under alias
+Assert::assertSame('plain', $plainOnly); // Plain's distinct method
diff --git a/test/fixture/compile/group_import_class_requalify/source/Use.xphp b/test/fixture/compile/group_import_class_requalify/source/Use.xphp
new file mode 100644
index 0000000..a160adf
--- /dev/null
+++ b/test/fixture/compile/group_import_class_requalify/source/Use.xphp
@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App;
+
+use Vendor\Widget;      // single import — must-keep (already worked)
+use Vendor\{Tool};      // group import — the WI-14 fix
+
+// Box<T> relocates into XPHP\Generated\App\Box, out of App's namespace + use scope. Both the
+// group-imported Tool and the single-imported Widget must re-qualify to \Vendor\… in the relocated
+// body — before the fix, the group form emitted \App\Tool::ping() and fataled ("Class App\Tool").
+class Box<T>
+{
+    public function run(): string
+    {
+        return Tool::ping() . Widget::spin();
+    }
+}
+
+$b = new Box::<int>();
+$result = $b->run();
diff --git a/test/fixture/compile/group_import_class_requalify/source/lib.xphp b/test/fixture/compile/group_import_class_requalify/source/lib.xphp
new file mode 100644
index 0000000..9b21dfc
--- /dev/null
+++ b/test/fixture/compile/group_import_class_requalify/source/lib.xphp
@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Vendor;
+
+class Tool
+{
+    public static function ping(): string
+    {
+        return 'pong';
+    }
+}
+
+class Widget
+{
+    public static function spin(): string
+    {
+        return 'spin';
+    }
+}
diff --git a/test/fixture/compile/group_import_class_requalify/verify/runtime.php b/test/fixture/compile/group_import_class_requalify/verify/runtime.php
new file mode 100644
index 0000000..1c8a7b1
--- /dev/null
+++ b/test/fixture/compile/group_import_class_requalify/verify/runtime.php
@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `group_import_class_requalify`: a class imported via a GROUP `use`
+ * (`use Vendor\{Tool};`) and one via a single `use Vendor\Widget;` both re-qualify to Vendor in the
+ * relocated Box<int> body. Tool::ping()='pong' . Widget::spin()='spin' -> 'pongspin'. A group form
+ * that fell back to the current namespace would fatal with "Class App\Tool not found".
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope, autoload registered.
+ */
+
+use PHPUnit\Framework\Assert;
+
+// Vendor's two classes share one emitted lib.php (not one-class-per-file), so PSR-4 can't autoload
+// them — require it before Use.php runs its top-level instantiation. The specialized Box autoloads
+// via XPHP\Generated.
+require $fixture->targetDir . '/lib.php';
+require $fixture->targetDir . '/Use.php';
+
+Assert::assertSame('pongspin', $result);
diff --git a/test/fixture/compile/keyword_named_generic_method/source/Use.xphp b/test/fixture/compile/keyword_named_generic_method/source/Use.xphp
new file mode 100644
index 0000000..fcb6940
--- /dev/null
+++ b/test/fixture/compile/keyword_named_generic_method/source/Use.xphp
@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App;
+
+// `list` and `print` are PHP keywords but valid (semi-reserved) method names. Their generic
+// forms must scan (the declaration gate used to require T_STRING and reject a keyword name,
+// so the raw `<T>` reached php-parser) AND both call sites must strip + specialize:
+//  - instance `$r->list::<int>()` — `list` re-tokenizes as T_STRING after `->` (already worked);
+//  - static `Reg::print::<int>()` — `print` stays T_PRINT after `::`, the case the call-site gate
+//    rejected, leaving a raw parse error until this WI.
+class Reg
+{
+    public function list<T>(T $x): T
+    {
+        return $x;
+    }
+
+    public static function print<T>(T $x): T
+    {
+        return $x;
+    }
+}
+
+$r = new Reg();
+$instanceResult = $r->list::<int>(41);
+$staticResult = Reg::print::<int>(7);
diff --git a/test/fixture/compile/keyword_named_generic_method/verify/runtime.php b/test/fixture/compile/keyword_named_generic_method/verify/runtime.php
new file mode 100644
index 0000000..4028497
--- /dev/null
+++ b/test/fixture/compile/keyword_named_generic_method/verify/runtime.php
@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `keyword_named_generic_method`: a generic method whose name is a PHP keyword
+ * (`list`, `print`) declares, specializes, and is callable through both an instance turbofish and a
+ * static turbofish. Instance `list::<int>(41)` returns 41; static `print::<int>(7)` returns 7.
