@nudojs/cli 0.2.0 → 0.3.0

package/src/evaluator.ts

@@ -3,7 +3,6 @@ import {
   type TypeValue,
   T,
   simplifyUnion,
-  applyBinaryOp,
   dispatchBinaryOp,
   dispatchMethod,
   dispatchProperty,
@@ -16,12 +15,442 @@ import {
   typeValueToString,
   isSubtypeOf,
   widenLiteral,
+  collapseLiteralUnion,
   createTemplate,
+  subtractType,
+  getFnSig,
 } from "@nudojs/core";
+import { extractInlineDirectives, type InlineDirective } from "@nudojs/parser";
 import { narrow } from "./narrowing.ts";
+import {
+  tryAbsObjectSpread,
+  tryAbsJoinObjects,
+  tryAbsUnary,
+  pushPhi,
+  popPhi,
+  currentPhi,
+  resetPhi,
+} from "./abs-route.ts";
+import {
+  evalBinaryValue,
+  distributeBinaryOverUnion,
+} from "./eval-binary.ts";
+import { phiFromTest, combinePhi } from "./phi-from-test.ts";
+import { tagParamArg } from "./term-registry.ts";
+import { evaluatePromiseStaticMethod, evaluatePromiseInstanceMethod } from "./builtins/builtin-promise.ts";
+import { MAP_INSTANCE_METHODS, createMapType, mapEntriesIterable, exactMapEntries } from "./builtins/builtin-map.ts";
+import { SET_INSTANCE_METHODS, createSetType, setValuesIterable, exactSetValues } from "./builtins/builtin-set.ts";
+import { REGEXP_INSTANCE_METHODS, createRegExpType } from "./builtins/builtin-regexp.ts";
+import { URL_INSTANCE_METHODS, URLSearchParams_INSTANCE_METHODS, createURLType, createURLSearchParamsType } from "./builtins/builtin-url.ts";
+import {
+  RESPONSE_INSTANCE_METHODS,
+  HEADERS_INSTANCE_METHODS,
+  FORMDATA_INSTANCE_METHODS,
+  ABORTCONTROLLER_INSTANCE_METHODS,
+  createResponseType,
+  createHeadersType,
+  createFormDataType,
+  createAbortControllerType,
+} from "./builtins/builtin-web.ts";
+import { WEAKMAP_INSTANCE_METHODS, WEAKSET_INSTANCE_METHODS, createWeakMapType, createWeakSetType } from "./builtins/builtin-weak.ts";
+import { SYMBOL_STATIC_PROPS } from "./builtins/builtin-symbol.ts";
+import { REFLECT_METHODS } from "./builtins/builtin-reflect.ts";
+import { INTL_DATETIMEFORMAT_METHODS, INTL_NUMBERFORMAT_METHODS, createDateTimeFormatType, createNumberFormatType } from "./builtins/builtin-intl.ts";
+import {
+  BUILTIN_ERROR_CLASSES,
+  BUILTIN_PROTOTYPE_CLASSES,
+  OBJECT_PROTOTYPE_METHODS,
+  BUILTIN_PROTOTYPE_METHOD_APPROXIMATIONS,
+  builtinClassValue,
+  builtinPrototype,
+} from "./builtins/builtin-prototype.ts";
+import { BUILTIN_STATIC_METHODS, builtinInstanceTest, jsonToTypeValue } from "./builtins/builtin-static.ts";
+
+
+
+
+
+
+
+
+
+// Wrapper-prototype fallback for primitive receivers: real JS auto-boxes
+// member access on primitives ('x'.constructor === String), so a named
+// member hit on a string/number/boolean/symbol consults the wrapper's
+// prototype table (the same approximations `X.prototype` uses) plus the
+// wrapper's constructor before anything reports a missing property.
+// hasOwnProp-guarded like every other table lookup here.
+/** 值上命名成员是否可能存在（union 部分成员持有的 no-method 降 warning
+ * 用）：primitive/literal 走 wrapper 原型近似表（'x'.charCodeAt），
+ * instance 走近似方法表。诊断侧据此区分"部分成员可能有"与"确定没有"。 */
+export function memberMayExistOn(tv: TypeValue, propName: string): boolean {
+  if (tv.kind === "primitive" || tv.kind === "literal") {
+    return wrapperPrototypeMember(tv, propName) !== undefined;
+  }
+  if (tv.kind === "instance") {
+    const className = tv.className;
+    const table = hasOwnProp(BUILTIN_PROTOTYPE_METHOD_APPROXIMATIONS, className)
+      ? BUILTIN_PROTOTYPE_METHOD_APPROXIMATIONS[className]
+      : BUILTIN_ERROR_CLASSES.has(className)
+        ? BUILTIN_PROTOTYPE_METHOD_APPROXIMATIONS.Error
+        : undefined;
+    if (table && hasOwnProp(table, propName)) return true;
+    // instance 的方法集是近似（未列出 ≠ 不存在）
+    return true;
+  }
+  return false;
+}
+
+function wrapperPrototypeMember(obj: TypeValue, propName: string): TypeValue | undefined {  let className: string | undefined;
+  if (obj.kind === "primitive") {
+    className = obj.type === "bigint" ? undefined : obj.type[0].toUpperCase() + obj.type.slice(1);
+  } else if (obj.kind === "literal") {
+    if (typeof obj.value === "string") className = "String";
+    else if (typeof obj.value === "number") className = "Number";
+    else if (typeof obj.value === "boolean") className = "Boolean";
+  }
+  if (!className) return undefined;
+  if (propName === "constructor") return builtinClassValue(className);
+  const table = BUILTIN_PROTOTYPE_METHOD_APPROXIMATIONS[className];
+  if (table && hasOwnProp(table, propName)) return table[propName];
+  return undefined;
+}
+
+
+
+
+
+
+function arrayIsArrayLiteral(v: TypeValue): boolean | undefined {
+  let base: TypeValue = v;
+  while (base.kind === "refined") base = base.base;
+  switch (base.kind) {
+    case "array":
+    case "tuple": return true;
+    case "instance": return base.className === "Array";
+    case "object":
+    case "function":
+    case "promise":
+    case "literal":
+    case "primitive": return false;
+    default: return undefined;
+  }
+}
+
+// JavaScript truthiness decided statically. Object-ish kinds (object/array/
+// tuple/function/instance/promise) are always truthy; literals decide on
+// their value; never is unreachable (falsy); symbolic values are null.
+function definiteBoolean(tv: TypeValue): boolean | null {
+  if (tv.kind === "union") {
+    let allTrue = true;
+    let allFalse = true;
+    for (const m of tv.members) {
+      const b = definiteBoolean(m);
+      if (b === null) return null;
+      allTrue = allTrue && b === true;
+      allFalse = allFalse && b === false;
+    }
+    if (allTrue) return true;
+    if (allFalse) return false;
+    return null;
+  }
+  switch (tv.kind) {
+    case "literal": return !!tv.value;
+    case "object":
+    case "array":
+    case "tuple":
+    case "function":
+    case "instance":
+    case "promise": return true;
+    case "never": return false;
+    default: return null;
+  }
+}
+
+/**
+ * 分支合并：双对象先走 Abs join（sum-of-products / 槽位合并），
+ * 失败或非对象再 simplifyUnion。保证 join 代数接到 evaluator 主路径。
+ */
+function joinOrUnion(a: TypeValue, b: TypeValue): TypeValue {
+  if (a.kind === "object" && b.kind === "object") {
+    const joined = tryAbsJoinObjects(a, b);
+    if (joined) return joined;
+  }
+  return simplifyUnion([a, b]);
+}
+
+// Receiver-binding for thisVal-dependent Object.prototype methods
+// (toString/valueOf): `const v = obj.valueOf; v()` loses the member-access
+// receiver, so accesses off a concrete receiver return a copy whose impl
+// closes over it. An explicit `.call(x)`/`.apply(x)` thisVal still wins.
+function bindObjectProtoMethod(fn: TypeValue, receiver: TypeValue): TypeValue {
+  const sig = getFnSig(fn);
+  if (!sig?.impl) return fn;
+  return T.fnSig(sig.paramTypes, sig.returnType, sig.throwsType, (args, thisVal) =>
+    sig.impl!(args, thisVal ?? receiver));
+}
+
+/** `.valueOf` on receivers that don't go through the object/instance
+ * property branches: non-nullish literals and primitives return their
+ * receiver (JS box-unbox semantics), structured values (array/tuple/
+ * function) return themselves, and null/undefined literals produce a call
+ * that throws TypeError — exactly like real JS, so an enclosing try/catch
+ * binds the error instead of the access poisoning the result with unknown. */
+function valueOfBinding(receiver: TypeValue): TypeValue | undefined {
+  switch (receiver.kind) {
+    case "literal": {
+      const v = receiver.value;
+      if (v === null || v === undefined) {
+        return T.fnSig([], T.never, T.instanceOf("TypeError"));
+      }
+      return bindObjectProtoMethod(OBJECT_PROTOTYPE_METHODS["valueOf"], receiver);
+    }
+    case "primitive":
+    case "array":
+    case "tuple":
+    case "function":
+      return bindObjectProtoMethod(OBJECT_PROTOTYPE_METHODS["valueOf"], receiver);
+    default:
+      return undefined;
+  }
+}
+
+// Strict equality over prototype singletons (and instances compared against
+// them): definite true/false only when every cross-pair agrees. null means
+// "not decidable here" — the generic boolean fallback applies.
+function builtinProtoIdentityEq(l: TypeValue, r: TypeValue): boolean | null {
+  const ls = l.kind === "union" ? l.members : [l];
+  const rs = r.kind === "union" ? r.members : [r];
+  let anyProto = false;
+  for (const m of ls.concat(rs)) {
+    if (m.kind !== "instance") return null;
+    if ((m as any)._builtinProto) anyProto = true;
+  }
+  if (!anyProto) return null;
+  let allEq = true;
+  let anyEq = false;
+  for (const lm of ls) {
+    for (const rm of rs) {
+      const eq = typeValueEquals(lm, rm);
+      allEq = allEq && eq;
+      anyEq = anyEq || eq;
+    }
+  }
+  if (allEq) return true;
+  if (!anyEq) return false;
+  return null;
+}
+
+// Strict equality over builtin class namespaces (`x.constructor === Array`
+// where both sides are memoized builtinClassValue objects): definite
+// true/false by class name. null means "not decidable here" — the generic
+// boolean fallback applies.
+function builtinClassIdentityEq(l: TypeValue, r: TypeValue): boolean | null {
+  const ls = l.kind === "union" ? l.members : [l];
+  const rs = r.kind === "union" ? r.members : [r];
+  const nameOf = (v: TypeValue): string | null =>
+    v.kind === "object" && typeof (v as any)._builtinName === "string" ? (v as any)._builtinName : null;
+  const lNames = ls.map(nameOf);
+  const rNames = rs.map(nameOf);
+  if (!lNames.some(Boolean) && !rNames.some(Boolean)) return null;
+  if (lNames.some((n) => n === null) || rNames.some((n) => n === null)) return null;
+  let allEq = true;
+  let anyEq = false;
+  for (const ln of lNames) {
+    for (const rn of rNames) {
+      const eq = ln === rn;
+      allEq = allEq && eq;
+      anyEq = anyEq || eq;
+    }
+  }
+  if (allEq) return true;
+  if (!anyEq) return false;
+  return null;
+}
+
+// Well-known symbols (Symbol.iterator, Symbol.asyncIterator, ...) as
+// marked symbol primitives: plain T.symbol cannot name which symbol it
+// is, but `Symbol.iterator in x` keys on exactly that identity.
+const _wellKnownSymbols = new Map<string, TypeValue>();
+function wellKnownSymbol(name: string): TypeValue {
+  let v = _wellKnownSymbols.get(name);
+  if (v === undefined) {
+    v = { ...(T.symbol as unknown as object), _symbolName: name } as unknown as TypeValue;
+    _wellKnownSymbols.set(name, v);
+  }
+  return v;
+}
+
+function wellKnownSymbolName(v: TypeValue): string | undefined {
+  let base = v;
+  while (base.kind === "refined") base = base.base;
+  if (base.kind === "primitive" && base.type === "symbol") {
+    return (base as any)._symbolName as string | undefined;
+  }
+  return undefined;
+}
+
+// `Symbol.iterator in receiver` iterability by receiver kind: true/false
+// for statically-known receivers, undefined = uncertain (unknown class
+// instances could define the protocol themselves).
+function iteratorInReceiver(v: TypeValue): boolean | undefined {
+  switch (v.kind) {
+    case "array":
+    case "tuple":
+      return true;
+    case "instance":
+      if (v.className === "Set" || v.className === "Map" || v.className === "Buffer") return true;
+      if (BUILTIN_PROTOTYPE_CLASSES.has(v.className)) return false;
+      return undefined;
+    case "literal":
+      return typeof v.value === "string" ? true : false;
+    case "primitive":
+      return v.type === "string" ? true : false;
+    case "object":
+    case "promise":
+    case "function":
+      return false;
+    default:
+      return undefined;
+  }
+}
+
+// `key in obj` literal decisions for non-union operands:
+// - Well-known symbols decide iterability (Symbol.iterator on
+//   arrays/sets/maps/strings → true, plain values → false, unknown-class
+//   instances → boolean).
+// - String keys decide against the declared shape (own properties plus
+//   inherited Object.prototype/builtin-prototype members); a definite
+//   miss is false.
+// - Symbolic keys or uncertain receivers degrade to boolean; unknown
+//   receivers stay unknown.
+function evaluateInMember(key: TypeValue, container: TypeValue): TypeValue {
+  let k = key;
+  while (k.kind === "refined") k = k.base;
+  let c = container;
+  while (c.kind === "refined") c = c.base;
+
+  if (c.kind === "unknown") return T.unknown;
+
+  const symName = wellKnownSymbolName(k);
+  if (symName !== undefined) {
+    if (symName === "iterator") {
+      const iter = iteratorInReceiver(c);
+      return iter === undefined ? T.boolean : T.literal(iter);
+    }
+    // Other well-known symbols (asyncIterator, toStringTag, ...): none of
+    // the statically-known receivers carry them; unknown-class instances
+    // stay symbolic.
+    if (c.kind === "instance" && !BUILTIN_PROTOTYPE_CLASSES.has(c.className)) return T.boolean;
+    return T.literal(false);
+  }
+
+  const strKey = k.kind === "literal" && typeof k.value === "string" ? k.value : undefined;
+  if (strKey === undefined) {
+    // Symbolic key (string, or a symbol without a name): object-ish
+    // receivers still promise a definite boolean; primitives/nullish
+    // cannot hold any property.
+    switch (c.kind) {
+      case "object":
+      case "instance":
+      case "promise":
+      case "function":
+      case "array":
+      case "tuple":
+        return T.boolean;
+      case "literal":
+      case "primitive":
+        return T.literal(false);
+      default:
+        return T.unknown;
+    }
+  }
+
+  const isArrayIndex = (s: string) => /^\d+$/.test(s);
+  switch (c.kind) {
+    case "object":
+      return T.literal(hasOwnProp(c.properties, strKey) || hasOwnProp(OBJECT_PROTOTYPE_METHODS, strKey));
+    case "tuple":
+      if (strKey === "length") return T.literal(true);
+      if (isArrayIndex(strKey)) return T.literal(Number(strKey) < c.elements.length);
+      return T.literal(
+        hasOwnProp(OBJECT_PROTOTYPE_METHODS, strKey) ||
+        hasOwnProp(BUILTIN_PROTOTYPE_METHOD_APPROXIMATIONS.Array, strKey),
+      );
+    case "array":
+      return T.literal(
+        strKey === "length" ||
+        isArrayIndex(strKey) ||
+        hasOwnProp(OBJECT_PROTOTYPE_METHODS, strKey) ||
+        hasOwnProp(BUILTIN_PROTOTYPE_METHOD_APPROXIMATIONS.Array, strKey),
+      );
+    case "instance": {
+      if (hasOwnProp(c.properties, strKey)) return T.literal(true);
+      if (hasOwnProp(OBJECT_PROTOTYPE_METHODS, strKey)) return T.literal(true);
+      // hasOwnProp guard: plain [] access on the class key would leak
+      // native Object.prototype members.
+      const approx = hasOwnProp(BUILTIN_PROTOTYPE_METHOD_APPROXIMATIONS, c.className)
+        ? BUILTIN_PROTOTYPE_METHOD_APPROXIMATIONS[c.className]
+        : undefined;
+      if (approx && hasOwnProp(approx, strKey)) return T.literal(true);
+      if ((c.className === "Set" || c.className === "Map") && strKey === "size") return T.literal(true);
+      return T.literal(false);
+    }
+    case "function":
+      return T.literal(
+        strKey === "prototype" || strKey === "name" || strKey === "length" ||
+        strKey === "call" || strKey === "apply" || strKey === "bind" || strKey === "toString",
+      );
+    case "promise":
+      return T.literal(
+        strKey === "then" || strKey === "catch" || strKey === "finally" ||
+        hasOwnProp(OBJECT_PROTOTYPE_METHODS, strKey),
+      );
+    case "literal":
+      if (typeof c.value === "string") {
+        return T.literal(strKey === "length" || (isArrayIndex(strKey) && Number(strKey) < c.value.length));
+      }
+      return T.literal(false);
+    case "primitive":
+      if (c.type === "string") return T.literal(strKey === "length" || isArrayIndex(strKey));
+      return T.literal(false);
+    default:
+      return T.boolean;
+  }
+}
 
 type SourceRange = { start: { line: number; column: number }; end: { line: number; column: number } };
 
+let _currentSource = "";
+
+export function setCurrentSource(source: string): void {
+  _currentSource = source;
+}
+
+type ActiveReplace = { targetSource: string; typeExpr: TypeValue };
+let _activeReplacements: ActiveReplace[] = [];
+let _activeAsOverride: TypeValue | null = null;
+
+function nodeSourceText(node: Node): string | null {
+  if (node.start == null || node.end == null || !_currentSource) return null;
+  return _currentSource.slice(node.start, node.end);
+}
+
+function normalizeWhitespace(s: string): string {
+  return s.replace(/\s+/g, "");
+}
+
+function matchesReplacement(node: Node): TypeValue | null {
+  if (_activeReplacements.length === 0) return null;
+  const src = nodeSourceText(node);
+  if (!src) return null;
+  const normalized = normalizeWhitespace(src);
+  for (const r of _activeReplacements) {
+    if (normalizeWhitespace(r.targetSource) === normalized) return r.typeExpr;
+  }
+  return null;
+}
+
 const RETURN_SIGNAL = Symbol("ReturnSignal");
 const BRANCH_SIGNAL = Symbol("BranchSignal");
 const THROW_SIGNAL = Symbol("ThrowSignal");
@@ -67,36 +496,107 @@ function isThrow(v: unknown): v is ThrowSignal {
   return typeof v === "object" && v !== null && THROW_SIGNAL in v;
 }
 
+// --- break / continue ---
+// 循环控制语句此前完全未求值（evaluate 无 case，信号丢失后守卫内
+// `break` 之后的语句照常执行 —— reach.js 的 `if (!ref) { …; break }`
+// 因此在 undefined 上求 `ref[key]`，产生假 no-method error）。实现上
+// 借道 Throw 信号管线：break/continue 对象带 THROW_SYMBOL 标记，全部
+// 既有 isThrow 检查点（语句列表、二元短路、调用边界）原样传播它们，
+// 只有循环边界与 switch 吸收。真实 throw 与循环信号用 LOOP_SIGNAL_KIND
+// 区分：前者继续走抛出语义，后者终止/跳过当轮迭代。
+const LOOP_SIGNAL_KIND = Symbol("LoopSignalKind");
+
+type LoopSignal = ThrowSignal & {
+  readonly [LOOP_SIGNAL_KIND]: "break" | "continue";
+};
+
+function makeBreak(): LoopSignal {
+  return { [THROW_SIGNAL]: true, [LOOP_SIGNAL_KIND]: "break", thrown: T.never };
+}
+
+function makeContinue(): LoopSignal {
+  return { [THROW_SIGNAL]: true, [LOOP_SIGNAL_KIND]: "continue", thrown: T.never };
+}
+
+function loopSignalKind(v: unknown): "break" | "continue" | null {
+  if (typeof v !== "object" || v === null) return null;
+  const kind = (v as Record<symbol, unknown>)[LOOP_SIGNAL_KIND];
+  return kind === "break" || kind === "continue" ? kind : null;
+}
+
 type EvalResult = TypeValue | ReturnSignal | BranchSignal | ThrowSignal;
 
 const MEMO_IN_PROGRESS = Symbol("MemoInProgress");
 const callMemo = new Map<string, TypeValue | typeof MEMO_IN_PROGRESS>();
 
-function buildMemoKey(fn: TypeValue & { kind: "function" }, args: TypeValue[]): string | null {
+function buildMemoKey(
+  fn: TypeValue & { kind: "function" },
+  args: TypeValue[],
+  thisVal?: TypeValue,
+): string | null {
   const fnName = (fn as any)._memoize as string | undefined;
   if (!fnName) return null;
   const argsKey = args.map(typeValueToString).join(",");
-  return `${fnName}(${argsKey})`;
+  // `this` participates in the key: obj1.f() and obj2.f() must not share a
+  // memo entry when f reads `this`.
+  const thisKey = thisVal ? `this:${typeValueToString(thisVal)};` : "";
+  return `${fnName}(${thisKey}${argsKey})`;
 }
 
 const moduleCache = new Map<string, Environment>();
 
+/** 模块加载链（import / require / @nudo:mock-module mock 文件）深度上限。
+ *  超限即截断为空环境并记录诊断——防御病态嵌套链，以及解析器返回未归一化
+ *  路径时（同一逻辑文件每次都是「新」路径、缓存永不命中）的真栈溢出。 */
+const MAX_MODULE_LOAD_DEPTH = 16;
+
 export function resetMemo(): void {
   callMemo.clear();
   moduleCache.clear();
+  // 加载栈由 try/finally 保证配平，这里清空是双保险：任何中途逃逸的帧
+  // 都会让后续分析把正常文件误判为环。
+  _moduleEvalStack.length = 0;
+  _callDepth = 0;
+  _totalCalls = 0;
+  _activeCallKeys.length = 0;
 }
 
