Class method called on a class-id-0 object that inherits the class prototype receives the owner marker (a number) as this #11201

A compiled class method called on an object whose class_id is 0, but whose prototype chain reaches the class prototype, runs with the wrong this. The body sees typeof this === "number", and every this.x read is undefined.

class C {
  x = 5;
  m() { return typeof this + ":" + (this as any).x; }
}
const n = Object.create(null);
Object.setPrototypeOf(n, C.prototype);
n.x = 7;
console.log(n.m());                // node: object:7    perry main: number:undefined
console.log(C.prototype.m.call(n)); // node: object:7    perry main: number:undefined

Getters reached through the same object behave correctly. Only method values fail: n.m() resolves m through the per-instance prototype override and then calls it the same way .call does.

Root cause

C.prototype.m is a canonical bound-method closure. Its capture slot 0 holds the owner's INT32 prototype-ref marker, not a receiver. dispatch_bound_method asks canonical_bound_method_receiver (crates/perry-runtime/src/object/native_module.rs) for the real this. That function accepts the call-site IMPLICIT_THIS only when it is a class instance (non-zero class id), a proxy, or a closure. Anything else, including a class-id-0 object whose prototype is C.prototype, falls back to the marker, and the marker becomes this.

Why it matters now

#11166 stops Object.create from minting a synthetic class id per call, so every Object.create(C.prototype) hits this bug. That includes the tslib __extends / Babel _inherits shape, and it also applies to Object.create(new C()). With #11166, test_gap_9495_strict_inherited_property_set, test_gap_11042_class_expr_dynamic_heritage_per_evaluation and test_gap_11139_member_heritage_builtin_name regress.