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope, autoload registered.
+ */
+
+use PHPUnit\Framework\Assert;
+
+require $fixture->targetDir . '/Use.php';
+
+Assert::assertSame(41, $instanceResult);
+Assert::assertSame(7, $staticResult);
diff --git a/test/fixture/compile/keyword_nongeneric_passthrough/source/Use.xphp b/test/fixture/compile/keyword_nongeneric_passthrough/source/Use.xphp
new file mode 100644
index 0000000..5d38abb
--- /dev/null
+++ b/test/fixture/compile/keyword_nongeneric_passthrough/source/Use.xphp
@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App;
+
+// Must-keep guard for the keyword-turbofish support: keyword-named NON-generic methods and
+// `list()` destructuring must pass through untouched. The keyword recognition is a dedicated
+// branch that fires ONLY for `keyword::<…>` after `::`, so it must never route these ordinary
+// keyword uses into the scanner's bare-`<`, closure-signature, or array-sugar sub-branches.
+class R
+{
+    public function list(int $z): int
+    {
+        return $z + 1;
+    }
+
+    public static function print(int $z): int
+    {
+        return $z + 2;
+    }
+}
+
+function unpack(array $a): int
+{
+    list($x, $y) = $a;
+    return $x + $y;
+}
+
+$r = new R();
+$instance = $r->list(10);
+$static = R::print(20);
+$destructured = unpack([3, 4]);
diff --git a/test/fixture/compile/keyword_nongeneric_passthrough/verify/runtime.php b/test/fixture/compile/keyword_nongeneric_passthrough/verify/runtime.php
new file mode 100644
index 0000000..3d9a8cb
--- /dev/null
+++ b/test/fixture/compile/keyword_nongeneric_passthrough/verify/runtime.php
@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `keyword_nongeneric_passthrough`: keyword-named non-generic methods and
+ * `list()` destructuring survive the keyword-turbofish support unchanged. list(10)+1=11,
+ * print(20)+2=22, unpack([3,4])=7.
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope, autoload registered.
+ */
+
+use PHPUnit\Framework\Assert;
+
+require $fixture->targetDir . '/Use.php';
+
+Assert::assertSame(11, $instance);
+Assert::assertSame(22, $static);
+Assert::assertSame(7, $destructured);
diff --git a/test/fixture/compile/multiline_generic_markers/source/Use.xphp b/test/fixture/compile/multiline_generic_markers/source/Use.xphp
new file mode 100644
index 0000000..3342461
--- /dev/null
+++ b/test/fixture/compile/multiline_generic_markers/source/Use.xphp
@@ -0,0 +1,61 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\MultilineMarkers;
+
+// Every stripped span below contains a newline. Stripping must preserve
+// the line layout, or every LINE-KEYED marker recorded after the span
+// (class headers, name markers) attaches to the wrong line and the later
+// declarations are emitted raw — a silent de-generification.
+
+// Multi-line type-param clause, with a multibyte comment inside the
+// blanked span (café) so per-byte blanking is exercised too.
+final class Wide<
+    T // café
+> {
+    public function __construct(public T $v)
+    {
+    }
+}
+
+// Must still specialize although the clause above spanned lines.
+final class Box<T>
+{
+    public function __construct(public T $v)
+    {
+    }
+}
+
+final class Rec
+{
+}
+
+// Newline inside the `[]` sugar brackets — a length-CHANGING rewrite
+// that must still keep the line count.
+function tally(Rec[
+] $rs): int
+{
+    return \count($rs);
+}
+
+// Multi-line bare generic type hint + multi-line turbofish arg list.