-export function setModuleResolver(resolver: ((source: string, fromDir: string) => { ast: Node; filePath: string } | null) | null): void {
+export function setModuleResolver(resolver: ((source: string, fromDir: string) => { ast: Node; filePath: string; json?: unknown } | null) | null): void {
   currentModuleResolver = resolver;
 }
 
-let currentModuleResolver: ((source: string, fromDir: string) => { ast: Node; filePath: string } | null) | null = null;
+let currentModuleResolver: ((source: string, fromDir: string) => { ast: Node; filePath: string; json?: unknown } | null) | null = null;
 let currentFileDir = "";
 
+let envModules: Record<string, Record<string, TypeValue>> = {};
+let mockModules: Map<string, { fromPath: string; names?: string[] }> = new Map();
+
+export function setEnvModules(modules: Record<string, Record<string, TypeValue>>): void {
+  envModules = modules;
+}
+
+export function resetEnvModules(): void {
+  envModules = {};
+}
+
+export function setMockModules(mocks: Map<string, { fromPath: string; names?: string[] }>): void {
+  mockModules = mocks;
+}
+
+export function resetMockModules(): void {
+  mockModules = new Map();
+}
+
 let _nodeTypeCollector: ((node: Node, tv: TypeValue) => void) | null = null;
 let _sampleCount = 3;
 let _maxConcreteIter = 1000;
 
+let _onUnknownBuiltin: ((name: string, loc?: { start: { line: number; column: number }; end: { line: number; column: number } }) => void) | null = null;
+
+export function setUnknownBuiltinHandler(handler: ((name: string, loc?: { start: { line: number; column: number }; end: { line: number; column: number } }) => void) | null) {
+  _onUnknownBuiltin = handler;
+}
+
 export function setSampleCount(count: number): void {
   _sampleCount = count;
 }
@@ -115,6 +615,277 @@ function recordNodeType(node: Node, tv: TypeValue): void {
   }
 }
 
+export type CallRecord = {
+  fnName: string;
+  argTypes: TypeValue[];
+  resultType: TypeValue;
+  throws: TypeValue;
+  /** Line-relative. Per-fn cache replay shifts this by lineDelta — if you
+   *  add another position field (callee loc, arg loc), extend
+   *  shiftCallRecordLines in analyzer.ts in the same change. */
+  callLoc?: { line: number; column: number };
+  targetModule?: string;
+  targetExport?: string;
+  /** export names the same function value was re-exported under after its
+   * defining module (barrel `index.js`, CJS forwarding shims); usage-site
+   * records stay name-matchable against them */
+  targetAliases?: string[];
+  /** module whose evaluation created the function value (definition site).
+   * Usage-site collection transitively evaluates the library under require(),
+   * so records of the library's INTERNAL calls (no export tag) can still be
+   * attributed to the defining file — while test-local functions and builtin
+   * statics stay unattributed and cannot pollute same-name candidates. */
+  fnModule?: string;
+};
+
+// --- Cross-module call attribution ---
+// Module-exported function values get tagged with their (module, export)
+// origin when the module environment is first built (moduleCache fill). The
+// same object reference flows through import bindings to call sites, so
+// recordCall can look the tag up from the evaluated callee value and mark the
+// record as targeting another module. Non-function exports are not tagged.
+
+const _exportTags = new WeakMap<object, { module: string; export: string; aliases?: string[] }>();
+
+/** Tag a function value with its exporting (module, export). A re-export
+ * chain — a barrel `index.js` doing `parseChunked: require('./parse-chunked')`,
+ * a CJS shim doing `module.exports = require('../../src/index.js')` — flows
+ * ONE function value through several module scopes, and each scope's tagging
+ * pass used to overwrite the tag with its own (module, export), so usage-site
+ * records ended up pointing at the last intermediary instead of the defining
+ * file. Now the first (definition-site) tag sticks; later export names
+ * accumulate as aliases. */
+// --- Function definition-site tags ---
+// Which module's evaluation created a function value. Only AST function
+// nodes route through tagFnModule — lazily built builtin tables never enter
+// a module stack, so builtin statics stay unattributed.
+const _fnModuleTags = new WeakMap<object, string>();
+const _moduleEvalStack: string[] = [];
+
+function tagFnModule(v: TypeValue): void {
+  const top = _moduleEvalStack[_moduleEvalStack.length - 1];
+  if (top !== undefined && v.kind === "function") {
+    if (!_fnModuleTags.has(v)) _fnModuleTags.set(v, top);
+  }
+}
+
+// 执行来源栈：当前正在执行的函数体来自哪个模块（fnModule tag；未 tag 的
+// 函数继承栈顶——本地函数无 tag 时代码在本文件内执行）。recordUnknown 据此
+// 给记录标 originModule，分析侧丢弃使用现场闭包体的泄漏错误。
+const _execOriginStack: (string | undefined)[] = [];
+
+/** usage-site 执行标记：外部调用记录的实参里携带的闭包（测试回调等）在
+ * case 合成重求值时被执行，其内部错误属于使用现场文件，与本文件分析无关。
+ * 分析侧在注入前对全部外部实参调用本函数；执行来源栈读到该标记时
+ * recordUnknown.originModule 记为标记值，分析侧据此丢弃。不按模块路径
+ * 比较——跨文件依赖（本文件 require 链上加载的模块）的执行记录是合法
+ * 的可达分析，不能误伤。 */
+export const USAGE_SITE_MODULE = "__usage_site__";
+
+export function setUsageSiteTag(tv: TypeValue, _seen: Set<object> = new Set()): void {
+  if (!tv || typeof tv !== "object" || _seen.has(tv)) return;
+  _seen.add(tv);
+  switch (tv.kind) {
+    case "function":
+      _fnModuleTags.set(tv, USAGE_SITE_MODULE);
+      return;
+    case "array":
+      return setUsageSiteTag(tv.element, _seen);
+    case "tuple":
+      for (const e of tv.elements) setUsageSiteTag(e, _seen);
+      return;
+    case "object":
+      for (const v of Object.values(tv.properties)) setUsageSiteTag(v, _seen);
+      return;
+    case "promise":
+      return setUsageSiteTag(tv.value, _seen);
+    case "union":
+      for (const m of tv.members) setUsageSiteTag(m, _seen);
+      return;
+    case "refined":
+      return setUsageSiteTag(tv.base, _seen);
+    default:
+      return;
+  }
+}
+
+function tagExport(v: TypeValue & { kind: "function" }, filePath: string, name: string): void {  const existing = _exportTags.get(v);
+  if (existing) {
+    if (existing.module === filePath && existing.export === name) return;
+    if (!existing.aliases) existing.aliases = [];
+    if (!existing.aliases.includes(name)) existing.aliases.push(name);
+    return;
+  }
+  _exportTags.set(v, { module: filePath, export: name });
+}
+
+function tagModuleExports(env: Environment, filePath: string): void {
+  const bindings = env.getOwnBindings();
+  for (const [k, v] of Object.entries(bindings)) {
+    if (!k.startsWith("__export_")) continue;
+    if (v.kind !== "function") continue;
+    const name = k === "__export_default" ? "default" : k.slice("__export_".length);
+    tagExport(v, filePath, name);
+  }
+}
+
+// --- CommonJS module scope ---
+// v1 does not distinguish module systems: every evaluated program (top-level
+// or module load) gets the implicit CJS bindings, so `require` /
+// `module.exports` / `exports.x` patterns analyze even inside ESM files.
+
+const _cjsRequireValue = T.fn(["specifier"], { type: "BlockStatement", body: [] } as any, undefined as any);
+
+function bindCommonJsGlobals(env: Environment): void {
+  if (env.has("module")) return; // already set up as a module scope
+  const exportsObj = T.object({});
+  // Marker so require() can tell "target never wrote CJS exports" apart from
+  // an explicit `module.exports = {...}` replacement.
+  (exportsObj as any).__cjsExportsRoot = true;
+  const moduleObj = T.object({ exports: exportsObj });
+  env.bind("exports", exportsObj);
+  env.bind("module", moduleObj);
+  env.bind("require", _cjsRequireValue);
+  env.bind("__dirname", T.string);
+  env.bind("__filename", T.string);
+}
+
+// CJS exports are plain values (`module.exports` itself, or its properties),
+// not `__export_` bindings; tag the function values the same way so
+// cross-module call attribution also works for require()d modules.
+function tagCommonJsExports(env: Environment, filePath: string): void {
+  if (!env.has("module")) return;
+  const moduleVal = env.lookup("module");
+  if (moduleVal.kind !== "object") return;
+  const exp = moduleVal.properties["exports"];
+  if (!exp) return;
+  if (exp.kind === "function") {
+    tagExport(exp, filePath, "default");
+    return;
+  }
+  if (exp.kind === "object") {
+    for (const [k, v] of Object.entries(exp.properties)) {
+      if (v.kind === "function") tagExport(v, filePath, k);
+    }
+  }
+}
+
+let _callCollector: ((record: CallRecord) => void) | null = null;
+
+export function setCallCollector(collector: ((record: CallRecord) => void) | null): void {
+  _callCollector = collector;
+}
+
+function recordCall(
+  fnName: string,
+  args: TypeValue[],
+  result: { value: TypeValue; throws: TypeValue },
+  loc: Node["loc"],
+  calleeVal?: TypeValue,
+): void {
+  if (!_callCollector) return;
+  // Synthetic Promise resolve/reject collectors are internal plumbing, not
+  // user-code call sites — never feed them into the callsite collector.
+  if (calleeVal && _promiseCollectors.has(calleeVal as unknown as object)) return;
+  const record: CallRecord = {
+    fnName,
+    argTypes: args,
+    resultType: result.value,
+    throws: result.throws,
+    callLoc: loc ? { line: loc.start.line, column: loc.start.column } : undefined,
+  };
+  const tag = calleeVal ? _exportTags.get(calleeVal) : undefined;
+  if (tag) {
+    record.targetModule = tag.module;
+    record.targetExport = tag.export;
+    if (tag.aliases && tag.aliases.length > 0) record.targetAliases = [...tag.aliases];
+  }
+  const fnModule = calleeVal ? _fnModuleTags.get(calleeVal) : undefined;
+  if (fnModule) record.fnModule = fnModule;
+  _callCollector(record);
+}
+
+export type UnknownRecord = {
+  kind: "method" | "property" | "global";
+  name: string;
+  receiverType?: TypeValue;
+  loc?: { line: number; column: number };
+  reason?: string;
+  origin?: { line: number; column: number };
+  /** 定义当前正在执行的函数的模块（执行来源栈顶）。case 合成重求值会执行
+   * 注入实参携带的使用现场闭包体，其内部错误记录属于使用现场文件——
+   * 分析侧据此丢弃（行数守卫会被同行号假阳性骗过）。 */
+  originModule?: string;
+};
+
+let _unknownCollector: ((record: UnknownRecord) => void) | null = null;
+
+export function setUnknownCollector(collector: ((record: UnknownRecord) => void) | null): void {
+  _unknownCollector = collector;
+}
+
+// --- Provenance side table ---
+// Maps an argument TypeValue (annotated at its call-site expression in
+// evaluateArgs) back to the source location of the expression that produced it.
+// The same object references flow into parameter bindings, so recordUnknown can
+// reverse-lookup where a receiver value originated from. Disabled by default;
+// zero overhead when off.
+
+const _originMap = new WeakMap<TypeValue, { line: number; column: number }>();
+let _provenanceEnabled = false;
+
+export function setProvenanceTracking(enabled: boolean): void {
+  _provenanceEnabled = enabled;
+}
+
+/** 克隆 TypeValue 后拷贝 provenance（tagParamArg 会 clone，丢 origin 会导致 M5 回归） */
+function copyOrigin(from: TypeValue, to: TypeValue): void {
+  if (!_provenanceEnabled || !from || !to) return;
+  const o = _originMap.get(from);
+  if (o) _originMap.set(to, o);
+}
+
+function extractOrigin(
+  tv: TypeValue | undefined,
+): { line: number; column: number } | undefined {
+  if (!_provenanceEnabled || !tv) return undefined;
+  const direct = _originMap.get(tv);
+  if (direct) return direct;
+  if (tv.kind === "union") {
+    for (const member of tv.members) {
+      const found = _originMap.get(member);
+      if (found) return found;
+    }
+  } else if (tv.kind === "object") {
+    for (const propVal of Object.values(tv.properties)) {
+      const found = _originMap.get(propVal);
+      if (found) return found;
+    }
+  }
+  return undefined;
+}
+
+/** Own-property check for plain record tables. Plain `{}` records inherit
+ * Object.prototype, so `in` / bracket access would leak native members
+ * (e.g. the real JS `hasOwnProperty`, `toString`) into the type system as
+ * bogus values. */
+function hasOwnProp(props: Record<string, unknown>, name: string): boolean {
+  return Object.prototype.hasOwnProperty.call(props, name);
+}
+
+function recordUnknown(r: Omit<UnknownRecord, "loc"> & { loc?: Node["loc"] }): void {
+  if (!_unknownCollector) return;
+  const origin = r.kind === "method" || r.kind === "property"
+    ? extractOrigin(r.receiverType)
+    : undefined;
+  _unknownCollector({
+    ...r,
+    origin,
+    originModule: _execOriginStack.length > 0 ? _execOriginStack[_execOriginStack.length - 1] : undefined,
+    loc: r.loc ? { line: r.loc.start.line, column: r.loc.start.column } : undefined,
+  });
+}
+
 function distributeOverUnion(
   tv: TypeValue,
   fn: (member: TypeValue) => TypeValue,
@@ -125,23 +896,210 @@ function distributeOverUnion(
   return fn(tv);
 }
 
-function distributeBinaryOverUnion(
-  left: TypeValue,
-  right: TypeValue,
-  fn: (l: TypeValue, r: TypeValue) => TypeValue,
+// --- Computed member access with a non-literal key (key-set evaluation) ---
+//
+// `obj[key]` where the key is a string/number type rather than a known
+// literal: the set of reachable values is exactly the object's own property
+// values (or the tuple's elements). When they are structurally uniform one
+// shared type answers every key; otherwise the union of all values does
+// (bounded, so pathological records cannot blow up the type graph).
+const MAX_KEYSET_PROPS = 16;
+const MAX_KEYSET_MEMBERS = 12;
+const MAX_KEYSET_TABLE_FNS = 8;
+
+/** Structural fingerprint for key-set uniformity. Mirrors the analyzer's
+ * typeStructureKey semantics (literal values included, so {a:1,b:2} is NOT
+ * uniform) but keeps function values identity-distinct: two different
+ * closures (a method table's entries) must never count as "uniform", or
+ * `Table[f]()` would silently pick one function's result. */
+const keySetObjIds = new WeakMap<object, number>();
+let keySetObjIdSeq = 0;
+
+function objectId(tv: object): number {
+  let id = keySetObjIds.get(tv);
+  if (id === undefined) {
+    id = ++keySetObjIdSeq;
+    keySetObjIds.set(tv, id);
+  }
+  return id;
+}
+
+const keySetKeyCache = new WeakMap<object, string>();
+const KEYSET_KEY_NODE_BUDGET = 64;
+
+function keySetStructureKeyUncached(tv: TypeValue, budget: { left: number }): string {
+  if (budget.left <= 0) return `oversized@${objectId(tv)}`;
+  budget.left--;
+  switch (tv.kind) {
+    case "literal":
+      return `lit(${typeof tv.value}:${String(tv.value)})`;
+    case "primitive":
+      return `prim(${tv.type})`;
+    case "array":
+      return `arr(${keySetStructureKeyUncached(tv.element, budget)})`;
+    case "tuple":
+      return `tup(${tv.elements.map((e) => keySetStructureKeyUncached(e, budget)).join(",")})`;
+    case "object":
+      return `obj(${Object.keys(tv.properties).sort().map((k) => `${k}:${keySetStructureKeyUncached(tv.properties[k], budget)}`).join(",")})`;
+    case "promise":
+      return `prom(${keySetStructureKeyUncached(tv.value, budget)})`;
+    case "instance":
+      return `inst(${tv.className})`;
+    case "refined":
+      return `ref(${keySetStructureKeyUncached(tv.base, budget)})`;
+    case "union":
+      return `uni(${tv.members.map((m) => keySetStructureKeyUncached(m, budget)).sort().join("|")})`;
+    case "function":
+      return `fn#${objectId(tv)}`;
+    default:
+      return tv.kind;
+  }
+}
+
+/** Structural fingerprint for key-set uniformity. Mirrors the analyzer's
+ * typeStructureKey semantics (literal values included, so {a:1,b:2} is NOT
+ * uniform) but keeps function values identity-distinct: two different
+ * closures (a method table's entries) must never count as "uniform", or
+ * `Table[f]()` would silently pick one function's result. Memoized per
+ * type value with a node budget — fixture-scale structures must not pay
+ * string building on every dynamic-key access. */
+function keySetStructureKey(tv: TypeValue): string {
+  const cached = keySetKeyCache.get(tv);
+  if (cached !== undefined) return cached;
+  const key = keySetStructureKeyUncached(tv, { left: KEYSET_KEY_NODE_BUDGET });
+  keySetKeyCache.set(tv, key);
+  return key;
+}
+
+function objectKeySetAccess(obj: TypeValue & { kind: "object" }): TypeValue {
+  const keys = Object.keys(obj.properties);
+  if (keys.length === 0) return T.undefined;
+  if (keys.length > MAX_KEYSET_PROPS) return T.unknown;
+  const values = keys.map((k) => obj.properties[k]);
+  if (values.every((v) => v.kind === "unknown")) return T.unknown;
+  const firstKey = keySetStructureKey(values[0]);
+  if (values.every((v) => keySetStructureKey(v) === firstKey)) {
+    return values[0];
+  }
+  // Method tables (`Strings[f]()`) union their member functions; calling a
+  // union of N functions runs N evaluations, so keep that budget tighter
+  // than the data-member cap.
+  if (values.every((v) => v.kind === "function") && values.length > MAX_KEYSET_TABLE_FNS) {
+    return T.unknown;
+  }
+  const union = simplifyUnion(values);
+  if (union.kind === "union" && union.members.length > MAX_KEYSET_MEMBERS) return T.unknown;
+  return union;
+}
+
+/** Does this key type admit key-set evaluation? Literal keys (and unions
+ * that collapse to literals) are handled precisely; everything else falls
+ * back to the property/element set. */
+function isDynamicStringKey(propVal: TypeValue): boolean {
+  if (propVal.kind === "unknown" || (propVal.kind === "primitive" && propVal.type === "string")) return true;
+  if (propVal.kind === "union") {
+    return propVal.members.some((m) => isDynamicStringKey(m) || (m.kind === "literal" && typeof m.value === "string"));
+  }
+  return false;
+}
+
+function isDynamicNumberKey(propVal: TypeValue): boolean {
+  if (propVal.kind === "unknown" || (propVal.kind === "primitive" && propVal.type === "number")) return true;
+  if (propVal.kind === "union") {
+    return propVal.members.some((m) => isDynamicNumberKey(m) || (m.kind === "literal" && typeof m.value === "number"));
+  }
+  return false;
+}
+
+function unionOfLiteralKind(tv: TypeValue, pred: (v: unknown) => boolean): tv is TypeValue & { kind: "union" } {
+  return tv.kind === "union" && tv.members.every((m) => m.kind === "literal" && pred(m.value));
+}
+
+/** Computed `obj[key]` on one union member of the receiver. Shared by
+ * MemberExpression / OptionalMemberExpression. `markMiss` records the
+ * unknown-property diagnostic for literal string keys that miss. */
+function computedMemberOnMember(
+  obj: TypeValue,
+  propVal: TypeValue,
+  markMiss: () => void,
 ): TypeValue {
-  if (left.kind === "union" && right.kind === "union") {
-    return simplifyUnion(
-      left.members.flatMap((l) => right.members.map((r) => fn(l, r))),
-    );
+  if (obj.kind === "object") {
+    if (propVal.kind === "literal" && typeof propVal.value === "string") {
+      return (hasOwnProp(obj.properties, propVal.value) ? obj.properties[propVal.value] : undefined) ?? T.undefined;
+    }
+    if (unionOfLiteralKind(propVal, (v) => typeof v === "string")) {
+      return simplifyUnion(
+        (propVal as TypeValue & { kind: "union" }).members.map((m) =>
+          (m as TypeValue & { kind: "literal" }).value as string,
+        ).map((k) => (hasOwnProp(obj.properties, k) ? obj.properties[k] : undefined) ?? T.undefined),
+      );
+    }
+    if (isDynamicStringKey(propVal)) {
+      return objectKeySetAccess(obj);
+    }
+    if (propVal.kind === "literal" && typeof propVal.value === "string") {
+      markMiss();
+    }
+    return T.unknown;
+  }
+  if (obj.kind === "array" || obj.kind === "tuple") {
+    if (propVal.kind === "literal" && typeof propVal.value === "number") {
+      if (obj.kind === "tuple") return obj.elements[propVal.value] ?? T.undefined;
+      return obj.element;
+    }
+    // A string-keyed read off an array/tuple hits no data property (real
+    // JS yields undefined, same as a missed key on an object) — returning
+    // unknown here would poison any union the read flows into.
+    if (propVal.kind === "literal" && typeof propVal.value === "string") {
+      return T.undefined;
+    }
+    if (unionOfLiteralKind(propVal, (v) => typeof v === "number")) {
+      const indices = (propVal as TypeValue & { kind: "union" }).members.map(
+        (m) => (m as TypeValue & { kind: "literal" }).value as number,
+      );
+      if (obj.kind === "tuple") {
+        return simplifyUnion(indices.map((i) => obj.elements[i] ?? T.undefined));
+      }
+      return obj.element;
+    }
+    if (isDynamicNumberKey(propVal)) {
+      // arr[anyNumber]: tuple → union of its elements, array → element type
+      if (obj.kind === "tuple") {
+        return obj.elements.length > 0 ? simplifyUnion(obj.elements) : T.undefined;
+      }
+      return obj.element;
+    }
+    return T.unknown;
+  }
+  if (obj.kind === "instance" && isDynamicStringKey(propVal)) {
+    // Known instances (Map/Set/Buffer singletons...) carry no string-keyed
+    // data properties; a dynamic key resolves to undefined rather than
+    // poisoning enclosing unions with unknown.
+    return T.undefined;
   }
-  if (left.kind === "union") {
-    return simplifyUnion(left.members.map((l) => fn(l, right)));
+  if (propVal.kind === "literal" && typeof propVal.value === "string") {
+    markMiss();
   }
-  if (right.kind === "union") {
-    return simplifyUnion(right.members.map((r) => fn(left, r)));
+  return T.unknown;
+}
+
+function evaluateComputedMemberAccess(objVal: TypeValue, propVal: TypeValue, node: Node): TypeValue {
+  let propMissed = false;
+  const result = distributeOverUnion(objVal, (obj) =>
+    computedMemberOnMember(obj, propVal, () => {
+      propMissed = true;
+    }),
+  );
+  if (propMissed && propVal.kind === "literal" && typeof propVal.value === "string") {
+    recordUnknown({
+      kind: "property",
+      name: propVal.value,
+      receiverType: objVal,
+      loc: node.loc,
+      reason: `no property '${propVal.value}' on ${objVal.kind}`,
+    });
   }
-  return fn(left, right);
+  return result;
 }
 
 let _unreachableRanges: SourceRange[] = [];
@@ -168,8 +1126,24 @@ function evaluateStatements(
 
   for (let i = 0; i < stmts.length; i++) {
     const stmt = stmts[i];
+
+    const inlineDirectives = extractInlineDirectives(stmt);
+    const savedAs = _activeAsOverride;
+    const savedReplacements = _activeReplacements;
+
+    const asDir = inlineDirectives.find((d): d is InlineDirective & { kind: "as" } => d.kind === "as");
+    const replaceDirs = inlineDirectives.filter((d): d is InlineDirective & { kind: "replace" } => d.kind === "replace");
+
+    _activeAsOverride = asDir?.typeExpr ?? null;
+    _activeReplacements = replaceDirs.length > 0
+      ? replaceDirs.map((d) => ({ targetSource: d.targetSource, typeExpr: d.typeExpr }))
+      : [];
+
     const result = evaluate(stmt, currentEnv);
 