+function pick(): Box<
+    int
+> {
+    return new Box::<
+        int
+    >(7);
+}
+
+// A generic closure AFTER all of the spans above — line- and byte-keyed
+// markers both have to survive the strips.
+$id = function<T>(T $x): T {
+    return $x;
+};
+
+$w = new Wide::<string>('w');
+$b = pick();
+$n = $id::<int>(41);
+$s = $id::<string>('s');
+$c = tally([new Rec(), new Rec()]);
diff --git a/test/fixture/compile/multiline_generic_markers/verify/runtime.php b/test/fixture/compile/multiline_generic_markers/verify/runtime.php
new file mode 100644
index 0000000..d6ccb81
--- /dev/null
+++ b/test/fixture/compile/multiline_generic_markers/verify/runtime.php
@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `multiline_generic_markers`. Multi-line generic
+ * clauses, turbofish arg lists, and sugar spans precede several generic
+ * declarations; every one of them must have specialized (none emitted
+ * raw), and the emitted program must execute.
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope.
+ */
+
+use PHPUnit\Framework\Assert;
+
+require $fixture->targetDir . '/Use.php';
+
+Assert::assertSame('w', $w->v);
+Assert::assertSame(7, $b->v);
+Assert::assertSame(41, $n);
+Assert::assertSame('s', $s);
+Assert::assertSame(2, $c);
diff --git a/test/fixture/compile/qualified_bare_new_defaults/source/OtherBox.xphp b/test/fixture/compile/qualified_bare_new_defaults/source/OtherBox.xphp
new file mode 100644
index 0000000..7023767
--- /dev/null
+++ b/test/fixture/compile/qualified_bare_new_defaults/source/OtherBox.xphp
@@ -0,0 +1,12 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Other;
+
+class Box<T = int>
+{
+    public function __construct(public T $n)
+    {
+    }
+}
diff --git a/test/fixture/compile/qualified_bare_new_defaults/source/RelativeUse.xphp b/test/fixture/compile/qualified_bare_new_defaults/source/RelativeUse.xphp
new file mode 100644
index 0000000..a2ef3aa
--- /dev/null
+++ b/test/fixture/compile/qualified_bare_new_defaults/source/RelativeUse.xphp
@@ -0,0 +1,16 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\QualifiedDefaults;
+
+use Other\Box;
+
+// `new namespace\Box(...)` binds to THIS namespace's Box — the `use`
+// alias never applies to a relative name, so synthesis must target
+// App\QualifiedDefaults\Box (string default), not Other\Box.
+$b = new namespace\Box("ho");
+
+// The aliased bare `new` keeps working: it synthesizes Other\Box's
+// defaults tuple (int).
+$c = new Box(7);
diff --git a/test/fixture/compile/qualified_bare_new_defaults/source/Use.xphp b/test/fixture/compile/qualified_bare_new_defaults/source/Use.xphp
new file mode 100644
index 0000000..f4a967f
--- /dev/null
+++ b/test/fixture/compile/qualified_bare_new_defaults/source/Use.xphp
@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\QualifiedDefaults;
+
+// A bare `new` of an all-defaults generic synthesizes the defaults tuple.
+// The fully-qualified spelling used to be skipped entirely — compile
+// emitted `interface Box {}` and kept `new \App\QualifiedDefaults\Box(...)`,
+// a guaranteed runtime fatal behind a clean gate.
+
+class Box<T = string>
+{
+    public function __construct(public T $v)
+    {
+    }
+}
+
+$a = new \App\QualifiedDefaults\Box("hi");
diff --git a/test/fixture/compile/qualified_bare_new_defaults/verify/runtime.php b/test/fixture/compile/qualified_bare_new_defaults/verify/runtime.php
new file mode 100644
index 0000000..fc2b962
--- /dev/null
+++ b/test/fixture/compile/qualified_bare_new_defaults/verify/runtime.php
@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `qualified_bare_new_defaults`. FQ and relative bare
+ * `new` of all-defaults generics must synthesize the defaults tuple and
+ * execute; the relative spelling must bind to the CURRENT namespace's
+ * template even with a colliding `use` alias in scope, while the aliased
+ * bare form keeps targeting the aliased template.
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope.
+ */
+
+use PHPUnit\Framework\Assert;
+
+require $fixture->targetDir . '/OtherBox.php';
+require $fixture->targetDir . '/Use.php';
+require $fixture->targetDir . '/RelativeUse.php';
+
+Assert::assertSame('hi', $a->v);
+Assert::assertSame('ho', $b->v);
+Assert::assertSame(7, $c->n);
+
+// $a and $b are the same App-side specialization; $c is Other's.
+Assert::assertSame(get_class($a), get_class($b));
+Assert::assertNotSame(get_class($a), get_class($c));
+// $c is a relocated specialization: emitted under Other's Generated namespace.
+Assert::assertSame(
+    'XPHP\\Generated\\Other\\Box\\T_6da88c34ba124c41f977db66a4fc5c1a951708d285c81bb0d47c3206f4c27ca8',
+    get_class($c),
+);
diff --git a/test/fixture/compile/qualified_generic_call_sites/source/Use.xphp b/test/fixture/compile/qualified_generic_call_sites/source/Use.xphp
new file mode 100644
index 0000000..c5c9387
--- /dev/null
+++ b/test/fixture/compile/qualified_generic_call_sites/source/Use.xphp
@@ -0,0 +1,59 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\QualifiedCalls;
+
+// Fully-qualified and `namespace\`-relative spellings of generic call
+// sites: every one must route to the same specialization as the bare
+// form. Historically the FQ forms either failed loudly with a doubled
+// namespace or silently kept the raw `new` against the stripped marker
+// interface, and the relative forms silently lost their markers.
+
+class Box<T>
+{
+    public function __construct(public T $v)
+    {
+    }
+}
+
+class Cache<T = string>
+{
+    public function __construct(public T $key)
+    {
+    }
+}
+
+class Holder<T>
+{
+    public function __construct(public T $inner)
+    {
+    }
+
+    // FQ generic return hint + FQ turbofish with a type-param arg inside
+    // a template body: both must ground when Holder specializes.
+    public function wrap(): \App\QualifiedCalls\Box<T>
+    {
+        return new \App\QualifiedCalls\Box::<T>($this->inner);
+    }
+}
+
+function make<T>(T $x): T
+{
+    return $x;
+}
+
+// Relative generic return type and a bare turbofish on ONE line: both
+// markers must bind (the relative one used to be silently dropped).
+// The wrong-site STEAL variant — distinct type args per site — is pinned
+// at the parser level, where a mismatched program can still be observed.
+function build(): namespace\Box<int> { return new Box::<int>(9); }
+
+$a = new \App\QualifiedCalls\Box::<int>(1);
+$b = new namespace\Box::<string>('r');
+$c = new \App\QualifiedCalls\Cache::<>('k');
+$h = new Holder::<int>(5);
+$d = $h->wrap();
+$e = build();
+$f = \App\QualifiedCalls\make::<int>(3);
+$g = namespace\make::<string>('g');
diff --git a/test/fixture/compile/qualified_generic_call_sites/verify/runtime.php b/test/fixture/compile/qualified_generic_call_sites/verify/runtime.php
new file mode 100644
index 0000000..a6176ae
--- /dev/null
+++ b/test/fixture/compile/qualified_generic_call_sites/verify/runtime.php
@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `qualified_generic_call_sites`. FQ and relative
+ * spellings of generic call sites must all have specialized (no raw
+ * `new` against the marker interface, no doubled-namespace template),
+ * route to the SAME specializations as the bare forms, and execute.
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope.
+ */
+
+use PHPUnit\Framework\Assert;
+
+require $fixture->targetDir . '/Use.php';
+
+Assert::assertSame(1, $a->v);
+Assert::assertSame('r', $b->v);
+Assert::assertSame('k', $c->key);
+Assert::assertSame(5, $d->v);
+Assert::assertSame(9, $e->v);
+Assert::assertSame(3, $f);
+Assert::assertSame('g', $g);
+
+// FQ, in-template, and same-line-relative int instantiations must all be
+// the one int specialization.