+    _activeAsOverride = savedAs;
+    _activeReplacements = savedReplacements;
+
     if (isThrow(result)) {
       collectUnreachable(stmts, i + 1);
       return result;
@@ -218,6 +1192,9 @@ function describeParam(p: Node): string {
 }
 
 export function evaluate(node: Node, env: Environment): EvalResult {
+  const replacement = matchesReplacement(node);
+  if (replacement) return replacement;
+
   const result = evaluateNode(node, env);
   if (_nodeTypeCollector && node.loc && !isReturn(result) && !isBranch(result) && !isThrow(result)) {
     recordNodeType(node, result);
@@ -234,6 +1211,7 @@ function evaluateNode(node: Node, env: Environment): EvalResult {
       return evaluateStatements(node.body, env);
 
     case "ExpressionStatement":
+      if (_activeAsOverride) return _activeAsOverride;
       return evaluate(node.expression, env);
 
     case "NumericLiteral":
@@ -248,13 +1226,69 @@ function evaluateNode(node: Node, env: Environment): EvalResult {
     case "NullLiteral":
       return T.null;
 
+    case "RegExpLiteral":
+      return createRegExpType();
+
     case "Identifier": {
       if (node.name === "undefined") return T.undefined;
+      // Check for built-in global objects (env-injected values take priority,
+      // e.g. @nudo:env es binds fnSig-backed globals with precise impls).
+      // hasOwnProp guard: `in` would hit the JS prototype chain and leak
+      // native functions for names like `hasOwnProperty`.
+      if (hasOwnProp(BUILTIN_STATIC_METHODS, node.name) && !env.has(node.name)) {
+        const builtin = BUILTIN_STATIC_METHODS[node.name];
+        if (typeof builtin === "object" && builtin !== null && !("kind" in builtin)) {
+          // It's a namespace object (like Date, Math, JSON); memoized so
+          // `'x'.constructor === String` hits reference equality.
+          return builtinClassValue(node.name);
+        }
+        // It's a direct value (like parseInt, isNaN)
+        return builtin as TypeValue;
+      }
+      // Constructible built-in classes without static-method coverage (Error,
+      // Map, Set, ...) still resolve to a namespace object so `X.prototype`
+      // can be typed as an instance.
+      if (BUILTIN_PROTOTYPE_CLASSES.has(node.name) && !env.has(node.name)) {
+        return builtinClassValue(node.name);
+      }
+      // Check if it looks like a built-in but isn't covered
+      if (node.name[0] === node.name[0].toUpperCase() && !env.has(node.name)) {
+        if (_onUnknownBuiltin) {
+          _onUnknownBuiltin(node.name, node.loc as any);
+        }
+        recordUnknown({
+          kind: "global",
+          name: node.name,
+          loc: node.loc,
+          reason: `unknown global identifier '${node.name}'`,
+        });
+        // Unresolved builtins propagate unknown (not undefined) so property
+        // access on them degrades to unknown instead of a false
+        // "property does not exist on undefined" error.
+        return T.unknown;
+      }
+      // Bare `hasOwnProperty(...)`-style references resolve through the
+      // global object's prototype chain in real JS — Object.prototype
+      // members act as implicit globals (own-guarded against proto leak).
+      if (!env.has(node.name) && hasOwnProp(OBJECT_PROTOTYPE_METHODS, node.name)) {
+        return OBJECT_PROTOTYPE_METHODS[node.name];
+      }
       return env.lookup(node.name);
     }
 
-    case "ThisExpression":
-      return env.lookup("this");
+    case "ThisExpression": {
+      // Un-bound `this` (plain function called without a receiver, e.g. a
+      // callsite-synthesized case): the receiver is unknowable statically, so
+      // degrade to unknown — `this.x` then warns (unknown-recv) instead of
+      // erroring with "on type 'undefined'". Explicit bindings (constructors,
+      // obj.f() receivers, .call(thisArg)) take precedence unchanged.
+      const thisVal = env.lookup("this");
+      // T.undefined is `{ kind: "literal", value: undefined }`.
+      if (thisVal === undefined || (thisVal.kind === "literal" && thisVal.value === undefined)) {
+        return T.unknown;
+      }
+      return thisVal;
+    }
 
     case "TemplateLiteral": {
       if (node.expressions.length === 0 && node.quasis.length === 1) {
@@ -291,22 +1325,39 @@ function evaluateNode(node: Node, env: Environment): EvalResult {
       if (node.operator === "instanceof") {
         return evaluateInstanceof(leftVal, rightVal, node.right, env);
       }
-      return distributeBinaryOverUnion(leftVal, rightVal, (l, r) =>
-        dispatchBinaryOp(node.operator, l, r),
-      );
+      if (node.operator === "in") {
+        return distributeBinaryOverUnion(leftVal, rightVal, (l, r) => evaluateInMember(l, r));
+      }
+      if (node.operator === "===" || node.operator === "!==") {
+        const identity = builtinProtoIdentityEq(leftVal, rightVal);
+        if (identity !== null) {
+          return T.literal(node.operator === "===" ? identity : !identity);
+        }
+        const classIdentity = builtinClassIdentityEq(leftVal, rightVal);
+        if (classIdentity !== null) {
+          return T.literal(node.operator === "===" ? classIdentity : !classIdentity);
+        }
+      }
+
+      // 统一二元：代数优先 → 宽松相等 → 外延 Ops
+      const bin = evalBinaryValue(node.operator, leftVal, rightVal);
+      if (bin !== undefined) return bin;
+      return T.unknown;
     }
 
     case "UnaryExpression": {
       const argVal = evaluate(node.argument, env);
       if (isReturn(argVal) || isBranch(argVal) || isThrow(argVal)) return argVal;
-      if (node.operator === "typeof") {
-        return distributeOverUnion(argVal, (v) => Ops.typeof_(v));
-      }
+      // 一元语言表面经代数（typeof / ! / -）
+      const unary = tryAbsUnary(node.operator, argVal);
+      if (unary !== undefined) return unary;
       if (node.operator === "!") {
-        return distributeOverUnion(argVal, (v) => Ops.not(v));
-      }
-      if (node.operator === "-") {
-        return distributeOverUnion(argVal, (v) => Ops.neg(v));
+        // 代数未接住：对象恒真等 host 知识
+        return distributeOverUnion(argVal, (v) => {
+          const decided = definiteBoolean(v);
+          if (decided !== null) return T.literal(!decided);
+          return Ops.not(v);
+        });
       }
       return T.unknown;
     }
@@ -321,6 +1372,13 @@ function evaluateNode(node: Node, env: Environment): EvalResult {
           const rv = evaluate(node.right, env);
           return isReturn(rv) || isBranch(rv) || isThrow(rv) ? rv : rv;
         }
+        // Object-ish left operands are always truthy: `Buffer && f(x)` is f(x)
+        const leftTruthy = definiteBoolean(leftVal);
+        if (leftTruthy === true) {
+          const rv = evaluate(node.right, env);
+          return isReturn(rv) || isBranch(rv) || isThrow(rv) ? rv : rv;
+        }
+        if (leftTruthy === false) return leftVal;
         const rv = evaluate(node.right, env);
         const rightTV = isReturn(rv) || isBranch(rv) || isThrow(rv) ? T.unknown : rv;
         return simplifyUnion([leftVal, rightTV]);
@@ -332,6 +1390,12 @@ function evaluateNode(node: Node, env: Environment): EvalResult {
           const rv = evaluate(node.right, env);
           return isReturn(rv) || isBranch(rv) || isThrow(rv) ? rv : rv;
         }
+        const leftTruthy = definiteBoolean(leftVal);
+        if (leftTruthy === true) return leftVal;
+        if (leftTruthy === false) {
+          const rv = evaluate(node.right, env);
+          return isReturn(rv) || isBranch(rv) || isThrow(rv) ? rv : rv;
+        }
         const rv = evaluate(node.right, env);
         const rightTV = isReturn(rv) || isBranch(rv) || isThrow(rv) ? T.unknown : rv;
         return simplifyUnion([leftVal, rightTV]);
@@ -345,9 +1409,17 @@ function evaluateNode(node: Node, env: Environment): EvalResult {
           const rv = evaluate(node.right, env);
           return isReturn(rv) || isBranch(rv) || isThrow(rv) ? rv : rv;
         }
+        // For non-literal types, narrow by removing null/undefined from the left side
+        const narrowedLeft = subtractType(leftVal, (m) =>
+          (m.kind === "literal" && (m.value === null || m.value === undefined))
+        );
+        if (narrowedLeft.kind !== "never") {
+          return narrowedLeft;
+        }
+        // If all members were null/undefined, use the right side
         const rv = evaluate(node.right, env);
         const rightTV = isReturn(rv) || isBranch(rv) || isThrow(rv) ? T.unknown : rv;
-        return simplifyUnion([leftVal, rightTV]);
+        return rightTV;
       }
 
       return T.unknown;
@@ -364,12 +1436,19 @@ function evaluateNode(node: Node, env: Environment): EvalResult {
           ? evaluate(node.consequent, trueEnv)
           : evaluate(node.alternate, falseEnv);
       }
+      // Object-ish / otherwise-decidable tests pick their branch statically
+      const decided = definiteBoolean(testVal);
+      if (decided !== null) {
+        return decided
+          ? evaluate(node.consequent, trueEnv)
+          : evaluate(node.alternate, falseEnv);
+      }
 
       const cResult = evaluate(node.consequent, trueEnv);
       const aResult = evaluate(node.alternate, falseEnv);
       const cVal = isReturn(cResult) ? cResult.value : isBranch(cResult) ? cResult.returnedValue : isThrow(cResult) ? T.never : cResult;
       const aVal = isReturn(aResult) ? aResult.value : isBranch(aResult) ? aResult.returnedValue : isThrow(aResult) ? T.never : aResult;
-      return simplifyUnion([cVal, aVal]);
+      return joinOrUnion(cVal, aVal);
     }
 
     case "IfStatement": {
@@ -378,6 +1457,9 @@ function evaluateNode(node: Node, env: Environment): EvalResult {
       const testVal = evaluate(test, env);
       if (isReturn(testVal) || isBranch(testVal) || isThrow(testVal)) return testVal;
 
+      // Kernel Φ：从测试表达式提取约束，真/假分支分别合取
+      const phis = phiFromTest(test);
+
       if (testVal.kind === "literal") {
         if (testVal.value) {
           if (node.alternate?.loc) {
@@ -386,7 +1468,12 @@ function evaluateNode(node: Node, env: Environment): EvalResult {
               end: { line: node.alternate.loc.end.line, column: node.alternate.loc.end.column },
             });
           }
-          return evaluate(node.consequent, trueEnv);
+          pushPhi(combinePhi(currentPhi(), phis.whenTrue));
+          try {
+            return evaluate(node.consequent, trueEnv);
+          } finally {
+            popPhi();
+          }
         }
         if (node.consequent.loc) {
           _unreachableRanges.push({
@@ -394,15 +1481,52 @@ function evaluateNode(node: Node, env: Environment): EvalResult {
             end: { line: node.consequent.loc.end.line, column: node.consequent.loc.end.column },
           });
         }
-        return node.alternate
-          ? evaluate(node.alternate, falseEnv)
-          : T.undefined;
+        if (!node.alternate) return T.undefined;
+        pushPhi(combinePhi(currentPhi(), phis.whenFalse));
+        try {
+          return evaluate(node.alternate, falseEnv);
+        } finally {
+          popPhi();
+        }
+      }
+      // Object-ish / otherwise-decidable tests pick their branch statically
+      // (e.g. `if (proto && proto.isImmutable)` once && resolves).
+      const decided = definiteBoolean(testVal);
+      if (decided !== null) {
+        if (decided) {
+          pushPhi(combinePhi(currentPhi(), phis.whenTrue));
+          try {
+            return evaluate(node.consequent, trueEnv);
+          } finally {
+            popPhi();
+          }
+        }
+        if (!node.alternate) return T.undefined;
+        pushPhi(combinePhi(currentPhi(), phis.whenFalse));
+        try {
+          return evaluate(node.alternate, falseEnv);
+        } finally {
+          popPhi();
+        }
       }
 
-      const consequentResult = evaluate(node.consequent, trueEnv);
-      const alternateResult = node.alternate
-        ? evaluate(node.alternate, falseEnv)
-        : null;
+      // 两边都探索：分别用各自 Φ
+      pushPhi(combinePhi(currentPhi(), phis.whenTrue));
+      let consequentResult: EvalResult;
+      try {
+        consequentResult = evaluate(node.consequent, trueEnv);
+      } finally {
+        popPhi();
+      }
+      pushPhi(combinePhi(currentPhi(), phis.whenFalse));
+      let alternateResult: EvalResult | null = null;
+      try {
+        alternateResult = node.alternate
+          ? evaluate(node.alternate, falseEnv)
+          : null;
+      } finally {
+        popPhi();
+      }
 
       const cReturns = isReturn(consequentResult);
       const cBranches = isBranch(consequentResult);
@@ -427,21 +1551,21 @@ function evaluateNode(node: Node, env: Environment): EvalResult {
       }
 
       if (aThrows) {
-        const cVal = cReturns ? consequentResult.value
-          : cBranches ? consequentResult.returnedValue
+        const cVal = cReturns ? (consequentResult as ReturnSignal).value
+          : cBranches ? (consequentResult as BranchSignal).returnedValue
           : consequentResult as TypeValue;
         return makeBranch(cVal, trueEnv);
       }
 
-      const cVal = cReturns ? consequentResult.value
-        : cBranches ? consequentResult.returnedValue
+      const cVal = cReturns ? (consequentResult as ReturnSignal).value
+        : cBranches ? (consequentResult as BranchSignal).returnedValue
         : consequentResult as TypeValue;
       const aVal = aReturns ? (alternateResult as ReturnSignal).value
         : aBranches ? (alternateResult as BranchSignal).returnedValue
         : alternateResult as TypeValue | null;
 
       if (cReturns && aReturns) {
-        return makeReturn(simplifyUnion([cVal, aVal!]));
+        return makeReturn(joinOrUnion(cVal, aVal!));
       }
 
       if (cReturns && !node.alternate) {
@@ -450,7 +1574,7 @@ function evaluateNode(node: Node, env: Environment): EvalResult {
 
       if (cReturns && node.alternate) {
         if (aReturns) {
-          return makeReturn(simplifyUnion([cVal, aVal!]));
+          return makeReturn(joinOrUnion(cVal, aVal!));
         }
         return makeBranch(cVal, falseEnv);
       }
@@ -466,12 +1590,13 @@ function evaluateNode(node: Node, env: Environment): EvalResult {
     }
 
     case "BlockStatement": {
-      const blockEnv = env.extend({});
+      const blockEnv = env.fork();
       const result = evaluateStatements(node.body, blockEnv);
       return result;
     }
 
     case "ReturnStatement": {
+      if (_activeAsOverride) return makeReturn(_activeAsOverride);
       const arg = node.argument;
       if (!arg) return makeReturn(T.undefined);
       const val = evaluate(arg, env);
@@ -481,8 +1606,13 @@ function evaluateNode(node: Node, env: Environment): EvalResult {
 
     case "VariableDeclaration": {
       for (const decl of node.declarations) {
-        const init = decl.init ? evaluate(decl.init, env) : T.undefined;
+        const init = _activeAsOverride ?? (decl.init ? evaluate(decl.init, env) : T.undefined);
         if (isReturn(init) || isBranch(init) || isThrow(init)) return init;
+        // Name anonymous function values after their binding so recursion
+        // truncation records can cite e.g. `recursion:fn`.
+        if (init.kind === "function" && decl.id.type === "Identifier" && !(init as any)._name) {
+          (init as any)._name = decl.id.name;
+        }
         bindPattern(decl.id, init, env);
         if (decl.id.type === "Identifier") {
           recordNodeType(decl.id, init);
@@ -493,16 +1623,40 @@ function evaluateNode(node: Node, env: Environment): EvalResult {
 
     case "AssignmentExpression": {
       if (node.left.type === "Identifier") {
-        const val = evaluate(node.right, env);
-        if (isReturn(val) || isBranch(val) || isThrow(val)) return val;
+        const rightVal = evaluate(node.right, env);
+        if (isReturn(rightVal) || isBranch(rightVal) || isThrow(rightVal)) return rightVal;
+
+        // Handle compound assignment operators
+        let val = rightVal;
+        if (node.operator !== "=") {
+          const leftVal = env.lookup(node.left.name);
+          if (leftVal && leftVal.kind !== "unknown") {
+            // Extract the binary operator (e.g., "+=" -> "+")
+            const binaryOp = node.operator.slice(0, -1);
+            val = evalBinaryValue(binaryOp, leftVal, rightVal) ?? T.unknown;
+          }
+        }
+
         if (!env.update(node.left.name, val)) {
           env.bind(node.left.name, val);
         }
+        if (val.kind === "function" && !(val as any)._name) {
+          (val as any)._name = node.left.name;
+        }
         return val;
       }
       if (node.left.type === "MemberExpression") {
         const val = evaluate(node.right, env);
         if (isReturn(val) || isBranch(val) || isThrow(val)) return val;
+        // `obj.method = function () {...}` — name the function after the
+        // assigned property (e.g. `recursion:internals.clone`).
+        if (val.kind === "function" && !(val as any)._name) {
+          const memberKey = getMemberKey(node.left, env);
+          if (memberKey !== null) {
+            const objKey = node.left.object.type === "Identifier" ? `${node.left.object.name}.` : "";
+            (val as any)._name = `${objKey}${memberKey}`;
+          }
+        }
         const objVal = evaluate(node.left.object, env);
         if (isReturn(objVal) || isBranch(objVal) || isThrow(objVal)) return val;
         if (objVal.kind === "object") {
@@ -570,7 +1724,10 @@ function evaluateNode(node: Node, env: Environment): EvalResult {
       const paramNames = node.params.map(describeParam);
       const fnType = T.fn(paramNames, node.body, env);
       (fnType as any)._paramPatterns = node.params;
+      if (node.id) (fnType as any)._name = node.id.name;
       if (node.async) (fnType as any)._async = true;
+      (fnType as any)._hasArguments = true;
+      tagFnModule(fnType);
       env.bind(node.id.name, fnType);
       return T.undefined;
     }
@@ -581,7 +1738,10 @@ function evaluateNode(node: Node, env: Environment): EvalResult {
       const body = node.body;
       const fnType = T.fn(paramNames, body, env);
       (fnType as any)._paramPatterns = node.params;
+      if ((node as any).id) (fnType as any)._name = (node as any).id.name;
       if (node.async) (fnType as any)._async = true;
+      (fnType as any)._hasArguments = true;
+      tagFnModule(fnType);
       return fnType;
     }
 
@@ -656,14 +1816,92 @@ function evaluateNode(node: Node, env: Environment): EvalResult {
         if (methodResult !== null) return methodResult;
       }
 