+Assert::assertSame(get_class($a), get_class($d));
+Assert::assertSame(get_class($a), get_class($e));
diff --git a/test/fixture/compile/relative_names_in_templates/source/LocalDefs.xphp b/test/fixture/compile/relative_names_in_templates/source/LocalDefs.xphp
new file mode 100644
index 0000000..3780c1b
--- /dev/null
+++ b/test/fixture/compile/relative_names_in_templates/source/LocalDefs.xphp
@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\RelativeTemplates;
+
+class Base
+{
+}
+
+class Thing
+{
+    public function __construct(public string $tag)
+    {
+    }
+}
+
+class Svc
+{
+    public function id<T>(T $x): T
+    {
+        return $x;
+    }
+}
diff --git a/test/fixture/compile/relative_names_in_templates/source/OtherDefs.xphp b/test/fixture/compile/relative_names_in_templates/source/OtherDefs.xphp
new file mode 100644
index 0000000..657c50c
--- /dev/null
+++ b/test/fixture/compile/relative_names_in_templates/source/OtherDefs.xphp
@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Other;
+
+// Deliberate name collisions: if any relative reference is alias-captured,
+// the emitted code lands on these classes instead and the runtime verify
+// fails loudly.
+
+class Base
+{
+}
+
+class Thing
+{
+    public function __construct(public int $wrong)
+    {
+    }
+}
+
+class Svc
+{
+}
diff --git a/test/fixture/compile/relative_names_in_templates/source/Use.xphp b/test/fixture/compile/relative_names_in_templates/source/Use.xphp
new file mode 100644
index 0000000..8aba391
--- /dev/null
+++ b/test/fixture/compile/relative_names_in_templates/source/Use.xphp
@@ -0,0 +1,61 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\RelativeTemplates;
+
+use Other\Base;
+use Other\Svc;
+use Other\Thing;
+
+// `namespace\Name` binds to the CURRENT namespace by PHP's rules — a
+// `use` alias never applies to it, and it is never a type parameter.
+// Every shape here used to alias-capture (emitting code against the
+// wrong class) or substitute a type param into an explicit class
+// reference.
+
+class Gen<T> extends namespace\Base
+{
+    public function __construct(public T $v)
+    {
+    }
+}
+
+class Keep<Thing>
+{
+    // Bare `Thing` IS the type param; `namespace\Thing` is an explicit
+    // reference to the App\RelativeTemplates\Thing class.
+    public function __construct(public Thing $generic)
+    {
+    }
+
+    public function label(namespace\Thing $t): string
+    {
+        return $t->tag;
+    }
+}
+
+// Generic-method receiver typed with a relative name: the method
+// template lookup must resolve `namespace\Svc` to THIS namespace's Svc.
+function relay(namespace\Svc $s): int
+{
+    return $s->id::<int>(5);
+}
+
+// Conformance target + candidate hierarchy through a relative parent:
+// Cat extends THIS namespace's Base, so the literal conforms.
+class Cat extends namespace\Base
+{
+}
+
+function factory(): Closure(): namespace\Base
+{
+    return fn(): Cat => new Cat();
+}
+
+$g = new Gen::<int>(4);
+$k = new Keep::<int>(1);
+$lbl = $k->label(new namespace\Thing('ok'));
+$r = relay(new namespace\Svc());
+$make = factory();
+$cat = $make();
diff --git a/test/fixture/compile/relative_names_in_templates/verify/runtime.php b/test/fixture/compile/relative_names_in_templates/verify/runtime.php
new file mode 100644
index 0000000..3e86a50
--- /dev/null
+++ b/test/fixture/compile/relative_names_in_templates/verify/runtime.php
@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `relative_names_in_templates`. Relative names inside
+ * generic templates must bind to the current namespace (never a colliding
+ * `use` alias, never a type parameter), across extends clauses, method
+ * signatures, generic-method receivers, and conformance hierarchies.
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope.