+      // CommonJS require(specifier) — resolved through the same module
+      // resolver/cache as ESM import. The identity check keeps user-defined
+      // `require` bindings on the normal call path.
+      if (
+        callee.type === "Identifier" &&
+        callee.name === "require" &&
+        env.lookup("require") === _cjsRequireValue
+      ) {
+        return evaluateRequireCall(node, env);
+      }
+
+      // Handle built-in global functions (only if not overridden in environment, e.g., by mocks)
+      if (callee.type === "Identifier" && !env.has(callee.name)) {
+        const builtinResult = evaluateBuiltinCall(callee.name, node.arguments as Node[], env);
+        if (builtinResult !== null) return builtinResult;
+      }
+
+      const calleeVal = evaluate(callee, env);
+      if (isReturn(calleeVal) || isBranch(calleeVal) || isThrow(calleeVal)) return calleeVal;
+
+      const argVals = evaluateArgs(node.arguments as Node[], env);
+      if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+
+      const thisVal = (callee.type === "MemberExpression" || callee.type === "OptionalMemberExpression")
+        ? ((callee as any)._receiverVal as TypeValue | undefined)
+        : undefined;
+      if (calleeVal.kind === "function") {
+        const full = callFunctionFull(calleeVal, argVals as TypeValue[], thisVal);
+        if (_callCollector && callee.type === "Identifier") {
+          recordCall(callee.name, argVals as TypeValue[], full, node.loc, calleeVal);
+        } else if (_callCollector && (callee.type === "MemberExpression" || callee.type === "OptionalMemberExpression") && callee.property.type === "Identifier") {
+          // 成员调用（ns.fn()/obj.fn()）：跨文件调用点发现的来源——
+          // 配合 _exportTags 还原 (module, export) 归属
+          recordCall(callee.property.name, argVals as TypeValue[], full, node.loc, calleeVal);
+        }
+        if (full.value.kind === "never" && full.throws.kind !== "never") {
+          const callLoc = node.loc ? {
+            start: { line: node.loc.start.line, column: node.loc.start.column },
+            end: { line: node.loc.end.line, column: node.loc.end.column },
+          } : full.throwLoc;
+          return makeThrow(full.throws, callLoc);
+        }
+        return full.value;
+      }
+
+      return distributeOverUnion(calleeVal, (fn) => {
+        if (fn.kind !== "function") return T.unknown;
+        return callFunction(fn, argVals as TypeValue[], thisVal);
+      });
+    }
+
+    case "OptionalCallExpression": {
+      const callee = node.callee as Node;
+
+      if (callee.type === "OptionalMemberExpression" || callee.type === "MemberExpression") {
+        const objVal = evaluate(callee.object, env);
+        if (isReturn(objVal) || isBranch(objVal) || isThrow(objVal)) return objVal;
+        if (objVal.kind === "literal" && (objVal.value === null || objVal.value === undefined)) {
+          return T.undefined;
+        }
+        const methodResult = evaluateMethodCall(callee as Node & { type: "MemberExpression" }, node.arguments as Node[], env);
+        if (methodResult !== null) return methodResult;
+      }
+
       const calleeVal = evaluate(callee, env);
       if (isReturn(calleeVal) || isBranch(calleeVal) || isThrow(calleeVal)) return calleeVal;
 
+      if (calleeVal.kind === "literal" && (calleeVal.value === null || calleeVal.value === undefined)) {
+        return T.undefined;
+      }
+
       const argVals = evaluateArgs(node.arguments as Node[], env);
       if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
 
+      const thisVal = (callee.type === "MemberExpression" || callee.type === "OptionalMemberExpression")
+        ? ((callee as any)._receiverVal as TypeValue | undefined)
+        : undefined;
       if (calleeVal.kind === "function") {
-        const full = callFunctionFull(calleeVal, argVals as TypeValue[]);
+        const full = callFunctionFull(calleeVal, argVals as TypeValue[], thisVal);
+        if (_callCollector && callee.type === "Identifier") {
+          recordCall(callee.name, argVals as TypeValue[], full, node.loc, calleeVal);
+        } else if (_callCollector && (callee.type === "MemberExpression" || callee.type === "OptionalMemberExpression") && callee.property.type === "Identifier") {
+          // 成员调用（ns.fn()/obj.fn()）：跨文件调用点发现的来源——
+          // 配合 _exportTags 还原 (module, export) 归属
+          recordCall(callee.property.name, argVals as TypeValue[], full, node.loc, calleeVal);
+        }
         if (full.value.kind === "never" && full.throws.kind !== "never") {
           const callLoc = node.loc ? {
             start: { line: node.loc.start.line, column: node.loc.start.column },
@@ -676,49 +1914,327 @@ function evaluateNode(node: Node, env: Environment): EvalResult {
 
       return distributeOverUnion(calleeVal, (fn) => {
         if (fn.kind !== "function") return T.unknown;
-        return callFunction(fn, argVals as TypeValue[]);
+        return callFunction(fn, argVals as TypeValue[], thisVal);
       });
     }
 
     case "MemberExpression": {
       const objVal = evaluate(node.object, env);
       if (isReturn(objVal) || isBranch(objVal) || isThrow(objVal)) return objVal;
+      // Stash the receiver so an enclosing CallExpression (`obj.f()`) can
+      // bind it as the callee's `this` without re-evaluating the object.
+      (node as any)._receiverVal = objVal;
 
       if (node.computed) {
         const propVal = evaluate(node.property, env);
         if (isReturn(propVal) || isBranch(propVal) || isThrow(propVal)) return propVal;
-        return distributeOverUnion(objVal, (obj) => {
-          if (obj.kind === "object" && propVal.kind === "literal" && typeof propVal.value === "string") {
-            return obj.properties[propVal.value] ?? T.undefined;
+        return evaluateComputedMemberAccess(objVal, propVal, node);
+      }
+
+      if (node.property.type === "Identifier") {
+        const propName = node.property.name;
+        let propMissed = false;
+        const result = distributeOverUnion(objVal, (obj) => {
+          // `x.valueOf` off non-object receivers (literals, primitives,
+          // arrays, functions) — see valueOfBinding.
+          if (propName === "valueOf") {
+            const bound = valueOfBinding(obj);
+            if (bound !== undefined) return bound;
+          }
+          // Check for built-in static methods (e.g., Date.now, Math.floor)
+          const builtinName = (obj as any)._builtinName as string | undefined;
+          if (builtinName && hasOwnProp(BUILTIN_STATIC_METHODS, builtinName)) {
+            const builtin = BUILTIN_STATIC_METHODS[builtinName];
+            // hasOwnProp guard: `in` would leak native Object.prototype
+            // members (e.g. `JSON.toString` → the real JS function).
+            if (typeof builtin === "object" && hasOwnProp(builtin, propName)) {
+              // Well-known symbols get named copies so `Symbol.iterator
+              // in x` can decide iterability.
+              if (builtinName === "Symbol" && hasOwnProp(SYMBOL_STATIC_PROPS, propName)) {
+                return wellKnownSymbol(propName);
+              }
+              return (builtin as Record<string, TypeValue>)[propName];
+            }
+          }
+          // `X.prototype` on a constructible built-in resolves to the cached
+          // singleton instance of X (stable identity across evaluations)
+          if (propName === "prototype" && builtinName && BUILTIN_PROTOTYPE_CLASSES.has(builtinName)) {
+            return builtinPrototype(builtinName);
           }
-          if ((obj.kind === "array" || obj.kind === "tuple") && propVal.kind === "literal" && typeof propVal.value === "number") {
-            if (obj.kind === "tuple") return obj.elements[propVal.value] ?? T.undefined;
-            return obj.element;
+          // Check for Map.size property
+          if (obj.kind === "instance" && obj.className === "Map" && propName === "size") {
+            return T.number;
+          }
+          // Check for Set.size property
+          if (obj.kind === "instance" && obj.className === "Set" && propName === "size") {
+            return T.number;
+          }
+          if (obj.kind === "object") {
+            const ownVal = hasOwnProp(obj.properties, propName) ? obj.properties[propName] : undefined;
+            if (ownVal) return ownVal;
+            // Every object inherits Object.prototype members (see table note).
+            const protoFn = hasOwnProp(OBJECT_PROTOTYPE_METHODS, propName)
+              ? OBJECT_PROTOTYPE_METHODS[propName]
+              : undefined;
+            if (protoFn) return bindObjectProtoMethod(protoFn, obj);
+            return T.undefined;
+          }
+          if (obj.kind === "instance") {
+            // Own-property lookup only: a plain `{}` properties record would
+            // otherwise leak native Object.prototype members (e.g. the real
+            // JS `toString` function) into the type system.
+            const own = hasOwnProp(obj.properties, propName) ? obj.properties[propName] : undefined;
+            if (own) return own;
+            // Instances inherit Object.prototype members too: keeps
+            // `Object.prototype.hasOwnProperty` (and the toString brand-check
+            // idiom) typeable instead of degrading to undefined.
+            const protoFn = hasOwnProp(OBJECT_PROTOTYPE_METHODS, propName)
+              ? OBJECT_PROTOTYPE_METHODS[propName]
+              : undefined;
+            if (protoFn) return bindObjectProtoMethod(protoFn, obj);
+            // `x.constructor` resolves to the class namespace: instances
+            // and prototype singletons share the memoized builtinClassValue
+            // (Array.prototype.constructor === Array), so reflection like
+            // `new (Object.getPrototypeOf(x).constructor)(n)` keeps going.
+            if (propName === "constructor") return builtinClassValue(obj.className);
+            // instance 的方法集是声明的近似：未列出的方法返回 unknown-result
+            // 函数值，让 `X.prototype.m.call(...)` 反射惯用法继续求值。
+            const knownInstanceMethods: Record<string, TypeValue> = {
+              values: T.fnSig([], T.array(T.unknown)),
+              keys: T.fnSig([], T.array(T.unknown)),
+              entries: T.fnSig([], T.array(T.tuple([T.unknown, T.unknown]))),
+              get: T.fnSig([T.unknown], T.unknown),
+              has: T.fnSig([T.unknown], T.boolean),
+              add: T.fnSig([T.unknown], T.unknown),
+              set: T.fnSig([T.unknown, T.unknown], T.unknown),
+              delete: T.fnSig([T.unknown], T.boolean),
+              forEach: T.fnSig([T.unknown], T.undefined),
+              call: T.fnSig([T.unknown], T.unknown),
+              apply: T.fnSig([T.unknown], T.unknown),
+              bind: T.fnSig([T.unknown], T.unknown),
+            };
+            // hasOwnProp：普通 [] 访问会命中 JS 原型链（valueOf/hasOwnProperty
+            // 等），把原生函数当 TypeValue 泄漏进类型系统
+            const knownFn = hasOwnProp(knownInstanceMethods, propName)
+              ? knownInstanceMethods[propName]
+              : undefined;
+            if (knownFn) return knownFn;
+            return T.fnSig([T.unknown], T.unknown);
+          }
+          if (propName === "length" && (obj.kind === "array" || obj.kind === "tuple")) {
+            return obj.kind === "tuple" ? T.literal(obj.elements.length) : T.number;
+          }
+          if (obj.kind === "array" || obj.kind === "tuple") {
+            // Feature-detection probes (`if (value.toJSON) …`) read arrays
+            // too: a missed named property is undefined (like objects),
+            // never unknown — unknown here poisons guarded unions.
+            return T.undefined;
           }
+          if (propName === "length" && obj.kind === "literal" && typeof obj.value === "string") {
+            return T.literal(obj.value.length);
+          }
+          if (propName === "length" && obj.kind === "primitive" && obj.type === "string") {
+            return T.number;
+          }
+          // Promise receivers carry Object.prototype members (valueOf
+          // returns the receiver itself) plus then/catch/finally — the
+          // same approximation the instance branch uses. Without this, a
+          // Promise-typed union member poisons `x.valueOf` to unknown.
+          if (obj.kind === "promise") {
+            const protoFn = hasOwnProp(OBJECT_PROTOTYPE_METHODS, propName)
+              ? OBJECT_PROTOTYPE_METHODS[propName]
+              : undefined;
+            if (protoFn) return bindObjectProtoMethod(protoFn, obj);
+            const promiseMethods = BUILTIN_PROTOTYPE_METHOD_APPROXIMATIONS.Promise;
+            if (promiseMethods && hasOwnProp(promiseMethods, propName)) {
+              return promiseMethods[propName];
+            }
+          }
+          // Primitive receivers auto-box through their wrapper prototype
+          // ('x'.constructor === String): consult it before reporting a miss.
+          // A wrapper miss on a wrapper-able primitive (string/number/
+          // boolean/symbol) is definite absence — undefined, not unknown —
+          // so `if (value.toJSON)` feature probes resolve their false
+          // branch (mirrors the array treatment above).
+          if (
+            obj.kind === "primitive" ||
+            (obj.kind === "literal" &&
+              (typeof obj.value === "string" || typeof obj.value === "number" || typeof obj.value === "boolean"))
+          ) {
+            const wrapper = wrapperPrototypeMember(obj, propName);
+            return wrapper !== undefined ? wrapper : T.undefined;
+          }
+          const wrapper = wrapperPrototypeMember(obj, propName);
+          if (wrapper !== undefined) return wrapper;
+          if (obj.kind === "refined") {
+            const result = dispatchProperty(obj, propName);
+            if (result !== undefined) return result;
+          }
+          propMissed = true;
           return T.unknown;
         });
+        if (propMissed) {
+          recordUnknown({
+            kind: "property",
+            name: propName,
+            receiverType: objVal,
+            loc: node.loc,
+            reason: `no property '${propName}' on ${objVal.kind}`,
+          });
+        }
+        return result;
+      }
+
+      return T.unknown;
+    }
+
+    case "OptionalMemberExpression": {
+      const objVal = evaluate(node.object, env);
+      if (isReturn(objVal) || isBranch(objVal) || isThrow(objVal)) return objVal;
+
+      // If object is null or undefined, short-circuit to undefined
+      if (objVal.kind === "literal" && (objVal.value === null || objVal.value === undefined)) {
+        return T.undefined;
+      }
+      (node as any)._receiverVal = objVal;
+
+      // Otherwise, evaluate like a normal member expression
+      if (node.computed) {
+        const propVal = evaluate(node.property, env);
+        if (isReturn(propVal) || isBranch(propVal) || isThrow(propVal)) return propVal;
+        return evaluateComputedMemberAccess(objVal, propVal, node);
       }
 
       if (node.property.type === "Identifier") {
         const propName = node.property.name;
-        return distributeOverUnion(objVal, (obj) => {
-          if (obj.kind === "object") return obj.properties[propName] ?? T.undefined;
-          if (obj.kind === "instance") return obj.properties[propName] ?? T.undefined;
+        let propMissed = false;
+        const result = distributeOverUnion(objVal, (obj) => {
+          // `x.valueOf` off non-object receivers (literals, primitives,
+          // arrays, functions) — see valueOfBinding.
+          if (propName === "valueOf") {
+            const bound = valueOfBinding(obj);
+            if (bound !== undefined) return bound;
+          }
+          // `X.prototype` on a constructible built-in resolves to the cached
+          // singleton instance of X (stable identity across evaluations)
+          const optBuiltinName = (obj as any)._builtinName as string | undefined;
+          if (propName === "prototype" && optBuiltinName && BUILTIN_PROTOTYPE_CLASSES.has(optBuiltinName)) {
+            return builtinPrototype(optBuiltinName);
+          }
+          if (obj.kind === "object") {
+            const ownVal = hasOwnProp(obj.properties, propName) ? obj.properties[propName] : undefined;
+            if (ownVal) return ownVal;
+            // Every object inherits Object.prototype members (see table note).
+            const protoFn = hasOwnProp(OBJECT_PROTOTYPE_METHODS, propName)
+              ? OBJECT_PROTOTYPE_METHODS[propName]
+              : undefined;
+            if (protoFn) return bindObjectProtoMethod(protoFn, obj);
+            return T.undefined;
+          }
+          if (obj.kind === "instance") {
+            // Own-property lookup only (see MemberExpression note): a plain
+            // `{}` properties record would otherwise leak native
+            // Object.prototype members into the type system.
+            const own = hasOwnProp(obj.properties, propName) ? obj.properties[propName] : undefined;
+            if (own) return own;
+            // Instances inherit Object.prototype members too: keeps
+            // `Object.prototype.hasOwnProperty` (and the toString brand-check
+            // idiom) typeable instead of degrading to undefined.
+            const protoFn = hasOwnProp(OBJECT_PROTOTYPE_METHODS, propName)
+              ? OBJECT_PROTOTYPE_METHODS[propName]
+              : undefined;
+            if (protoFn) return bindObjectProtoMethod(protoFn, obj);
+            // `x.constructor` resolves to the class namespace: instances
+            // and prototype singletons share the memoized builtinClassValue
+            // (Array.prototype.constructor === Array), so reflection like
+            // `new (Object.getPrototypeOf(x).constructor)(n)` keeps going.
+            if (propName === "constructor") return builtinClassValue(obj.className);
+            // instance 的方法集是声明的近似：未列出的方法返回 unknown-result
+            // 函数值，让 `X.prototype.m.call(...)` 反射惯用法继续求值。
+            const knownInstanceMethods: Record<string, TypeValue> = {
+              values: T.fnSig([], T.array(T.unknown)),
+              keys: T.fnSig([], T.array(T.unknown)),
+              entries: T.fnSig([], T.array(T.tuple([T.unknown, T.unknown]))),
+              get: T.fnSig([T.unknown], T.unknown),
+              has: T.fnSig([T.unknown], T.boolean),
+              add: T.fnSig([T.unknown], T.unknown),
+              set: T.fnSig([T.unknown, T.unknown], T.unknown),
+              delete: T.fnSig([T.unknown], T.boolean),
+              forEach: T.fnSig([T.unknown], T.undefined),
+              call: T.fnSig([T.unknown], T.unknown),
+              apply: T.fnSig([T.unknown], T.unknown),
+              bind: T.fnSig([T.unknown], T.unknown),
+            };
+            // hasOwnProp：普通 [] 访问会命中 JS 原型链（valueOf/hasOwnProperty
+            // 等），把原生函数当 TypeValue 泄漏进类型系统
+            const knownFn = hasOwnProp(knownInstanceMethods, propName)
+              ? knownInstanceMethods[propName]
+              : undefined;
+            if (knownFn) return knownFn;
+            return T.fnSig([T.unknown], T.unknown);
+          }
           if (propName === "length" && (obj.kind === "array" || obj.kind === "tuple")) {
             return obj.kind === "tuple" ? T.literal(obj.elements.length) : T.number;
           }
+          if (obj.kind === "array" || obj.kind === "tuple") {
+            // Feature-detection probes (`if (value.toJSON) …`) read arrays
+            // too: a missed named property is undefined (like objects),
+            // never unknown — unknown here poisons guarded unions.
+            return T.undefined;
+          }
           if (propName === "length" && obj.kind === "literal" && typeof obj.value === "string") {
             return T.literal(obj.value.length);
           }
           if (propName === "length" && obj.kind === "primitive" && obj.type === "string") {
             return T.number;
           }
+          // Promise receivers carry Object.prototype members (valueOf
+          // returns the receiver itself) plus then/catch/finally — the
+          // same approximation the instance branch uses. Without this, a
+          // Promise-typed union member poisons `x.valueOf` to unknown.
+          if (obj.kind === "promise") {
+            const protoFn = hasOwnProp(OBJECT_PROTOTYPE_METHODS, propName)
+              ? OBJECT_PROTOTYPE_METHODS[propName]
+              : undefined;
+            if (protoFn) return bindObjectProtoMethod(protoFn, obj);
+            const promiseMethods = BUILTIN_PROTOTYPE_METHOD_APPROXIMATIONS.Promise;
+            if (promiseMethods && hasOwnProp(promiseMethods, propName)) {
+              return promiseMethods[propName];
+            }
+          }
+          // Primitive receivers auto-box through their wrapper prototype
+          // ('x'.constructor === String): consult it before reporting a miss.
+          // A wrapper miss on a wrapper-able primitive (string/number/
+          // boolean/symbol) is definite absence — undefined, not unknown —
+          // so `if (value.toJSON)` feature probes resolve their false
+          // branch (mirrors the array treatment above).
+          if (
+            obj.kind === "primitive" ||
+            (obj.kind === "literal" &&
+              (typeof obj.value === "string" || typeof obj.value === "number" || typeof obj.value === "boolean"))
+          ) {
+            const wrapper = wrapperPrototypeMember(obj, propName);
+            return wrapper !== undefined ? wrapper : T.undefined;
+          }
+          const wrapper = wrapperPrototypeMember(obj, propName);
+          if (wrapper !== undefined) return wrapper;
           if (obj.kind === "refined") {
             const result = dispatchProperty(obj, propName);
             if (result !== undefined) return result;
           }
+          propMissed = true;
           return T.unknown;
         });
+        if (propMissed) {
+          recordUnknown({
+            kind: "property",
+            name: propName,
+            receiverType: objVal,
+            loc: node.loc,
+            reason: `no property '${propName}' on ${objVal.kind}`,
+          });
+        }
+        return result;
       }
 
       return T.unknown;
@@ -745,11 +2261,53 @@ function evaluateNode(node: Node, env: Environment): EvalResult {
             if (isReturn(val) || isBranch(val) || isThrow(val)) return val;
             props[key] = val;
           }
+        } else if (prop.type === "ObjectMethod") {
+          // Handle shorthand method syntax: { method() { ... } }
+          const key = prop.key.type === "Identifier"
+            ? prop.key.name
+            : prop.key.type === "StringLiteral"
+              ? prop.key.value
+              : null;
+          if (key) {
+            const params = prop.params.map((p: Node) => {
+              if (p.type === "Identifier") return p.name;
+              if (p.type === "RestElement" && p.argument.type === "Identifier") return `...${p.argument.name}`;
+              return `__param`;
+            });
+            props[key] = T.fn(params, prop.body, env);
+          }
         } else if (prop.type === "SpreadElement") {
           const spreadVal = evaluate(prop.argument, env);
           if (isReturn(spreadVal) || isBranch(spreadVal) || isThrow(spreadVal)) return spreadVal;
+          // M4：代数 spread（保留字面量/term）；失败回退 Object.assign
+          const absSpread = tryAbsObjectSpread(T.object(props), spreadVal);
+          if (absSpread !== undefined && absSpread.kind === "object") {
+            // 合并到 props 继续处理后续属性
+            for (const [k, v] of Object.entries(absSpread.properties)) {
+              props[k] = v;
+            }
+            continue;
+          }
           if (spreadVal.kind === "object") {
             Object.assign(props, spreadVal.properties);
+          } else if (spreadVal.kind === "union") {
+            const objectMembers = spreadVal.members.filter((m: TypeValue) => m.kind === "object");
+            if (objectMembers.length > 0) {
+              const allKeys = new Set<string>();
+              for (const m of objectMembers) {
+                if (m.kind === "object") {
+                  for (const k of Object.keys(m.properties)) allKeys.add(k);
+                }
+              }
+              for (const key of allKeys) {
+                const values = objectMembers
+                  .filter((m: TypeValue) => m.kind === "object" && key in (m as any).properties)
+                  .map((m: TypeValue) => (m as any).properties[key]);
+                if (values.length > 0) {
+                  props[key] = simplifyUnion(values);
+                }
+              }
+            }
           }
         }
       }
@@ -763,194 +2321,736 @@ function evaluateNode(node: Node, env: Environment): EvalResult {
           elements.push(T.undefined);
           continue;
         }
-        if (elem.type === "SpreadElement") {
-          const spreadVal = evaluate(elem.argument, env);
-          if (isReturn(spreadVal) || isBranch(spreadVal) || isThrow(spreadVal)) return spreadVal;
-          if (spreadVal.kind === "tuple") {
-            elements.push(...spreadVal.elements);
-          } else if (spreadVal.kind === "array") {
-            return T.array(simplifyUnion([...elements, spreadVal.element]));
-          } else {
-            elements.push(T.unknown);
-          }
-          continue;
+        if (elem.type === "SpreadElement") {
+          const spreadVal = evaluate(elem.argument, env);
+          if (isReturn(spreadVal) || isBranch(spreadVal) || isThrow(spreadVal)) return spreadVal;
+          if (spreadVal.kind === "tuple") {
+            elements.push(...spreadVal.elements);
+          } else if (spreadVal.kind === "array") {
+            return T.array(simplifyUnion([...elements, spreadVal.element]));
+          } else {
+            // Set/Map instances spread through their exact side tables
+            // (`[...new Set([1,2])]` → [1, 2]) or their element typeArgs.
+            const iterable = iterableSpreadValue(spreadVal);
+            if (iterable) {
+              if (iterable.kind === "tuple") {
+                elements.push(...iterable.elements);
+              } else if (iterable.kind === "array") {
+                return T.array(simplifyUnion([...elements, iterable.element]));
+              } else {
+                elements.push(T.unknown);
+              }
+            } else {
+              elements.push(T.unknown);
+            }
+          }
+          continue;
+        }
+        const val = evaluate(elem as Node, env);
+        if (isReturn(val) || isBranch(val) || isThrow(val)) return val;
+        elements.push(val);
+      }
+      return T.tuple(elements);
+    }
+
+    case "ThrowStatement": {
+      const argVal = node.argument ? evaluate(node.argument, env) : T.undefined;
+      if (isReturn(argVal) || isBranch(argVal) || isThrow(argVal)) return argVal;
+      const throwLoc = node.loc ? {
+        start: { line: node.loc.start.line, column: node.loc.start.column },
+        end: { line: node.loc.end.line, column: node.loc.end.column },
+      } : undefined;
+      return makeThrow(argVal, throwLoc);
+    }
+
+    case "BreakStatement":
+      return makeBreak();
+
+    case "ContinueStatement":
+      return makeContinue();
+
+    case "TryStatement": {
+      return evaluateTryStatement(node, env);
+    }
+
+    case "NewExpression": {
+      return evaluateNewExpression(node, env);
+    }
+
+    case "SwitchStatement": {
+      return evaluateSwitchStatement(node, env);
+    }
+
+    case "UpdateExpression": {
+      if (node.argument.type === "Identifier") {
+        const current = env.lookup(node.argument.name);
+        if (current.kind === "literal" && typeof current.value === "number") {
+          const newVal = node.operator === "++"
+            ? T.literal(current.value + 1)
+            : T.literal(current.value - 1);
+          if (!env.update(node.argument.name, newVal)) {
+            env.bind(node.argument.name, newVal);
+          }
+          return node.prefix ? newVal : current;
+        }
+        if (!env.update(node.argument.name, T.number)) {
+          env.bind(node.argument.name, T.number);
+        }
+        return T.number;
+      }
+      return T.number;
+    }
+
+    default:
+      return T.unknown;
+  }
+}
+
+function getMemberKey(node: Node & { type: "MemberExpression" }, env: Environment): string | null {
+  if (!node.computed && node.property.type === "Identifier") {
+    return node.property.name;
+  }
+  if (node.computed) {
+    const propVal = evaluate(node.property, env);
+    if (!isReturn(propVal) && !isBranch(propVal) && !isThrow(propVal) && propVal.kind === "literal") {
+      return String(propVal.value);
+    }
+  }
+  return null;
+}
+
+function bindPattern(pattern: Node, value: TypeValue, env: Environment): void {
+  if (pattern.type === "Identifier") {
+    env.bind(pattern.name, value);
+    return;
+  }
+
+  if (pattern.type === "RestElement") {
+    // Handle rest parameters: (...args) => ...
+    // The value should be a tuple of all remaining arguments
+    if (pattern.argument.type === "Identifier") {
+      env.bind(pattern.argument.name, value);
+    }
+    return;
+  }
+
+  if (pattern.type === "AssignmentPattern") {
+    const defaultVal = evaluate(pattern.right, env);
+    const resolved = (value.kind === "literal" && value.value === undefined)
+      ? (!isReturn(defaultVal) && !isBranch(defaultVal) && !isThrow(defaultVal) ? defaultVal : T.unknown)
+      : value;
+    bindPattern(pattern.left, resolved, env);
+    return;
+  }
+
+  if (pattern.type === "ObjectPattern") {
+    const restKeys: string[] = [];
+    for (const prop of pattern.properties) {
+      if (prop.type === "RestElement") {
+        if (value.kind === "object") {
+          const remaining: Record<string, TypeValue> = {};
+          for (const [k, v] of Object.entries(value.properties)) {
+            if (!restKeys.includes(k)) remaining[k] = v;
+          }
+          bindPattern(prop.argument, T.object(remaining), env);
+        } else {
+          bindPattern(prop.argument, T.object({}), env);
+        }
+        continue;
+      }
+      if (prop.type !== "ObjectProperty") continue;
+      const key = prop.key.type === "Identifier"
+        ? prop.key.name
+        : prop.key.type === "StringLiteral"
+          ? prop.key.value
+          : null;
+      if (!key) continue;
+      restKeys.push(key);
+      // Own-property guard first (a plain record would leak native JS
+      // functions for names like "hasOwnProperty"), then Object.prototype
+      // fallback — real destructuring reads through the prototype chain.
+      const propVal = value.kind === "object"
+        ? (hasOwnProp(value.properties, key)
+          ? value.properties[key]
+          : (hasOwnProp(OBJECT_PROTOTYPE_METHODS, key) ? bindObjectProtoMethod(OBJECT_PROTOTYPE_METHODS[key], value) : T.undefined))
+        : T.unknown;
+      bindPattern(prop.value as Node, propVal, env);
+    }
+    return;
+  }
+
+  if (pattern.type === "ArrayPattern") {
+    for (let i = 0; i < pattern.elements.length; i++) {
+      const elem = pattern.elements[i];
+      if (!elem) continue;
+      if (elem.type === "RestElement") {
+        if (value.kind === "tuple") {
+          bindPattern(elem.argument, T.tuple(value.elements.slice(i)), env);
+        } else if (value.kind === "array") {
+          bindPattern(elem.argument, value, env);
+        } else {
+          bindPattern(elem.argument, T.tuple([]), env);
+        }
+        continue;
+      }
+      const elemVal = value.kind === "tuple"
+        ? (value.elements[i] ?? T.undefined)
+        : value.kind === "array"
+          ? value.element
+          : T.unknown;
+      bindPattern(elem, elemVal, env);
+    }
+    return;
+  }
+}
+
+function evaluateArgs(args: Node[], env: Environment): TypeValue[] | ReturnSignal | BranchSignal | ThrowSignal {
+  const result: TypeValue[] = [];
+  for (const arg of args) {
+    if (arg.type === "SpreadElement") {
+      const spreadVal = evaluate(arg.argument, env);
+      if (isReturn(spreadVal) || isBranch(spreadVal) || isThrow(spreadVal)) return spreadVal;
+      if (spreadVal.kind === "tuple") {
+        result.push(...spreadVal.elements);
+      } else if (spreadVal.kind === "array") {
+        result.push(spreadVal.element);
+      } else {
+        // Set/Map instances spread through their exact side tables or
+        // their element typeArgs (one element, like the array case).
+        const iterable = iterableSpreadValue(spreadVal);
+        if (iterable) {
+          if (iterable.kind === "tuple") {
+            result.push(...iterable.elements);
+          } else if (iterable.kind === "array") {
+            result.push(iterable.element);
+          } else {
+            result.push(T.unknown);
+          }
+        } else {
+          result.push(T.unknown);
+        }
+      }
+      continue;
+    }
+    const v = evaluate(arg, env);
+    if (isReturn(v) || isBranch(v) || isThrow(v)) return v;
+    if (_provenanceEnabled && arg.loc) {
+      _originMap.set(v, { line: arg.loc.start.line, column: arg.loc.start.column });
+    }
+    result.push(v);
+  }
+  return result;
+}
+
+function evaluateBuiltinCall(
+  name: string,
+  args: Node[],
+  env: Environment,
+): EvalResult | null {
+  // Type conversion functions
+  if (name === "String" || name === "Number" || name === "Boolean") {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    if (argVals.length === 0) {
+      if (name === "String") return T.literal("");
+      if (name === "Number") return T.literal(0);
+      if (name === "Boolean") return T.literal(false);
+    }
+    // For literals, try to convert
+    if (argVals.length === 1) {
+      const arg = argVals[0];
+      if (name === "String") {
+        if (arg.kind === "literal") return T.literal(String(arg.value));
+        return T.string;
+      }
+      if (name === "Number") {
+        if (arg.kind === "literal") {
+          // Number() converts literals to their numeric value
+          if (arg.value === null) return T.literal(0);
+          if (arg.value === undefined) return T.literal(NaN);
+          if (typeof arg.value === "boolean") return T.literal(arg.value ? 1 : 0);
+          if (typeof arg.value === "number") return arg;
+          if (typeof arg.value === "string") {
+            const num = Number(arg.value);
+            if (!isNaN(num)) return T.literal(num);
+            return T.literal(NaN);
+          }
+        }
+        return T.number;
+      }
+      if (name === "Boolean") {
+        if (arg.kind === "literal") return T.literal(Boolean(arg.value));
+        return T.boolean;
+      }
+    }
+    if (name === "String") return T.string;
+    if (name === "Number") return T.number;
+    if (name === "Boolean") return T.boolean;
+  }
+
+  // parseInt and parseFloat
+  if (name === "parseInt" || name === "parseFloat") {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    return T.number;
+  }
+
+  // isNaN and isFinite
+  if (name === "isNaN" || name === "isFinite") {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    return T.boolean;
+  }
+
+  // encodeURIComponent, decodeURIComponent, encodeURI, decodeURI
+  if (name === "encodeURIComponent" || name === "decodeURIComponent" ||
+      name === "encodeURI" || name === "decodeURI") {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    return T.string;
+  }
+
+  // Math functions (accessed via member expression, not here)
+  if (name === "Math") {
+    return null;
+  }
+
+  // console functions (accessed via member expression, not here)
+  if (name === "console") {
+    return null;
+  }
+
+  // fetch global function
+  if (name === "fetch") {
+    return T.promise(createResponseType());
+  }
+
+  return null;
+}
+
+// --- Function.prototype.call / apply / bind ---
+// When the receiver of a method call is itself a function value,
+// `f.call(thisArg, ...args)` / `f.apply(thisArg, argsArray)` re-invoke that
+// function with the args following the leading thisArg; `f.bind(...)`
+// approximates to the original function value. Non-function receivers keep
+// the existing fallback.
+function evaluateFunctionPrototypeMethod(
+  fnVal: TypeValue & { kind: "function" },
+  methodName: string,
+  argVals: TypeValue[],
+): EvalResult | null {
+  if (methodName === "bind") return fnVal;
+  if (methodName === "call") {
+    const full = callFunctionFull(fnVal, argVals.slice(1), argVals[0]);
+    // A definitely-throwing callee (e.g. `null.valueOf` binding) must raise
+    // a ThrowSignal, not degrade to never — enclosing try/catch depends on it.
+    if (full.value.kind === "never" && full.throws.kind !== "never") {
+      return makeThrow(full.throws, full.throwLoc);
+    }
+    return full.value;
+  }
+  if (methodName === "apply") {
+    const listArg = argVals[1];
+    let spreadArgs: TypeValue[];
+    if (listArg?.kind === "tuple") {
+      spreadArgs = listArg.elements;
+    } else {
+      // Unknown-length array (or non-array): approximate with the element
+      // type (or unknown) repeated to the callee's arity.
+      const el = listArg?.kind === "array" ? listArg.element : T.unknown;
+      spreadArgs = fnVal.params.map(() => el);
+    }
+    const full = callFunctionFull(fnVal, spreadArgs, argVals[0]);
+    if (full.value.kind === "never" && full.throws.kind !== "never") {
+      return makeThrow(full.throws, full.throwLoc);
+    }
+    return full.value;
+  }
+  return null;
+}
+
+function evaluateMethodForMember(
+  objVal: TypeValue,
+  methodName: string,
+  argVals: TypeValue[],
+  callee: Node & { type: "MemberExpression" },
+  env: Environment,
+): EvalResult | null {
+  // Function.prototype.call/apply/bind on function-valued union members
+  if (objVal.kind === "function") {
+    const fnProto = evaluateFunctionPrototypeMethod(objVal, methodName, argVals);
+    if (fnProto !== null) return fnProto;
+  }
+
+  // Promise instance methods
+  if (objVal.kind === "promise") {
+    if (methodName === "then") {
+      const chained = applyPromiseThenCallback(objVal, argVals);
+      if (chained !== null) return chained;
+    }
+    const result = evaluatePromiseInstanceMethod(objVal, methodName, argVals);
+    if (result !== null) return result;
+  }
+
+  // Instance methods (Map, Set, RegExp, etc.)
+  if (objVal.kind === "instance") {
+    const classMethods: Record<string, Record<string, (...args: TypeValue[]) => TypeValue>> = {
+      Map: MAP_INSTANCE_METHODS,
+      Set: SET_INSTANCE_METHODS,
+      RegExp: REGEXP_INSTANCE_METHODS,
+    };
+    const methods = classMethods[objVal.className];
+    if (methods) {
+      const method = methods[methodName];
+      if (method) return method(...argVals, objVal);
+    }
+  }
+
+  // Array/tuple methods（union 分布路径）：与主路径共用 evaluateArrayMethodValues
+  // ——实参在此已是 TypeValue，回调类 map/filter/reduce 等同样从函数值签名
+  // 求值（mock 箭头 / 具名函数 / 内联箭头一致），不再保守降级 unknown。
+  if (objVal.kind === "array" || objVal.kind === "tuple") {
+    return evaluateArrayMethodValues(objVal, methodName, argVals);
+  }
+
+  // String methods
+  if (isStringLike(objVal)) {
+    return evaluateStringMethod(objVal, methodName, argVals);
+  }
+
+  return null;
+}
+
+function evaluateMethodCall(
+  callee: Node & { type: "MemberExpression" },
+  args: Node[],
+  env: Environment,
+): EvalResult | null {
+  const objVal = evaluate(callee.object, env);
+  if (isReturn(objVal) || isBranch(objVal) || isThrow(objVal)) return objVal;
+  const methodName = !callee.computed && callee.property.type === "Identifier"
+    ? callee.property.name
+    : null;
+  if (!methodName) return null;
+
+  // Distribute method calls over union types
+  if (objVal.kind === "union") {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    let methodMissed = false;
+    const result = distributeOverUnion(objVal, (member) => {
+      // Create a temporary env with the member bound, then re-evaluate the method call
+      const memberResult = evaluateMethodForMember(member, methodName, argVals as TypeValue[], callee, env);
+      if (
+        memberResult === null &&
+        member.kind !== "object" && member.kind !== "instance" &&
+        member.kind !== "refined" && member.kind !== "promise"
+      ) {
+        methodMissed = true;
+      }
+      // A throwing member contributes no value; return/branch signals
+      // contribute their carried value (the potential throw is dropped
+      // here; the single-callee path raises it properly).
+      if (memberResult !== null && typeof memberResult === "object") {
+        if (THROW_SIGNAL in memberResult) return T.never;
+        if (RETURN_SIGNAL in memberResult) return memberResult.value;
+        if (BRANCH_SIGNAL in memberResult) return memberResult.returnedValue;
+      }
+      return memberResult ?? T.unknown;
+    });
+    if (methodMissed) {
+      recordUnknown({
+        kind: "method",
+        name: methodName,
+        receiverType: objVal,
+        loc: callee.loc,
+        reason: `no method '${methodName}' on ${objVal.kind}`,
+      });
+    }
+    return result;
+  }
+
+  // Function.prototype.call/apply/bind re-invoking a function value
+  if (objVal.kind === "function") {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    const fnProto = evaluateFunctionPrototypeMethod(objVal, methodName, argVals as TypeValue[]);
+    if (fnProto !== null) return fnProto;
+  }
+
+  // Handle console methods (no return value)
+  if (callee.object.type === "Identifier" && callee.object.name === "console" && !env.has("console")) {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    return T.undefined;
+  }
+
+  // Handle Math methods
+  if (callee.object.type === "Identifier" && callee.object.name === "Math" && !env.has("Math")) {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    // Math methods return numbers
+    if (["abs", "ceil", "floor", "round", "sqrt", "pow", "min", "max",
+         "random", "log", "log2", "log10", "exp", "sin", "cos", "tan",
+         "asin", "acos", "atan", "atan2"].includes(methodName)) {
+      return T.number;
+    }
+    // Math constants
+    if (["PI", "E", "LN2", "LN10", "LOG2E", "LOG10E", "SQRT1_2", "SQRT2"].includes(methodName)) {
+      return T.number;
+    }
+    return T.number;
+  }
+
+  // Handle Date methods
+  if (callee.object.type === "Identifier" && callee.object.name === "Date" && !env.has("Date")) {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    // Date static methods
+    if (["now", "parse", "UTC"].includes(methodName)) {
+      return T.number;
+    }
+    // Date constructor
+    if (methodName === "constructor") {
+      return T.instanceOf("Date", {
+        getTime: T.fn(["...args"], { type: "BlockStatement", body: [] } as any, undefined as any),
+        getFullYear: T.fn(["...args"], { type: "BlockStatement", body: [] } as any, undefined as any),
+        toISOString: T.fn(["...args"], { type: "BlockStatement", body: [] } as any, undefined as any),
+      });
+    }
+    return T.unknown;
+  }
+
+  // Handle JSON methods
+  if (callee.object.type === "Identifier" && callee.object.name === "JSON" && !env.has("JSON")) {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    // JSON.parse: the table entry is a fnSig whose impl decodes literal
+    // string arguments precisely (jsonToTypeValue); non-literal / invalid /
+    // reviver-bearing calls fall back to its unknown return type.
+    if (methodName === "parse") {
+      return callFunction(
+        (BUILTIN_STATIC_METHODS.JSON as Record<string, TypeValue>).parse as TypeValue & {
+          kind: "function";
+        },
+        argVals as TypeValue[],
+      );
+    }
+    // JSON.stringify returns string
+    if (methodName === "stringify") {
+      return T.string;
+    }
+    return T.unknown;
+  }
+
+  // Handle Array methods (Array.from, Array.isArray, etc.)
+  if (callee.object.type === "Identifier" && callee.object.name === "Array" && !env.has("Array")) {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    if (methodName === "from") {
+      if (argVals.length > 0) {
+        const iterable = argVals[0];
+        // Array.from(Set) -> array of Set's element type
+        if (iterable.kind === "instance" && iterable.className === "Set") {
+          const typeArgs = (iterable as any)._typeArgs;
+          if (typeArgs?.T) return T.array(typeArgs.T);
+        }
+        // Array.from(tuple) -> tuple (preserve types)
+        if (iterable.kind === "tuple") {
+          return iterable;
+        }
+        // Array.from(array) -> array
+        if (iterable.kind === "array") {
+          return iterable;
         }
-        const val = evaluate(elem as Node, env);
-        if (isReturn(val) || isBranch(val) || isThrow(val)) return val;
-        elements.push(val);
       }
-      return T.tuple(elements);
+      return T.array(T.unknown);
     }
-
-    case "ThrowStatement": {
-      const argVal = node.argument ? evaluate(node.argument, env) : T.undefined;
-      if (isReturn(argVal) || isBranch(argVal) || isThrow(argVal)) return argVal;
-      const throwLoc = node.loc ? {
-        start: { line: node.loc.start.line, column: node.loc.start.column },
-        end: { line: node.loc.end.line, column: node.loc.end.column },
-      } : undefined;
-      return makeThrow(argVal, throwLoc);
+    if (methodName === "isArray") {
+      // Structurally-known receivers decide literally (arrays/tuples →
+      // true, plain objects/instances-of-other-classes → false); unknown
+      // receivers keep the symbolic boolean.
+      return distributeOverUnion((argVals as TypeValue[])[0] ?? T.undefined, (v) => {
+        const lit = arrayIsArrayLiteral(v);
+        return lit === undefined ? T.boolean : T.literal(lit);
+      });
     }
+    return T.unknown;
+  }
 
-    case "TryStatement": {
-      return evaluateTryStatement(node, env);
+  // Handle Promise methods
+  if (callee.object.type === "Identifier" && callee.object.name === "Promise" && !env.has("Promise")) {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    const result = evaluatePromiseStaticMethod(methodName, argVals as TypeValue[]);
+    if (result !== null) return result;
+    return T.unknown;
+  }
+
+  // Handle Symbol methods
+  if (callee.object.type === "Identifier" && callee.object.name === "Symbol" && !env.has("Symbol")) {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    if (methodName === "for") return T.symbol;
+    if (methodName === "keyFor") return T.union(T.string, T.undefined);
+    return T.unknown;
+  }
+
+  // Handle Reflect methods
+  if (callee.object.type === "Identifier" && callee.object.name === "Reflect" && !env.has("Reflect")) {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    const method = (REFLECT_METHODS as Record<string, (...args: TypeValue[]) => TypeValue>)[methodName];
+    if (method) return method(...(argVals as TypeValue[]));
+    return T.unknown;
+  }
+
+  // Handle Promise instance methods (.then, .catch, .finally)
+  if (objVal.kind === "promise") {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    if (methodName === "then") {
+      const chained = applyPromiseThenCallback(objVal, argVals as TypeValue[]);
+      if (chained !== null) return chained;
     }
+    const result = evaluatePromiseInstanceMethod(objVal, methodName, argVals as TypeValue[]);
+    if (result !== null) return result;
+  }
 
-    case "NewExpression": {
-      return evaluateNewExpression(node, env);
+  // Handle Map instance methods
+  if (objVal.kind === "instance" && objVal.className === "Map") {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    const method = MAP_INSTANCE_METHODS[methodName];
+    if (method) {
+      return method(...(argVals as TypeValue[]), objVal);
     }
+  }
 
-    case "SwitchStatement": {
-      return evaluateSwitchStatement(node, env);
+  // Handle Set instance methods
+  if (objVal.kind === "instance" && objVal.className === "Set") {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    const method = SET_INSTANCE_METHODS[methodName];
+    if (method) {
+      return method(...(argVals as TypeValue[]), objVal);
     }
+  }
 