+ */
+
+use PHPUnit\Framework\Assert;
+
+require $fixture->targetDir . '/LocalDefs.php';
+require $fixture->targetDir . '/OtherDefs.php';
+require $fixture->targetDir . '/Use.php';
+
+Assert::assertSame(4, $g->v);
+Assert::assertSame('App\\RelativeTemplates\\Base', get_parent_class($g));
+Assert::assertSame(1, $k->generic);
+Assert::assertSame('ok', $lbl);
+Assert::assertSame(5, $r);
+Assert::assertInstanceOf('App\\RelativeTemplates\\Cat', $cat);
+Assert::assertSame('App\\RelativeTemplates\\Base', get_parent_class($cat));
diff --git a/test/fixture/compile/same_line_marker_pairs/source/Aliased.xphp b/test/fixture/compile/same_line_marker_pairs/source/Aliased.xphp
new file mode 100644
index 0000000..7f202da
--- /dev/null
+++ b/test/fixture/compile/same_line_marker_pairs/source/Aliased.xphp
@@ -0,0 +1,15 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\SameLinePairs\Sub;
+
+use App\SameLinePairs\Box as B;
+
+// Aliased plain + generic hints of the same spelling on one line.
+function h(B $plain, B<string> $gen): string
+{
+    return $gen->v;
+}
+
+$hv = h(new B::<int>(3), new B::<string>('al'));
diff --git a/test/fixture/compile/same_line_marker_pairs/source/Use.xphp b/test/fixture/compile/same_line_marker_pairs/source/Use.xphp
new file mode 100644
index 0000000..f617858
--- /dev/null
+++ b/test/fixture/compile/same_line_marker_pairs/source/Use.xphp
@@ -0,0 +1,81 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\SameLinePairs;
+
+// Two same-spelling sites on ONE line: markers must bind byte-exact to
+// their own site. Line-keyed matching let the first-traversed node steal
+// the other's marker — specializing the wrong parameter, rewriting the
+// wrong class to a marker interface, or false-rejecting a plain call.
+
+class Box<T>
+{
+    public function __construct(public T $v)
+    {
+    }
+}
+
+class R
+{
+}
+
+class Util
+{
+    public static function pick<T>(T $x): T
+    {
+        return $x;
+    }
+
+    public function id<T>(T $x): T
+    {
+        return $x;
+    }
+}
+
+class Plain
+{
+    public static function pick(int $x): int
+    {
+        return $x;
+    }
+}
+
+// Same-name static calls — one generic, one not — on ONE line. The old
+// line-range match cross-claimed and false-rejected BOTH calls.
+function mixCalls(): int { return Plain::pick(5) + Util::pick::<int>(4); }
+
+// Plain hint + generic hint, same spelling, one line — both orders.
+function f(Box $a, Box<int> $b): int { return $b->v; }
+function g(Box<int> $a, Box $b): int { return $a->v; }
+
+// Return hint + `new` turbofish on one line — the hint must not steal
+// the instantiation's marker.
+function mk(): Box { return new Box::<int>(1); }
+
+// Two same-name turbofish with DIFFERENT args on one line — each site
+// keeps its own argument tuple.
+function pair(): array { return [new Box::<int>(2), new Box::<string>('s')]; }
+
+// Length-changing sugar and a generic hint on the SAME line — byte
+// positions must round-trip through the offset map.
+function tally(R[] $rs, Box<int> $c): int { return \count($rs) + $c->v; }
+
+// One-line same-name conditional classes — the plain class must stay a
+// class (it used to become an uninstantiable marker interface).
+if (true) { class B { } } else { class B<T> { public T $v; } }
+
+$m = mixCalls();
+$a = f(new Box::<string>('p'), new Box::<int>(7));
+$b = g(new Box::<int>(8), new Box::<string>('q'));
+$k = mk();
+[$p1, $p2] = pair();
+$t = tally([new R()], new Box::<int>(10));
+$bb = new B();
+
+// Same variable turbofish twice on one line, and a member turbofish
+// inside string interpolation.