-    case "UpdateExpression": {
-      if (node.argument.type === "Identifier") {
-        const current = env.lookup(node.argument.name);
-        if (current.kind === "literal" && typeof current.value === "number") {
-          const newVal = node.operator === "++"
-            ? T.literal(current.value + 1)
-            : T.literal(current.value - 1);
-          if (!env.update(node.argument.name, newVal)) {
-            env.bind(node.argument.name, newVal);
-          }
-          return node.prefix ? newVal : current;
-        }
-        if (!env.update(node.argument.name, T.number)) {
-          env.bind(node.argument.name, T.number);
-        }
-        return T.number;
-      }
-      return T.number;
+  // Handle RegExp instance methods
+  if (objVal.kind === "instance" && objVal.className === "RegExp") {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    const method = REGEXP_INSTANCE_METHODS[methodName];
+    if (method) {
+      return method(...(argVals as TypeValue[]), objVal);
     }
+  }
 
-    default:
-      return T.unknown;
+  // Handle URL instance methods
+  if (objVal.kind === "instance" && objVal.className === "URL") {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    const method = URL_INSTANCE_METHODS[methodName];
+    if (method) {
+      return method(...(argVals as TypeValue[]), objVal);
+    }
   }
-}
 
-function getMemberKey(node: Node & { type: "MemberExpression" }, env: Environment): string | null {
-  if (!node.computed && node.property.type === "Identifier") {
-    return node.property.name;
+  // Handle URLSearchParams instance methods
+  if (objVal.kind === "instance" && objVal.className === "URLSearchParams") {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    const method = URLSearchParams_INSTANCE_METHODS[methodName];
+    if (method) {
+      return method(...(argVals as TypeValue[]), objVal);
+    }
   }
-  if (node.computed) {
-    const propVal = evaluate(node.property, env);
-    if (!isReturn(propVal) && !isBranch(propVal) && !isThrow(propVal) && propVal.kind === "literal") {
-      return String(propVal.value);
+
+  // Handle Response instance methods
+  if (objVal.kind === "instance" && objVal.className === "Response") {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    const method = RESPONSE_INSTANCE_METHODS[methodName];
+    if (method) {
+      return method(...(argVals as TypeValue[]), objVal);
     }
   }
-  return null;
-}
 
-function bindPattern(pattern: Node, value: TypeValue, env: Environment): void {
-  if (pattern.type === "Identifier") {
-    env.bind(pattern.name, value);
-    return;
+  // Handle Headers instance methods
+  if (objVal.kind === "instance" && objVal.className === "Headers") {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    const method = HEADERS_INSTANCE_METHODS[methodName];
+    if (method) {
+      return method(...(argVals as TypeValue[]), objVal);
+    }
   }
 
-  if (pattern.type === "AssignmentPattern") {
-    const defaultVal = evaluate(pattern.right, env);
-    const resolved = (value.kind === "literal" && value.value === undefined)
-      ? (!isReturn(defaultVal) && !isBranch(defaultVal) && !isThrow(defaultVal) ? defaultVal : T.unknown)
-      : value;
-    bindPattern(pattern.left, resolved, env);
-    return;
+  // Handle FormData instance methods
+  if (objVal.kind === "instance" && objVal.className === "FormData") {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    const method = FORMDATA_INSTANCE_METHODS[methodName];
+    if (method) {
+      return method(...(argVals as TypeValue[]), objVal);
+    }
   }
 
-  if (pattern.type === "ObjectPattern") {
-    const restKeys: string[] = [];
-    for (const prop of pattern.properties) {
-      if (prop.type === "RestElement") {
-        if (value.kind === "object") {
-          const remaining: Record<string, TypeValue> = {};
-          for (const [k, v] of Object.entries(value.properties)) {
-            if (!restKeys.includes(k)) remaining[k] = v;
-          }
-          bindPattern(prop.argument, T.object(remaining), env);
-        } else {
-          bindPattern(prop.argument, T.object({}), env);
-        }
-        continue;
-      }
-      if (prop.type !== "ObjectProperty") continue;
-      const key = prop.key.type === "Identifier"
-        ? prop.key.name
-        : prop.key.type === "StringLiteral"
-          ? prop.key.value
-          : null;
-      if (!key) continue;
-      restKeys.push(key);
-      const propVal = value.kind === "object"
-        ? (value.properties[key] ?? T.undefined)
-        : T.unknown;
-      bindPattern(prop.value as Node, propVal, env);
+  // Handle AbortController instance methods
+  if (objVal.kind === "instance" && objVal.className === "AbortController") {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    const method = ABORTCONTROLLER_INSTANCE_METHODS[methodName];
+    if (method) {
+      return method(...(argVals as TypeValue[]), objVal);
     }
-    return;
   }
 
-  if (pattern.type === "ArrayPattern") {
-    for (let i = 0; i < pattern.elements.length; i++) {
-      const elem = pattern.elements[i];
-      if (!elem) continue;
-      if (elem.type === "RestElement") {
-        if (value.kind === "tuple") {
-          bindPattern(elem.argument, T.tuple(value.elements.slice(i)), env);
-        } else if (value.kind === "array") {
-          bindPattern(elem.argument, value, env);
-        } else {
-          bindPattern(elem.argument, T.tuple([]), env);
-        }
-        continue;
-      }
-      const elemVal = value.kind === "tuple"
-        ? (value.elements[i] ?? T.undefined)
-        : value.kind === "array"
-          ? value.element
-          : T.unknown;
-      bindPattern(elem, elemVal, env);
+  // Handle WeakMap instance methods
+  if (objVal.kind === "instance" && objVal.className === "WeakMap") {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    const method = WEAKMAP_INSTANCE_METHODS[methodName];
+    if (method) {
+      return method(...(argVals as TypeValue[]), objVal);
     }
-    return;
   }
-}
 
-function evaluateArgs(args: Node[], env: Environment): TypeValue[] | ReturnSignal | BranchSignal | ThrowSignal {
-  const result: TypeValue[] = [];
-  for (const arg of args) {
-    if (arg.type === "SpreadElement") {
-      const spreadVal = evaluate(arg.argument, env);
-      if (isReturn(spreadVal) || isBranch(spreadVal) || isThrow(spreadVal)) return spreadVal;
-      if (spreadVal.kind === "tuple") {
-        result.push(...spreadVal.elements);
-      } else if (spreadVal.kind === "array") {
-        result.push(spreadVal.element);
-      } else {
-        result.push(T.unknown);
-      }
-      continue;
+  // Handle WeakSet instance methods
+  if (objVal.kind === "instance" && objVal.className === "WeakSet") {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    const method = WEAKSET_INSTANCE_METHODS[methodName];
+    if (method) {
+      return method(...(argVals as TypeValue[]), objVal);
     }
-    const v = evaluate(arg, env);
-    if (isReturn(v) || isBranch(v) || isThrow(v)) return v;
-    result.push(v);
   }
-  return result;
-}
 
-function evaluateMethodCall(
-  callee: Node & { type: "MemberExpression" },
-  args: Node[],
-  env: Environment,
-): EvalResult | null {
-  const objVal = evaluate(callee.object, env);
-  if (isReturn(objVal) || isBranch(objVal) || isThrow(objVal)) return objVal;
+  // Handle DateTimeFormat instance methods
+  if (objVal.kind === "instance" && objVal.className === "DateTimeFormat") {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    const method = INTL_DATETIMEFORMAT_METHODS[methodName];
+    if (method) {
+      return method(...(argVals as TypeValue[]), objVal);
+    }
+  }
 
-  const methodName = !callee.computed && callee.property.type === "Identifier"
-    ? callee.property.name
-    : null;
-  if (!methodName) return null;
+  // Handle NumberFormat instance methods
+  if (objVal.kind === "instance" && objVal.className === "NumberFormat") {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    const method = INTL_NUMBERFORMAT_METHODS[methodName];
+    if (method) {
+      return method(...(argVals as TypeValue[]), objVal);
+    }
+  }
 
   if (
     callee.object.type === "Identifier" &&
     callee.object.name === "Object" &&
+    !env.has("Object") &&
     args.length >= 1
   ) {
     const argVal = evaluate(args[0], env);
@@ -959,7 +3059,17 @@ function evaluateMethodCall(
   }
 
   if (objVal.kind === "array" || objVal.kind === "tuple") {
-    return evaluateArrayMethod(objVal, methodName, args, env);
+    const arrResult = evaluateArrayMethod(objVal, methodName, args, env);
+    if (arrResult === null) {
+      recordUnknown({
+        kind: "method",
+        name: methodName,
+        receiverType: objVal,
+        loc: callee.loc,
+        reason: `no method '${methodName}' on ${objVal.kind}`,
+      });
+    }
+    return arrResult;
   }
 
   if (isStringLike(objVal)) {
@@ -971,7 +3081,36 @@ function evaluateMethodCall(
       if (refined !== undefined) return refined;
     }
 
-    return evaluateStringMethod(objVal, methodName, argVals as TypeValue[]);
+    const strResult = evaluateStringMethod(objVal, methodName, argVals as TypeValue[]);
+    if (strResult === null) {
+      recordUnknown({
+        kind: "method",
+        name: methodName,
+        receiverType: objVal,
+        loc: callee.loc,
+        reason: `no method '${methodName}' on ${objVal.kind}`,
+      });
+    }
+    return strResult;
+  }
+
+  // Number receivers: toString/valueOf exist on every JS number. Without
+  // this, deepEqual-style `obj.toString()` comparators reaching a numeric
+  // union member record a false no-method error.
+  if (isNumberLike(objVal)) {
+    const argVals = evaluateArgs(args, env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    if (methodName === "toString") {
+      return objVal.kind === "literal" && typeof objVal.value === "number"
+        ? T.literal(String(objVal.value))
+        : T.string;
+    }
+    if (methodName === "valueOf") {
+      return objVal.kind === "literal" && typeof objVal.value === "number"
+        ? objVal
+        : T.number;
+    }
+    if (methodName === "toFixed" || methodName === "toPrecision") return T.string;
   }
 
   if (objVal.kind === "refined") {
@@ -981,6 +3120,23 @@ function evaluateMethodCall(
     if (result !== undefined) return result;
   }
 
+  // Method dispatch fallback: no handler matched. For receivers whose property
+  // lookup may still succeed (object/instance/refined/promise — resolved by the
+  // MemberExpression evaluation downstream), stay silent; for everything else
+  // this call will degrade to T.unknown, so record it.
+  if (
+    objVal.kind !== "object" && objVal.kind !== "instance" &&
+    objVal.kind !== "refined" && objVal.kind !== "promise"
+  ) {
+    recordUnknown({
+      kind: "method",
+      name: methodName,
+      receiverType: objVal,
+      loc: callee.loc,
+      reason: `no method '${methodName}' on ${objVal.kind}`,
+    });
+  }
+
   return null;
 }
 
@@ -991,6 +3147,13 @@ function isStringLike(tv: TypeValue): boolean {
   return false;
 }
 
+function isNumberLike(tv: TypeValue): boolean {
+  if (tv.kind === "literal" && typeof tv.value === "number") return true;
+  if (tv.kind === "primitive" && tv.type === "number") return true;
+  if (tv.kind === "refined") return isNumberLike(tv.base);
+  return false;
+}
+
 function evaluateStringMethod(
   receiver: TypeValue,
   method: string,
@@ -1014,6 +3177,9 @@ function evaluateStringMethodLiteral(
   };
 
   switch (method) {
+    // String.prototype.toString/valueOf return the receiver string itself
+    case "toString":
+    case "valueOf": return T.literal(str);
     case "toUpperCase": return T.literal(str.toUpperCase());
     case "toLowerCase": return T.literal(str.toLowerCase());
     case "trim": return T.literal(str.trim());
@@ -1125,6 +3291,9 @@ function evaluateStringMethodAbstract(
   _args: TypeValue[],
 ): TypeValue | null {
   switch (method) {
+    case "toString":
+    case "valueOf":
+      return T.string;
     case "toUpperCase":
     case "toLowerCase":
     case "trim":
@@ -1160,6 +3329,58 @@ function evaluateObjectStaticMethod(
   method: string,
   obj: TypeValue,
 ): TypeValue | null {
+  // Shape-aware receivers list their declared own-property names:
+  // instances carry their properties record (usually empty for fresh
+  // collections), tuples their indices. Key loops (`for (const key of
+  // Object.keys(x))`) then iterate concrete keys instead of symbolic
+  // strings.
+  if (obj.kind === "instance") {
+    if (method === "keys" || method === "getOwnPropertyNames") {
+      return T.tuple(Object.keys(obj.properties).map((k) => T.literal(k)));
+    }
+    if (method === "values") return T.tuple(Object.values(obj.properties));
+    if (method === "entries") {
+      return T.tuple(
+        Object.keys(obj.properties).map((k) => T.tuple([T.literal(k), obj.properties[k]])),
+      );
+    }
+    return null;
+  }
+  if (obj.kind === "union") {
+    // union 分发：逐成员 keys/values/entries。成员多时逐成员 tuple 的
+    // union 会超预算——keys 恒为 string[]（sound 下界），values/entries
+    // 同理回退宽类型而非 unknown（hoek utils.keys 的 30+ 成员 union 曾
+    // 在无分支路径上退化）。
+    const per = obj.members.map((m) => evaluateObjectStaticMethod(method, m));
+    if (method === "keys" || method === "getOwnPropertyNames") {
+      const literals: TypeValue[] = [];
+      for (const r of per) {
+        if (r?.kind === "tuple") literals.push(...r.elements);
+        else return T.array(T.string);
+      }
+      if (literals.length > 64) return T.array(T.string);
+      return T.tuple(literals);
+    }
+    if (method === "values") {
+      const vals = per.filter((r) => r && r.kind !== "unknown").flatMap((r) => (r!.kind === "tuple" ? r.elements : [r!]));
+      if (per.some((r) => !r || r.kind === "unknown") || vals.length > 64) return T.array(T.unknown);
+      return T.tuple(vals);
+    }
+    if (method === "entries") {
+      return T.array(T.tuple([T.string, T.unknown]));
+    }
+    return null;
+  }
+  if (obj.kind === "tuple") {
+    if (method === "keys" || method === "getOwnPropertyNames") {
+      return T.tuple(obj.elements.map((_, i) => T.literal(String(i))));
+    }
+    if (method === "values") return T.tuple([...obj.elements]);
+    if (method === "entries") {
+      return T.tuple(obj.elements.map((el, i) => T.tuple([T.literal(String(i)), el])));
+    }
+    return null;
+  }
   if (obj.kind !== "object") {
     if (method === "keys") return T.array(T.string);
     if (method === "values") return T.array(T.unknown);
@@ -1181,6 +3402,9 @@ function evaluateObjectStaticMethod(
       keys.map((k) => T.tuple([T.literal(k), obj.properties[k]])),
     );
   }
+  if (method === "getOwnPropertyNames") {
+    return T.tuple(keys.map((k) => T.literal(k)));
+  }
   return null;
 }
 
@@ -1192,12 +3416,23 @@ function evaluateArrayMethod(
 ): EvalResult | null {
   const argVals = evaluateArgs(args, env);
   if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+  return evaluateArrayMethodValues(arr, method, argVals as TypeValue[]);
+}
 
-  const callbackFn = (argVals as TypeValue[])[0];
+/** Array/tuple 方法求值主体：实参已经是 TypeValue（AST 路径与 union 分布
+ *  路径共用）。回调类方法（map/filter/reduce/...）拿到 kind "function" 的
+ *  实参时经 callFunction 从其签名/闭包求值——mock 箭头、具名函数与内联
+ *  箭头在此走同一机制。 */
+function evaluateArrayMethodValues(
+  arr: TypeValue & { kind: "array" | "tuple" },
+  method: string,
+  argVals: TypeValue[],
+): EvalResult | null {
+  const callbackFn = argVals[0];
 
   if (method === "push") {
     if (arr.kind === "tuple") {
-      arr.elements.push(...(argVals as TypeValue[]));
+      arr.elements.push(...argVals);
       return T.literal(arr.elements.length);
     }
     return T.number;
@@ -1207,13 +3442,29 @@ function evaluateArrayMethod(
     return arr.kind === "tuple" ? T.literal(arr.elements.length) : T.number;
   }
 
+  if (method === "pop" || method === "shift") {
+    if (arr.kind === "tuple") {
+      // 抽象数组不模拟顺序语义：返回元素 union（空 tuple 理论返回 undefined，union 进去保持 sound）
+      if (arr.elements.length === 0) return T.undefined;
+      return T.union(...arr.elements);
+    }
+    return T.unknown;
+  }
+
+  if (method === "unshift") {
+    if (arr.kind === "tuple") {
+      return T.literal(arr.elements.length + argVals.length);
+    }
+    return T.number;
+  }
+
   if (method === "indexOf" || method === "lastIndexOf") {
     return T.number;
   }
 
   if (method === "includes") {
-    if (arr.kind === "tuple" && (argVals as TypeValue[])[0]?.kind === "literal") {
-      const searchVal = (argVals as TypeValue[])[0];
+    if (arr.kind === "tuple" && argVals[0]?.kind === "literal") {
+      const searchVal = argVals[0];
       const found = arr.elements.some((e) => typeValueEquals(e, searchVal));
       return T.literal(found);
     }
@@ -1227,7 +3478,7 @@ function evaluateArrayMethod(
   if (method === "concat") {
     if (arr.kind === "tuple") {
       const otherElements: TypeValue[] = [];
-      for (const a of argVals as TypeValue[]) {
+      for (const a of argVals) {
         if (a.kind === "tuple") otherElements.push(...a.elements);
         else if (a.kind === "array") return T.array(simplifyUnion([...arr.elements, a.element]));
         else otherElements.push(a);
@@ -1239,8 +3490,8 @@ function evaluateArrayMethod(
 
   if (method === "slice") {
     if (arr.kind === "tuple") {
-      const start = (argVals as TypeValue[])[0];
-      const end = (argVals as TypeValue[])[1];
+      const start = argVals[0];
+      const end = argVals[1];
       const startIdx = start?.kind === "literal" && typeof start.value === "number" ? start.value : 0;
       const endIdx = end?.kind === "literal" && typeof end.value === "number" ? end.value : arr.elements.length;
       return T.tuple(arr.elements.slice(startIdx, endIdx));
@@ -1248,12 +3499,23 @@ function evaluateArrayMethod(
     return T.array(arr.element);
   }
 
+  // 回调实参是「函数 union」（cond ? f : g 透传给 HOF）：对每个成员签名
+  // 分别求值再 union 结果——与非函数守卫（unknown 回调）不同，这里每个
+  // 成员都有完整的 TypeValue 信息，不该整体降级。
+  if (callbackFn && callbackFn.kind === "union" && callbackFn.members.length > 0 &&
+      callbackFn.members.every((m) => m.kind === "function")) {
+    return distributeOverUnion(callbackFn, (member) => {
+      const r = evaluateArrayMethodValues(arr, method, [member, ...argVals.slice(1)]);
+      return r === null ? T.unknown : (r as TypeValue);
+    });
+  }
+
   if (!callbackFn || callbackFn.kind !== "function") {
     if (method === "map") return arr.kind === "tuple" ? T.tuple(arr.elements.map(() => T.unknown)) : T.array(T.unknown);
     if (method === "filter") return arr.kind === "tuple" ? T.array(simplifyUnion(arr.elements)) : arr;
     if (method === "find") return arr.kind === "tuple" ? simplifyUnion([...arr.elements, T.undefined]) : simplifyUnion([arr.element, T.undefined]);
     if (method === "some" || method === "every") return T.boolean;
-    if (method === "reduce") return (argVals as TypeValue[])[1] ?? T.unknown;
+    if (method === "reduce") return argVals[1] ?? T.unknown;
     if (method === "forEach") return T.undefined;
     if (method === "flatMap") return T.array(T.unknown);
     return null;
@@ -1261,23 +3523,36 @@ function evaluateArrayMethod(
 
   const fn = callbackFn as TypeValue & { kind: "function" };
 
+  // HOF：给回调元素挂 term 身份，使 Φ 中的约束可传播到 map/reduce 体
+  const tagEl = (el: TypeValue, name: string): TypeValue => {
+    const tagged = tagParamArg(el, name);
+    copyOrigin(el, tagged);
+    return tagged;
+  };
+
   if (method === "map") {
     if (arr.kind === "tuple") {
       const mapped = arr.elements.map((el, i) =>
-        callFunction(fn, [el, T.literal(i), arr]),
+        callFunction(fn, [tagEl(el, fn.params[0] ?? "item"), T.literal(i), arr]),
       );
       return T.tuple(mapped);
     }
-    return T.array(callFunction(fn, [arr.element, T.number, arr]));
+    return T.array(
+      callFunction(fn, [tagEl(arr.element, fn.params[0] ?? "item"), T.number, arr]),
+    );
   }
 
   if (method === "filter") {
     if (arr.kind === "tuple") {
       const kept: TypeValue[] = [];
       for (let i = 0; i < arr.elements.length; i++) {
-        const result = callFunction(fn, [arr.elements[i], T.literal(i), arr]);
+        const result = callFunction(fn, [
+          tagEl(arr.elements[i]!, fn.params[0] ?? "item"),
+          T.literal(i),
+          arr,
+        ]);
         if (result.kind === "literal" && !result.value) continue;
-        kept.push(arr.elements[i]);
+        kept.push(arr.elements[i]!);
       }
       if (kept.length === 0) return T.tuple([]);
       return T.array(simplifyUnion(kept));
@@ -1286,17 +3561,35 @@ function evaluateArrayMethod(
   }
 
   if (method === "reduce") {
-    const init = (argVals as TypeValue[])[1];
+    const init = argVals[1];
     if (arr.kind === "tuple") {
       let acc = init ?? arr.elements[0] ?? T.unknown;
       const startIdx = init ? 0 : 1;
       for (let i = startIdx; i < arr.elements.length; i++) {
-        acc = callFunction(fn, [acc, arr.elements[i], T.literal(i), arr]);
+        acc = callFunction(fn, [
+          acc,
+          tagEl(arr.elements[i]!, fn.params[1] ?? "item"),
+          T.literal(i),
+          arr,
+        ]);
       }
       return acc;
     }
-    const acc = init ?? arr.element;
-    return callFunction(fn, [acc, arr.element, T.number, arr]);
+    // 抽象数组：不动点迭代（代数纪律）。unknown 不 join 进 acc。
+    const acc0 = init ?? arr.element;
+    let acc = acc0;
+    for (let i = 0; i < 6; i++) {
+      const next = callFunction(fn, [
+        acc,
+        tagEl(arr.element, fn.params[1] ?? "item"),
+        T.number,
+        arr,
+      ]);
+      if (typeValueEquals(acc, next)) return next;
+      if (next.kind === "unknown") return acc;
+      acc = simplifyUnion([acc, next]);
+    }
+    return acc;
   }
 
   if (method === "find") {
@@ -1349,11 +3642,62 @@ function evaluateArrayMethod(
   return null;
 }
 