+$id = fn<T>(T $x): T => $x;
+$sum = $id::<int>(1) + $id::<int>(2);
+$u = new Util();
+$msg = "v={$u->id::<int>(9)}";
diff --git a/test/fixture/compile/same_line_marker_pairs/verify/runtime.php b/test/fixture/compile/same_line_marker_pairs/verify/runtime.php
new file mode 100644
index 0000000..46c765b
--- /dev/null
+++ b/test/fixture/compile/same_line_marker_pairs/verify/runtime.php
@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `same_line_marker_pairs`. Every same-line
+ * same-spelling pair must have bound its markers to the right sites and
+ * the whole program must execute.
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope.
+ */
+
+use PHPUnit\Framework\Assert;
+
+require $fixture->targetDir . '/Use.php';
+require $fixture->targetDir . '/Aliased.php';
+
+Assert::assertSame(9, $m);
+Assert::assertSame(7, $a);
+Assert::assertSame(8, $b);
+Assert::assertSame(1, $k->v);
+Assert::assertSame(2, $p1->v);
+Assert::assertSame('s', $p2->v);
+Assert::assertNotSame(get_class($p1), get_class($p2));
+Assert::assertSame(11, $t);
+Assert::assertSame('App\\SameLinePairs\\B', get_class($bb));
+Assert::assertSame(3, $sum);
+Assert::assertSame('v=9', $msg);
+Assert::assertSame('al', $hv);
diff --git a/test/fixture/compile/split_declaration_headers/source/Use.xphp b/test/fixture/compile/split_declaration_headers/source/Use.xphp
new file mode 100644
index 0000000..fbd8e71
--- /dev/null
+++ b/test/fixture/compile/split_declaration_headers/source/Use.xphp
@@ -0,0 +1,66 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\SplitHeaders;
+
+// A declaration whose attributes / modifiers / keyword sit on a different
+// line than its NAME: the generic marker records the name token's line, so
+// matching must key on the name, not on the node start (which php-parser
+// puts at the first attribute or modifier).
+
+#[\Attribute]
+class Note
+{
+}
+
+#[Note]
+final class Box<T>
+{
+    public function __construct(public T $v)
+    {
+    }
+}
+
+final
+class Pair<U>
+{
+    public function __construct(public U $u)
+    {
+    }
+}
+
+class Wrap
+{
+    #[Note]
+    public function lift<T>(T $x): T
+    {
+        return $x;
+    }
+
+    public static
+    function pick<T>(T $x): T
+    {
+        return $x;
+    }
+}
+
+#[Note]
+function ident<T>(T $x): T
+{
+    return $x;
+}
+
+function
+double<T>(T $x): array
+{
+    return [$x, $x];
+}
+
+$b = new Box::<string>('bx');
+$p = new Pair::<int>(4);
+$w = new Wrap();
+$l = $w->lift::<int>(5);
+$s = Wrap::pick::<string>('pk');
+$i = ident::<int>(9);
+$d = double::<string>('z');
diff --git a/test/fixture/compile/split_declaration_headers/verify/runtime.php b/test/fixture/compile/split_declaration_headers/verify/runtime.php
new file mode 100644
index 0000000..f3cd528
--- /dev/null
+++ b/test/fixture/compile/split_declaration_headers/verify/runtime.php
@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `split_declaration_headers`. Generic classes, methods,
+ * and functions whose headers split across lines (attribute or modifier on
+ * its own line, keyword/name split) must all specialize and run.
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope.
+ */
+
+use PHPUnit\Framework\Assert;
+
+require $fixture->targetDir . '/Use.php';
+
+Assert::assertSame('bx', $b->v);
+Assert::assertSame(4, $p->u);
+Assert::assertSame(5, $l);
+Assert::assertSame('pk', $s);
+Assert::assertSame(9, $i);
+Assert::assertSame(['z', 'z'], $d);
diff --git a/test/fixture/compile/turbofish_fcc_closure/source/Use.xphp b/test/fixture/compile/turbofish_fcc_closure/source/Use.xphp
new file mode 100644
index 0000000..b51aba1
--- /dev/null
+++ b/test/fixture/compile/turbofish_fcc_closure/source/Use.xphp
@@ -0,0 +1,40 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\TurbofishFccClosure;
+
+// A first-class callable of a turbofish specialization (`$f::<int>(...)`) must emit a
+// valid forwarding closure that routes through the dispatcher -- not `$f('T_…', ...)`,
+// which does not parse. Every shape below is compiled and executed.