+// Iterable spread of Set/Map instances: exact side tables spread as
+// tuples ([...new Set([1,2])] → [1, 2]; Maps as [k, v] pairs), otherwise
+// the element typeArgs approximate like an array of that element type.
+// Oversized side tables degrade to the array approximation.
+const MAX_ITERABLE_SPREAD = 1000;
+function iterableSpreadValue(v: TypeValue): TypeValue | undefined {
+  if (v.kind === "instance" && v.className === "Set") {
+    const values = exactSetValues(v);
+    if (values) {
+      return values.length <= MAX_ITERABLE_SPREAD ? T.tuple([...values]) : setValuesIterable(v);
+    }
+    const t = (v as any)._typeArgs?.T;
+    return t && t.kind !== "unknown" ? T.array(t) : undefined;
+  }
+  if (v.kind === "instance" && v.className === "Map") {
+    const entries = exactMapEntries(v);
+    if (entries && entries.length > MAX_ITERABLE_SPREAD) {
+      const ta = (v as any)._typeArgs ?? {};
+      return T.array(T.tuple([ta.K ?? T.unknown, ta.V ?? T.unknown]));
+    }
+    return mapEntriesIterable(v);
+  }
+  return undefined;
+}
+
 function evaluateForOf(
   node: Node & { type: "ForOfStatement" },
   iterable: TypeValue,
   env: Environment,
 ): EvalResult {
+  // A union iterable distributes: every member's elements flow through the
+  // body in sequence (concatenated), not just the first member's. Branch
+  // envs chain member-to-member exactly like element-to-element inside one
+  // tuple iteration, so side effects on shared values (array push) and
+  // outer-var reassignments accumulate across members. Non-iterable
+  // members (number, …) fall through their own recursion harmlessly.
+  if (iterable.kind === "union") {
+    const returnValues: TypeValue[] = [];
+    let currentEnv = env;
+    for (const member of iterable.members) {
+      const memberResult = evaluateForOf(node, member, currentEnv);
+      if (isReturn(memberResult)) {
+        returnValues.push(memberResult.value);
+        return makeReturn(simplifyUnion(returnValues));
+      }
+      if (isBranch(memberResult)) {
+        returnValues.push(memberResult.returnedValue);
+        currentEnv = memberResult.fallthroughEnv;
+      }
+    }
+    if (returnValues.length > 0) {
+      return makeBranch(simplifyUnion(returnValues), currentEnv);
+    }
+    return T.undefined;
+  }
+
   if (iterable.kind === "tuple") {
     const returnValues: TypeValue[] = [];
     let currentEnv = env;
@@ -1369,6 +3713,7 @@ function evaluateForOf(
         returnValues.push(result.returnedValue);
         currentEnv = result.fallthroughEnv;
       }
+      if (loopSignalKind(result) === "break") break;
     }
     if (returnValues.length > 0) {
       return makeBranch(simplifyUnion(returnValues), currentEnv);
@@ -1377,13 +3722,37 @@ function evaluateForOf(
   }
 
   if (iterable.kind === "array") {
-    const loopEnv = env.extend({});
+    const loopEnv = env.fork();
     bindForLoopVar(node.left, iterable.element, loopEnv);
     const result = evaluate(node.body, loopEnv);
     if (isReturn(result)) return makeBranch(result.value, env);
     return T.undefined;
   }
 
+  // Set instances iterate their exact value side table (`new Set([1,2])`
+  // yields 1 then 2); no/partial table keeps the body unexecuted.
+  if (iterable.kind === "instance" && iterable.className === "Set") {
+    const values = exactSetValues(iterable);
+    if (values && values.length > 0) {
+      return evaluateForOf(node, T.tuple([...values]), env);
+    }
+    return T.undefined;
+  }
+
+  // Map instances iterate their exact entry side table as [key, value]
+  // tuples (`for (const [k, v] of map)`); same no/partial-table rule.
+  if (iterable.kind === "instance" && iterable.className === "Map") {
+    const entries = exactMapEntries(iterable);
+    if (entries && entries.length > 0) {
+      return evaluateForOf(
+        node,
+        T.tuple(entries.map((e) => T.tuple([e.key, e.value]))),
+        env,
+      );
+    }
+    return T.undefined;
+  }
+
   return T.undefined;
 }
 
@@ -1409,6 +3778,7 @@ function evaluateForIn(
           returnValues.push(result.returnedValue);
           currentEnv = result.fallthroughEnv;
         }
+        if (loopSignalKind(result) === "break") break;
       }
       if (returnValues.length > 0) {
         return makeBranch(simplifyUnion(returnValues), currentEnv);
@@ -1417,7 +3787,7 @@ function evaluateForIn(
     }
   }
 
-  const loopEnv = env.extend({});
+  const loopEnv = env.fork();
   bindForLoopVar(node.left, T.string, loopEnv);
   evaluate(node.body, loopEnv);
   return T.undefined;
@@ -1471,7 +3841,7 @@ function evaluateForStatement(
   node: Node & { type: "ForStatement" },
   env: Environment,
 ): EvalResult {
-  const loopEnv = env.extend({});
+  const loopEnv = env.fork();
 
   if (node.init) {
     const initResult = evaluate(node.init, loopEnv);
@@ -1482,6 +3852,22 @@ function evaluateForStatement(
   const returnValues: TypeValue[] = [];
   let concreteCompleted = false;
 
+  // let/const 声明的循环变量每轮迭代获得新绑定（真实 JS 的 per-iteration
+  // scope）：body 内创建的闭包捕获当轮副本而非共享 cell，var 保持共享
+  // cell（闭包看到终值）。迭代结束后把副本值拷回 loopEnv，test/update/
+  // widening 依旧能看到 body 对循环变量的修改（`for (let i = 0; i < n;)
+  // { ...; i++ }` 这类无 update 子句的循环靠它推进）。
+  const perIteration =
+    node.init?.type === "VariableDeclaration" && node.init.kind !== "var";
+  const runBody = (scope: Environment): EvalResult => {
+    if (!perIteration) return evaluate(node.body, scope);
+    const iterEnv = scope.fork();
+    for (const name of varNames) iterEnv.bind(name, scope.lookup(name));
+    const result = evaluate(node.body, iterEnv);
+    for (const name of varNames) scope.update(name, iterEnv.lookup(name));
+    return result;
+  };
+
   for (let i = 0; i < _maxConcreteIter; i++) {
     if (node.test) {
       const testVal = evaluate(node.test, loopEnv);
@@ -1490,7 +3876,7 @@ function evaluateForStatement(
       if (testVal.kind !== "literal") break;
     }
 
-    const bodyResult = evaluate(node.body, loopEnv);
+    const bodyResult = runBody(loopEnv);
     if (isReturn(bodyResult)) {
       returnValues.push(bodyResult.value);
       concreteCompleted = true;
@@ -1499,6 +3885,12 @@ function evaluateForStatement(
     if (isBranch(bodyResult)) {
       returnValues.push(bodyResult.returnedValue);
     }
+    // break 终止迭代（变量按 break 时的值流出循环）；continue 落到
+    // update 子句 —— 与真实 JS for 的 continue 语义一致。
+    if (loopSignalKind(bodyResult) === "break") {
+      concreteCompleted = true;
+      break;
+    }
 
     if (node.update) {
       const updateResult = evaluate(node.update, loopEnv);
@@ -1511,7 +3903,7 @@ function evaluateForStatement(
     const prevSnap = snapshotVars(varNames, loopEnv);
 
     for (let i = 0; i < 10; i++) {
-      evaluate(node.body, loopEnv);
+      runBody(loopEnv);
       if (node.update) evaluate(node.update, loopEnv);
       widenVars(varNames, loopEnv);
       const currSnap = snapshotVars(varNames, loopEnv);
@@ -1550,6 +3942,7 @@ function evaluateWhileStatement(
     if (isBranch(bodyResult)) {
       returnValues.push(bodyResult.returnedValue);
     }
+    if (loopSignalKind(bodyResult) === "break") break;
   }
 
   if (returnValues.length > 0) {
@@ -1573,6 +3966,7 @@ function evaluateDoWhileStatement(
     if (isBranch(bodyResult)) {
       returnValues.push(bodyResult.returnedValue);
     }
+    if (loopSignalKind(bodyResult) === "break") break;
 
     const tv = evaluate(node.test, env);
     if (isReturn(tv) || isBranch(tv) || isThrow(tv)) return tv;
@@ -1586,23 +3980,293 @@ function evaluateDoWhileStatement(
   return T.undefined;
 }
 
-function evaluateImportDeclaration(node: Node & { type: "ImportDeclaration" }, env: Environment): EvalResult {
-  const source = node.source.value;
-  if (!currentModuleResolver) return T.undefined;
+/** 诊断用的模块短名：UnknownRecord.name 会决定诊断 range 的列宽
+ *  （analyzer 按 name.length 折叠 end 列），完整路径会把列号撑爆。 */
+function moduleLabel(pathOrSpecifier: string): string {
+  const base = pathOrSpecifier.replace(/^.*\//, "");
+  return base || pathOrSpecifier;
+}
 
-  const resolved = currentModuleResolver(source, currentFileDir);
-  if (!resolved) return T.undefined;
+/** 相对说明符的完整候选路径（evaluator 不引 node:path，手工拼接并归一化
+ *  "./" 与 ".." 段，保证诊断里是干净的绝对路径）。 */
+function attemptedFullPath(fromDir: string, specifier: string): string {
+  if (specifier.startsWith("/")) return specifier;
+  const base = specifier.startsWith("./") ? specifier.slice(2) : specifier;
+  const joined = fromDir ? `${fromDir.replace(/\/+$/, "")}/${base}` : base;
+  const segments: string[] = [];
+  for (const seg of joined.split("/")) {
+    if (seg === "" || seg === ".") continue;
+    if (seg === "..") segments.pop();
+    else segments.push(seg);
+  }
+  return (joined.startsWith("/") ? "/" : "") + segments.join("/");
+}
 
+/** Load (or fetch from cache) the environment for a resolved module file.
+ * Shared by ESM import and CJS require — one loading path, one cache.
+ * loc 为触发本次加载的 import/require 结点，用于守卫诊断定位。 */
+function loadModuleEnv(resolved: { ast: Node; filePath: string }, loc?: Node["loc"]): Environment {
+  // 循环加载守卫——必须先于缓存查询：进行中的文件在求值前就已预置进
+  // moduleCache，缓存命中分支区分不了「已加载完成」与「环形依赖回到自身」。
+  // 命中环时返回进行中的部分环境（ESM 环形依赖语义，类型不炸），同时记录
+  // 指明环链的诊断（a -> b -> a）。
+  const cycleIndex = _moduleEvalStack.indexOf(resolved.filePath);
+  if (cycleIndex !== -1) {
+    const chain = [..._moduleEvalStack.slice(cycleIndex), resolved.filePath];
+    recordUnknown({
+      kind: "global",
+      name: `module-cycle:${moduleLabel(resolved.filePath)}`,
+      loc,
+      reason: `Circular module load: ${chain.join(" -> ")} (bindings inside the cycle resolve to their partially evaluated types)`,
+    });
+    return moduleCache.get(resolved.filePath) ?? freshStubModuleEnv(resolved);
+  }
   let moduleEnv = moduleCache.get(resolved.filePath);
   if (!moduleEnv) {
+    // 深度上限：每个真正新载入的文件占一帧，超过 MAX_MODULE_LOAD_DEPTH
+    // 即截断为空环境（导出全为 unknown），报错指明链深与完整链。
+    if (_moduleEvalStack.length >= MAX_MODULE_LOAD_DEPTH) {
+      const chain = [..._moduleEvalStack, resolved.filePath];
+      recordUnknown({
+        kind: "global",
+        name: `module-depth:${moduleLabel(resolved.filePath)}`,
+        loc,
+        reason: `Module load chain too deep (depth ${chain.length} > ${MAX_MODULE_LOAD_DEPTH} max): ${chain.join(" -> ")} (loading truncated, deeper modules typed as unknown)`,
+      });
+      return freshStubModuleEnv(resolved);
+    }
     moduleEnv = createEnvironment();
     moduleCache.set(resolved.filePath, moduleEnv);
     const savedDir = currentFileDir;
     currentFileDir = resolved.filePath.replace(/\/[^/]+$/, "");
-    evaluateProgram(resolved.ast, moduleEnv);
+    _moduleEvalStack.push(resolved.filePath);
+    try {
+      evaluateProgram(resolved.ast, moduleEnv);
+    } finally {
+      _moduleEvalStack.pop();
+    }
     currentFileDir = savedDir;
+    tagModuleExports(moduleEnv, resolved.filePath);
+    tagCommonJsExports(moduleEnv, resolved.filePath);
+  }
+  return moduleEnv;
+}
+
+/** 截断/环回退用的空环境：入缓存保证后续请求拿到同一份「全 unknown」结果。 */
+function freshStubModuleEnv(resolved: { ast: Node; filePath: string }): Environment {
+  const stub = createEnvironment();
+  moduleCache.set(resolved.filePath, stub);
+  return stub;
+}
+
+/** Build an exports namespace object from a module's `__export_` bindings
+ * (ESM exports required from CJS). Null when the module exports nothing. */
+function namespaceFromExportBindings(env: Environment): TypeValue | null {
+  const exports: Record<string, TypeValue> = {};
+  const bindings = env.getOwnBindings();
+  for (const [k, v] of Object.entries(bindings)) {
+    if (!k.startsWith("__export_")) continue;
+    exports[k === "__export_default" ? "default" : k.slice("__export_".length)] = v;
+  }
+  if (Object.keys(exports).length === 0) return null;
+  return T.object(exports);
+}
+
+/** The value of require() for an evaluated module: `module.exports` when the
+ * target assigned it, the (possibly `exports.x`-mutated) exports object
+ * otherwise, and the ESM namespace when the target is an ES module. */
+function commonJsExportsValue(moduleEnv: Environment): TypeValue {
+  if (moduleEnv.has("module")) {
+    const moduleVal = moduleEnv.lookup("module");
+    if (moduleVal.kind === "object") {
+      const exp = moduleVal.properties["exports"];
+      if (exp) {
+        if (
+          exp.kind === "object" &&
+          (exp as any).__cjsExportsRoot === true &&
+          Object.keys(exp.properties).length === 0
+        ) {
+          // Target never wrote CJS exports — surface ESM exports instead.
+          return namespaceFromExportBindings(moduleEnv) ?? exp;
+        }
+        return exp;
+      }
+    }
+  }
+  return T.unknown;
+}
+
+
+function evaluateRequireCall(node: Node & { type: "CallExpression" }, _env: Environment): EvalResult {  const arg = (node.arguments as Node[])[0];
+  if (!arg || arg.type !== "StringLiteral") {
+    recordUnknown({
+      kind: "global",
+      name: "require",
+      loc: node.loc,
+      reason: "require() with non-literal specifier",
+    });
+    return T.unknown;
+  }
+  const specifier = arg.value as string;
+  // Bare specifiers (npm packages) are not resolved in v1.
+  if (!specifier.startsWith(".") && !specifier.startsWith("/")) {
+    recordUnknown({
+      kind: "global",
+      name: `require('${specifier}')`,
+      loc: node.loc,
+      reason: `bare module specifier '${specifier}' is not resolved (npm packages unsupported)`,
+    });
+    return T.unknown;
+  }
+  if (!currentModuleResolver) return T.unknown;
+  const resolved = currentModuleResolver(specifier, currentFileDir);
+  if (!resolved) {
+    // 缺失文件：报错带完整候选路径（module-missing 前缀走 analyzer 专属
+    // 文案通道，reason 不会被通用 unknown-global 文案吞掉）。
+    recordUnknown({
+      kind: "global",
+      name: `module-missing:require('${specifier}')`,
+      loc: node.loc,
+      reason: `Cannot resolve require('${specifier}'): no file at ${attemptedFullPath(currentFileDir, specifier)} (with or without .js/.ts/.mjs extension)`,
+    });
+    return T.unknown;
+  }
+  // .json 模块（如 require('../package.json')）：JSON 值直接映射为字面量类型
+  if ("json" in resolved && resolved.json !== undefined) {
+    return jsonToTypeValue(resolved.json);
+  }
+  return commonJsExportsValue(loadModuleEnv(resolved, node.loc));
+}
+
+function evaluateImportDeclaration(node: Node & { type: "ImportDeclaration" }, env: Environment): EvalResult {
+  const source = node.source.value;
+
+  const mockModule = mockModules.get(source);
+  if (mockModule && currentModuleResolver) {
+    const mockResolved = currentModuleResolver(mockModule.fromPath, currentFileDir);
+    if (mockResolved) {
+      const mockEnv = loadModuleEnv(mockResolved, node.loc);
+
+      if (mockModule.names) {
+        const originalResolved = currentModuleResolver(source, currentFileDir);
+        let originalEnv: Environment | undefined;
+        if (originalResolved) {
+          originalEnv = loadModuleEnv(originalResolved, node.loc);
+        }
+
+        for (const spec of node.specifiers) {
+          if (spec.type === "ImportSpecifier") {
+            const importedName = spec.imported.type === "Identifier" ? spec.imported.name : null;
+            if (importedName && mockModule.names.includes(importedName)) {
+              const val = mockEnv.has(`__export_${importedName}`) ? mockEnv.lookup(`__export_${importedName}`) : T.unknown;
+              env.bind(spec.local.name, val);
+            } else if (importedName && originalEnv) {
+              const val = originalEnv.has(`__export_${importedName}`) ? originalEnv.lookup(`__export_${importedName}`) : T.unknown;
+              env.bind(spec.local.name, val);
+            }
+          } else if (spec.type === "ImportDefaultSpecifier") {
+            const sourceEnv = originalEnv ?? mockEnv;
+            const val = sourceEnv.has(`__export_default`) ? sourceEnv.lookup(`__export_default`) : T.unknown;
+            env.bind(spec.local.name, val);
+          } else if (spec.type === "ImportNamespaceSpecifier") {
+            const exports: Record<string, TypeValue> = {};
+            const sourceEnv = originalEnv ?? mockEnv;
+            const bindings = sourceEnv.getOwnBindings();
+            for (const [k, v] of Object.entries(bindings)) {
+              if (k.startsWith("__export_") && k !== "__export_default") {
+                const name = k.slice("__export_".length);
+                exports[name] = mockModule.names.includes(name)
+                  ? (mockEnv.has(k) ? mockEnv.lookup(k) : v)
+                  : v;
+              }
+            }
+            const mockBindings = mockEnv.getOwnBindings();
+            for (const [k, v] of Object.entries(mockBindings)) {
+              if (k.startsWith("__export_") && k !== "__export_default") {
+                const name = k.slice("__export_".length);
+                if (mockModule.names.includes(name)) {
+                  exports[name] = v;
+                }
+              }
+            }
+            env.bind(spec.local.name, T.object(exports));
+          }
+        }
+        return T.undefined;
+      }
+
+      for (const spec of node.specifiers) {
+        if (spec.type === "ImportDefaultSpecifier") {
+          const val = mockEnv.has(`__export_default`) ? mockEnv.lookup(`__export_default`) : T.unknown;
+          env.bind(spec.local.name, val);
+        } else if (spec.type === "ImportSpecifier") {
+          const importedName = spec.imported.type === "Identifier" ? spec.imported.name : null;
+          if (importedName) {
+            const val = mockEnv.has(`__export_${importedName}`) ? mockEnv.lookup(`__export_${importedName}`) : T.unknown;
+            env.bind(spec.local.name, val);
+          }
+        } else if (spec.type === "ImportNamespaceSpecifier") {
+          const exports: Record<string, TypeValue> = {};
+          const bindings = mockEnv.getOwnBindings();
+          for (const [k, v] of Object.entries(bindings)) {
+            if (k.startsWith("__export_") && k !== "__export_default") {
+              exports[k.slice("__export_".length)] = v;
+            }
+          }
+          env.bind(spec.local.name, T.object(exports));
+        }
+      }
+      return T.undefined;
+    }
+    // mock 文件本身解析失败：此前静默回落到原模块（mock 被无声忽略）。
+    // 现在记录带完整候选路径的诊断后仍回落，分析不中断。
+    recordUnknown({
+      kind: "global",
+      name: `module-missing:${moduleLabel(mockModule.fromPath)}`,
+      loc: node.loc,
+      reason: `@nudo:mock-module target for "${source}" not found: no file at ${attemptedFullPath(currentFileDir, mockModule.fromPath)} (with or without .js/.ts/.mjs extension); falling back to the original module`,
+    });
+  }
+
+  const envModule = envModules[source];
+  if (envModule) {
+    for (const spec of node.specifiers) {
+      if (spec.type === "ImportDefaultSpecifier") {
+        const defaultExport = envModule["default"];
+        env.bind(spec.local.name, defaultExport ?? T.unknown);
+      } else if (spec.type === "ImportSpecifier") {
+        const importedName = spec.imported.type === "Identifier" ? spec.imported.name : null;
+        if (importedName) {
+          env.bind(spec.local.name, envModule[importedName] ?? T.unknown);
+        }
+      } else if (spec.type === "ImportNamespaceSpecifier") {
+        const { default: _default, ...rest } = envModule;
+        env.bind(spec.local.name, T.object(rest));
+      }
+    }
+    return T.undefined;
+  }
+
+  if (!currentModuleResolver) return T.undefined;
+
+  const resolved = currentModuleResolver(source, currentFileDir);
+  if (!resolved) {
+    // 相对/绝对说明符解析失败：此前完全静默（绑定凭空缺失，只剩下游
+    // 「unknown global」噪音）。缺失文件报错带完整候选路径；裸说明符
+    // （npm 包）保持静默，与 require() 的 bare 分支口径一致。
+    if (source.startsWith(".") || source.startsWith("/")) {
+      recordUnknown({
+        kind: "global",
+        name: `module-missing:${moduleLabel(source)}`,
+        loc: node.loc,
+        reason: `Cannot resolve import '${source}': no file at ${attemptedFullPath(currentFileDir, source)} (with or without .js/.ts/.mjs extension)`,
+      });
+    }
+    return T.undefined;
   }
 