+
+// Implicit-capture arrow: the FCC must forward THROUGH the dispatcher so the captured
+// $mul stays bound.
+$mul = 10;
+$f = fn<T>(T $x): T => $x * $mul;
+$g = $f::<int>(...);
+$viaCall = $g(5);                          // 50
+$viaMap = array_map($g, [1, 2, 3]);        // [10, 20, 30]
+
+// Named argument rides the `...` placeholder through to the specialized param `$x`.
+$id = fn<T>(T $x): T => $x;
+$h = $id::<int>(...);
+$named = $h(x: 42);                         // 42
+
+// Empty-turbofish all-defaults FCC.
+$d = fn<T = int>(T $y): T => $y;
+$e = $d::<>(...);
+$defaulted = $e(7);                         // 7
+
+// A direct turbofish call AND an FCC of the same tag share one dispatcher.
+$twice = fn<T>(T $x): T => $x;
+$direct = $twice::<int>(4);                 // 4
+$fcc = $twice::<int>(...);
+$viaFcc = $fcc(8);                          // 8
+
+// Collision guard: the dispatcher variable is literally named like the reserved
+// forwarding param. The forwarding param must be suffixed so it does not shadow the
+// captured dispatcher inside the closure body.
+$__xphp_fcc_args = fn<T>(T $x): T => $x;
+$collide = $__xphp_fcc_args::<int>(...);
+$collided = $collide(9);                     // 9
diff --git a/test/fixture/compile/turbofish_fcc_closure/verify/runtime.php b/test/fixture/compile/turbofish_fcc_closure/verify/runtime.php
new file mode 100644
index 0000000..96217b1
--- /dev/null
+++ b/test/fixture/compile/turbofish_fcc_closure/verify/runtime.php
@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `turbofish_fcc_closure`: a first-class callable of a turbofish
+ * specialization emits a valid forwarding closure (the file parses, or this require would
+ * fatal) that routes through the dispatcher and preserves callable semantics.
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope.
+ */
+
+use PHPUnit\Framework\Assert;
+
+require $fixture->targetDir . '/Use.php';
+
+Assert::assertSame(50, $viaCall);
+Assert::assertSame([10, 20, 30], $viaMap);
+Assert::assertSame(42, $named);
+Assert::assertSame(7, $defaulted);
+Assert::assertSame(4, $direct);
+Assert::assertSame(8, $viaFcc);
+Assert::assertSame(9, $collided);
diff --git a/test/fixture/compile/use_trait_generic/source/Use.xphp b/test/fixture/compile/use_trait_generic/source/Use.xphp
new file mode 100644
index 0000000..607634b
--- /dev/null
+++ b/test/fixture/compile/use_trait_generic/source/Use.xphp
@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\UseTraitGeneric;
+
+// A generic TRAIT-use (`use Holder<int>`) inside a class body is NOT a namespace
+// import: it specializes the trait and inlines its members. The WI-08 use-import
+// reject must leave it untouched -- compiled and executed end-to-end here.
+trait Holder<T>
+{
+    public function label(): string
+    {
+        return 'held';
+    }
+}
+
+class Box
+{
+    use Holder<int>;
+}
+
+$box = new Box();
+$label = $box->label();
diff --git a/test/fixture/compile/use_trait_generic/verify/runtime.php b/test/fixture/compile/use_trait_generic/verify/runtime.php
new file mode 100644
index 0000000..3185ce2
--- /dev/null
+++ b/test/fixture/compile/use_trait_generic/verify/runtime.php
@@ -0,0 +1,16 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * Runtime verify for `use_trait_generic`: a generic trait-use survives the WI-08
+ * use-import reject, specializes, and runs -- the inlined trait method returns.
+ *
+ * Driver contract: `$fixture` (CompiledFixture) in scope, autoloader registered.
+ */
+
+use PHPUnit\Framework\Assert;
+
+require $fixture->targetDir . '/Use.php';
+
+Assert::assertSame('held', $label);