+  const moduleEnv = loadModuleEnv(resolved, node.loc);
+
   for (const spec of node.specifiers) {
     if (spec.type === "ImportDefaultSpecifier") {
       const val = moduleEnv.has(`__export_default`) ? moduleEnv.lookup(`__export_default`) : T.unknown;
@@ -1643,7 +4307,9 @@ function evaluateClassDeclaration(node: Node & { type: "ClassDeclaration" }, env
     );
     const fnType = T.fn(paramNames, member.body, env) as TypeValue & { kind: "function" };
     (fnType as any)._paramPatterns = member.params;
+    (fnType as any)._name = `${className}.${methodName}`;
     if (member.async) (fnType as any)._async = true;
+    tagFnModule(fnType);
 
     if (member.kind === "constructor") {
       constructorFn = fnType;
@@ -1671,26 +4337,320 @@ function evaluateInstanceof(left: TypeValue, _right: TypeValue, rightNode: Node,
         isSubtypeOf(lv, T.instanceOf(className));
       return T.literal(matches);
     }
+    // Structurally-known receivers decide `x instanceof C` literally:
+    // plain objects are never Date/Buffer/..., arrays are Array/Object, ...
+    // (hoek getInternalProto's instanceof chain keys off this precision).
+    const structural = builtinInstanceTest(lv, className);
+    if (structural !== undefined) return T.literal(structural);
     return T.boolean;
   });
 }
 
-const BUILTIN_ERROR_CLASSES = new Set([
-  "Error", "TypeError", "SyntaxError", "RangeError", "ReferenceError", "URIError", "EvalError",
-]);
+// --- new Promise(executor) ---
+
+// Budgets for the static resolve-site scan: resolve calls hiding inside
+// never-executed callbacks are invisible to the executor run, so the
+// executor AST is walked for them. Bounded to keep large executors from
+// ballooning analysis time.
+const PROMISE_SCAN_MAX_SITES = 16;
+const PROMISE_SCAN_MAX_NODES = 2000;
+
+// Synthetic resolve/reject collectors handed to executors (see
+// makePromiseCollector). Calls to them are internal plumbing; recordCall
+// consults this set to avoid emitting them as user call sites.
+const _promiseCollectors = new WeakSet<object>();
+
+function makePromiseCollector(sink: TypeValue[]): TypeValue {
+  const collector = T.fnSig([T.unknown], T.undefined, T.never, (args) => {
+    sink.push(args[0] ?? T.undefined);
+    return T.undefined;
+  });
+  _promiseCollectors.add(collector as unknown as object);
+  return collector;
+}
+
+// Resolve sites hiding in never-executed callbacks (`setTimeout(() =>
+// resolve(x), 1)`, `emitter.on('end', () => resolve(x))`) never fire during
+// the executor run; walk the executor subtree for `resolve(...)` calls —
+// matched by the executor's actual first-parameter name — and collect each
+// site's first argument node. Sites with spread/no arguments are skipped.
+function findResolveArgSites(root: Node, resolveName: string): Node[] {
+  const sites: Node[] = [];
+  let visited = 0;
+  const stack: Node[] = [root];
+  while (stack.length > 0 && sites.length < PROMISE_SCAN_MAX_SITES) {
+    const n = stack.pop()!;
+    if (++visited > PROMISE_SCAN_MAX_NODES) break;
+    if (n.type === "CallExpression" || n.type === "OptionalCallExpression") {
+      const c = (n as any).callee as Node | undefined;
+      if (c?.type === "Identifier" && c.name === resolveName) {
+        const first = (n as any).arguments?.[0] as Node | undefined;
+        if (first && first.type !== "SpreadElement") sites.push(first);
+      }
+    }
+    for (const key of Object.keys(n)) {
+      if (key === "loc" || key === "leadingComments" || key === "trailingComments" || key === "innerComments") continue;
+      const v = (n as any)[key];
+      if (Array.isArray(v)) {
+        for (const el of v) {
+          if (el && typeof el === "object" && typeof (el as any).type === "string") stack.push(el as Node);
+        }
+      } else if (v && typeof v === "object" && typeof v.type === "string") {
+        stack.push(v as Node);
+      }
+    }
+  }
+  return sites;
+}
+
+// Returns the promise's fulfillment type. The executor call environment is
+// built here (not buried in callFunctionUnchecked) so the static scan can
+// evaluate resolve-site arguments in the post-execution executor scope,
+// where executor locals and the closure chain (outer params, e.g. hoek's
+// wait(timeout, returnValue)) are both visible.
+function evaluatePromiseExecutor(executor: TypeValue & { kind: "function" }): TypeValue {
+  const resolveCollected: TypeValue[] = [];
+  // reject is collected too (complete executor semantics) but only resolve
+  // determines the fulfillment type.
+  const rejectCollected: TypeValue[] = [];
+  const callEnv = executor.closure.extend({});
+  bindFunctionParams(executor, [makePromiseCollector(resolveCollected), makePromiseCollector(rejectCollected)], callEnv);
+
+  // try/finally 语义下 resolve 位点（位于 try 内）先于 finally 执行，但
+  // 这里是先执行完整个 body 再扫描——finally 的副作用（如 finally
+  // { parser = null }）会毒化扫描求值（parser.finish() 变 no-method on
+  // null）。快照执行前的绑定链；扫描时当前值被 null/undefined 化而快照
+  // 值非空的绑定回退快照值（finally-nullification 的签名）。循环累加
+  // （当前值更丰富）不受影响。
+  const preBodySnapshot = callEnv.snapshot();
+
+  // Execute the executor body synchronously; direct resolve/reject calls
+  // hit the collectors through normal parameter binding.
+  if (_callDepth < MAX_CALL_DEPTH && _totalCalls < MAX_TOTAL_CALLS) {
+    _callDepth++;
+    _totalCalls++;
+    const savedUnreachable = _unreachableRanges;
+    _unreachableRanges = [];
+    try {
+      evaluate(executor.body, callEnv);
+    } finally {
+      _unreachableRanges = savedUnreachable;
+      _callDepth--;
+    }
+  }
+
+  const isNullish = (v: TypeValue): boolean =>
+    v.kind === "literal" && (v.value === null || v.value === undefined);
+  const scanEnv: Environment = {
+    lookup: (name: string) => {
+      const cur = callEnv.lookup(name);
+      if (isNullish(cur)) {
+        const snap = preBodySnapshot.lookup(name);
+        if (!isNullish(snap) && snap !== T.undefined) return snap;
+      }
+      return cur;
+    },
+    bind: (name, value) => callEnv.bind(name, value),
+    update: (name, value) => callEnv.update(name, value),
+    extend: (b) => callEnv.extend(b),
+    fork: () => callEnv.fork(),
+    has: (name) => callEnv.has(name),
+    snapshot: () => callEnv.snapshot(),
+    getOwnBindings: () => callEnv.getOwnBindings(),
+  };
+
+  const firstPattern = ((executor as any)._paramPatterns as Node[] | undefined)?.[0];
+  if (firstPattern?.type === "Identifier") {
+    for (const argExpr of findResolveArgSites(executor.body, firstPattern.name)) {
+      const argVal = evaluate(argExpr, scanEnv);
+      if (isReturn(argVal) || isBranch(argVal) || isThrow(argVal)) continue;
+      resolveCollected.push(argVal);
+    }
+  }
+
+  // No fulfillment value observed → never-resolving promise (hoek block()'s
+  // `new Promise(Ignore)`); T.union flattens/dedups the collected values.
+  return T.promise(T.union(...resolveCollected));
+}
+
+// .then(cb): run the callback on the resolved value through the main call
+// path so the callback's return type flows into the chained promise; a
+// callback returning a promise flattens (runtime then-semantics). Returns
+// null when not applicable (non-then method, non-callable handler).
+function applyPromiseThenCallback(
+  promiseValue: TypeValue & { kind: "promise" },
+  argVals: TypeValue[],
+): TypeValue | null {
+  const cb = argVals[0];
+  if (!cb || cb.kind !== "function") return null;
+  const result = callFunctionFull(cb, [promiseValue.value]).value;
+  return result.kind === "promise" ? result : T.promise(result);
+}
+
+// Bind call arguments to a function value's parameters (rest parameters
+// collect the remaining arguments into a tuple; patterns delegate to
+// bindPattern). Shared by the direct call path, class construction, and
+// the Promise executor run.
+function bindFunctionParams(
+  fn: TypeValue & { kind: "function" },
+  args: TypeValue[],
+  callEnv: Environment,
+): void {
+  const paramPatterns = (fn as any)._paramPatterns as Node[] | undefined;
+  for (let i = 0; i < fn.params.length; i++) {
+    const paramName = fn.params[i];
+    // Check if this is a rest parameter (starts with ...)
+    if (paramName.startsWith("...")) {
+      const restValue = T.tuple(args.slice(i));
+      if (paramPatterns && paramPatterns[i]) {
+        bindPattern(paramPatterns[i], restValue, callEnv);
+      } else {
+        callEnv.bind(paramName.slice(3), restValue); // Remove "..." prefix
+      }
+    } else {
+      let argVal = args[i] ?? T.undefined;
+      {
+        const tagged = tagParamArg(argVal, paramName);
+        copyOrigin(argVal, tagged);
+        argVal = tagged;
+      }
+      if (paramPatterns && paramPatterns[i]) {
+        bindPattern(paramPatterns[i], argVal, callEnv);
+      } else {
+        callEnv.bind(paramName, argVal);
+      }
+    }
+  }
+  // 非箭头函数的 arguments 对象：tuple(实参) —— length/索引/迭代/展开
+  // 经由既有 tuple 机制直接可用。箭头函数不绑（词法作用域回退外层，
+  // 真实 JS 语义）；_hasArguments 在函数值创建位点按节点类型标记。
+  if ((fn as any)._hasArguments) {
+    callEnv.bind("arguments", T.tuple(args));
+  }
+}
 
 function evaluateNewExpression(node: Node & { type: "NewExpression" }, env: Environment): EvalResult {
   const callee = node.callee as Node;
-  if (callee.type === "Identifier" && BUILTIN_ERROR_CLASSES.has(callee.name)) {
+  if (callee.type === "Identifier" && BUILTIN_ERROR_CLASSES.has(callee.name) && !env.has(callee.name)) {
     const argVals = evaluateArgs(node.arguments as Node[], env);
     if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
     const msgVal = (argVals as TypeValue[])[0] ?? T.undefined;
     return T.instanceOf(callee.name, { message: msgVal });
   }
 
+  // Handle new Map()
+  if (callee.type === "Identifier" && callee.name === "Map" && !env.has("Map")) {
+    const argVals = evaluateArgs(node.arguments as Node[], env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    return createMapType(argVals as TypeValue[]);
+  }
+
+  // Handle new Set()
+  if (callee.type === "Identifier" && callee.name === "Set" && !env.has("Set")) {
+    const argVals = evaluateArgs(node.arguments as Node[], env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    return createSetType(argVals as TypeValue[]);
+  }
+
+  // Handle new RegExp()
+  if (callee.type === "Identifier" && callee.name === "RegExp" && !env.has("RegExp")) {
+    return createRegExpType();
+  }
+
+  // Handle new URL()
+  if (callee.type === "Identifier" && callee.name === "URL" && !env.has("URL")) {
+    return createURLType();
+  }
+
+  // Handle new URLSearchParams()
+  if (callee.type === "Identifier" && callee.name === "URLSearchParams" && !env.has("URLSearchParams")) {
+    return createURLSearchParamsType();
+  }
+
+  // Handle new Response()
+  if (callee.type === "Identifier" && callee.name === "Response" && !env.has("Response")) {
+    return createResponseType();
+  }
+
+  // Handle new Headers()
+  if (callee.type === "Identifier" && callee.name === "Headers" && !env.has("Headers")) {
+    return createHeadersType();
+  }
+
+  // Handle new FormData()
+  if (callee.type === "Identifier" && callee.name === "FormData" && !env.has("FormData")) {
+    return createFormDataType();
+  }
+
+  // Handle new AbortController()
+  if (callee.type === "Identifier" && callee.name === "AbortController" && !env.has("AbortController")) {
+    return createAbortControllerType();
+  }
+
+  // Handle new WeakMap()
+  if (callee.type === "Identifier" && callee.name === "WeakMap" && !env.has("WeakMap")) {
+    return createWeakMapType();
+  }
+
+  // Handle new WeakSet()
+  if (callee.type === "Identifier" && callee.name === "WeakSet" && !env.has("WeakSet")) {
+    return createWeakSetType();
+  }
+
+  // Handle new Promise(executor): run the executor with resolve/reject
+  // collectors, then statically scan for resolve sites hiding inside
+  // never-executed callbacks (setTimeout / emitter.on) to recover the
+  // fulfillment type. Unknown/non-function executor still yields an honest
+  // Promise<unknown> instead of a bare unknown.
+  if (callee.type === "Identifier" && callee.name === "Promise" && !env.has("Promise")) {
+    const argVals = evaluateArgs(node.arguments as Node[], env);
+    if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
+    const executor = (argVals as TypeValue[])[0];
+    if (executor && executor.kind === "function") {
+      return evaluatePromiseExecutor(executor);
+    }
+    return T.promise(T.unknown);
+  }
+
+  // Handle new Intl.DateTimeFormat() and new Intl.NumberFormat()
+  if (callee.type === "MemberExpression" && !callee.computed) {
+    const obj = callee.object as Node;
+    const prop = callee.property as Node;
+    if (obj.type === "Identifier" && obj.name === "Intl" && !env.has("Intl") && prop.type === "Identifier") {
+      if (prop.name === "DateTimeFormat") {
+        return createDateTimeFormatType();
+      }
+      if (prop.name === "NumberFormat") {
+        return createNumberFormatType();
+      }
+    }
+  }
+
   const calleeVal = evaluate(callee, env);
   if (isReturn(calleeVal) || isBranch(calleeVal) || isThrow(calleeVal)) return calleeVal;
 
+  // Reflection constructors: `new (X.prototype)()` (hoek clone's
+  // `new Types.set()`) builds a fresh instance of the prototype's class;
+  // collection classes get their side-table-carrying factories.
+  const protoClassName = calleeVal.kind === "instance" ? (calleeVal as any)._builtinProto as string | undefined : undefined;
+  if (protoClassName) {
+    if (protoClassName === "Set") return createSetType();
+    if (protoClassName === "Map") return createMapType();
+    if (protoClassName === "Array") return T.array(T.unknown);
+    return T.instanceOf(protoClassName);
+  }
+
+  // Class-namespace constructors (`new (x.constructor)(n)` where the
+  // constructor is a memoized builtinClassValue): Array approximates to
+  // unknown[], Object to a plain object, everything else to its class
+  // instance.
+  const classNamespace = calleeVal.kind === "object" ? (calleeVal as any)._builtinName as string | undefined : undefined;
+  if (classNamespace) {
+    if (classNamespace === "Array") return T.array(T.unknown);
+    if (classNamespace === "Object") return T.object({});
+    return T.instanceOf(classNamespace);
+  }
+
   if (calleeVal.kind === "function") {
     const argVals = evaluateArgs(node.arguments as Node[], env);
     if (isReturn(argVals) || isBranch(argVals) || isThrow(argVals)) return argVals;
@@ -1701,15 +4661,7 @@ function evaluateNewExpression(node: Node & { type: "NewExpression" }, env: Envi
       const constructEnv = calleeVal.closure.extend({});
       const thisObj = T.object(instanceProps);
       constructEnv.bind("this", thisObj);
-      const paramPatterns = (calleeVal as any)._paramPatterns as Node[] | undefined;
-      for (let i = 0; i < calleeVal.params.length; i++) {
-        const argVal = (argVals as TypeValue[])[i] ?? T.undefined;
-        if (paramPatterns?.[i]) {
-          bindPattern(paramPatterns[i], argVal, constructEnv);
-        } else {
-          constructEnv.bind(calleeVal.params[i], argVal);
-        }
-      }
+      bindFunctionParams(calleeVal, argVals as TypeValue[], constructEnv);
       const result = evaluate(calleeVal.body, constructEnv);
       if (isThrow(result)) return result;
       const finalThis = constructEnv.lookup("this");
@@ -1727,7 +4679,7 @@ function evaluateNewExpression(node: Node & { type: "NewExpression" }, env: Envi
 }
 
 function evaluateTryStatement(node: Node & { type: "TryStatement" }, env: Environment): EvalResult {
-  const tryResult = evaluateStatements(node.block.body, env.extend({}));
+  const tryResult = evaluateStatements(node.block.body, env.fork());
 
   const thrownType = isThrow(tryResult) ? tryResult.thrown : null;
 
@@ -1739,9 +4691,13 @@ function evaluateTryStatement(node: Node & { type: "TryStatement" }, env: Enviro
         ? tryResult
         : tryResult;
 
+  // The handler only runs when the try block actually threw along the
+  // evaluated paths. Evaluating it unconditionally unions the catch value
+  // into every try/catch (with `err` bound to unknown when nothing threw),
+  // which poisons guards like hoek's `try { return v.call(o) } catch …`.
   let catchResult: EvalResult | null = null;
-  if (node.handler && thrownType) {
-    const catchEnv = env.extend({});
+  if (node.handler && thrownType !== null) {
+    const catchEnv = env.fork();
     if (node.handler.param) {
       bindPattern(node.handler.param, thrownType, catchEnv);
     }
@@ -1749,7 +4705,7 @@ function evaluateTryStatement(node: Node & { type: "TryStatement" }, env: Enviro
   }
 
   if (node.finalizer) {
-    const finallyResult = evaluateStatements(node.finalizer.body, env.extend({}));
+    const finallyResult = evaluateStatements(node.finalizer.body, env.fork());
     if (isThrow(finallyResult)) return finallyResult;
     if (isReturn(finallyResult)) return finallyResult;
   }
@@ -1798,7 +4754,11 @@ function evaluateSwitchStatement(node: Node & { type: "SwitchStatement" }, env:
       }
       if (matched) {
         const result = evaluateStatements(caseNode.consequent, env);
-        if (isThrow(result)) return result;
+        if (isThrow(result)) {
+          // switch 是 break 的边界：吸收后正常落穿
+          if (loopSignalKind(result) === "break") break;
+          return result;
+        }
         if (isReturn(result)) {
           returnValues.push(result.value);
           break;
@@ -1817,7 +4777,28 @@ function evaluateSwitchStatement(node: Node & { type: "SwitchStatement" }, env:
 
   const returnValues: TypeValue[] = [];
   for (const caseNode of node.cases) {
-    const result = evaluateStatements(caseNode.consequent, env);
+    let caseEnv = env;
+    if (caseNode.test) {
+      const testVal = evaluate(caseNode.test, env);
+      if (isReturn(testVal) || isBranch(testVal) || isThrow(testVal)) return testVal;
+
+      // Try to narrow discriminant for this case using existing narrow()
+      // Construct a synthetic BinaryExpression: discriminant === caseTest
+      const syntheticTest = {
+        type: "BinaryExpression",
+        operator: "===",
+        left: node.discriminant,
+        right: caseNode.test,
+        start: 0,
+        end: 0,
+        loc: null,
+      } as unknown as Node;
+      const [narrowedEnv] = narrow(syntheticTest, env);
+      caseEnv = narrowedEnv;
+    }
+
+    const result = evaluateStatements(caseNode.consequent, caseEnv);
+    if (loopSignalKind(result) === "break") break;
     if (isThrow(result)) continue;
     if (isReturn(result)) {
       returnValues.push(result.value);
@@ -1840,19 +4821,210 @@ type CallResult = {
   throwLoc?: SourceRange;
 };
 
-function callFunctionFull(fn: TypeValue & { kind: "function" }, args: TypeValue[]): CallResult {
-  const callEnv = fn.closure.extend({});
-  const paramPatterns = (fn as any)._paramPatterns as Node[] | undefined;
-  const isAsync = !!(fn as any)._async;
-  for (let i = 0; i < fn.params.length; i++) {
-    const argVal = args[i] ?? T.undefined;
-    if (paramPatterns && paramPatterns[i]) {
-      bindPattern(paramPatterns[i], argVal, callEnv);
-    } else {
-      callEnv.bind(fn.params[i], argVal);
+// --- Recursion termination: cycle detection + depth/work budgets ---
+// Abstract interpretation unrolls calls instead of iterating to a fixpoint,
+// so recursive functions invoked under unconstrained arguments (e.g. an
+// entry@ case where `seen.has(obj)` cannot concretely short-circuit) expand
+// forever. Three guards cut the expansion, all returning T.unknown — the
+// call-side dual of loop widening: the result simply drops the deeper
+// iterations' effects instead of guessing them, a sound over-approximation.
+//
+// 1. Cycle detection: a call whose (function value, abstract args) pair is
+//    already being evaluated higher on the stack makes no abstract progress
+//    (clone(obj, seen) re-invoking itself with identical types). Unrolling it
+//    anyway fans out exponentially, so the re-entrant edge is cut at its
+//    first recurrence — the same treatment the call memo applies on
+//    MEMO_IN_PROGRESS. Accumulator-growing recursion (deepEqual's `seen`
+//    tuple getting one entry longer per level) never repeats a key verbatim,
+//    so cycle keys are *widened*: tuples longer than CYCLE_TUPLE_CAP and
+//    objects with more than CYCLE_PROP_CAP properties all normalize to the
+//    same key, making accumulator growth collapse after a few levels.
+//    Args-changing recursion (factorial(5) -> factorial(4)) is unaffected
+//    because each level still has a distinct widened key.
+// 2. Depth budget: backstop for recursion whose argument types keep morphing
+//    without structurally repeating (f(n) -> f([n]) -> f([[n]]) ...) beyond
+//    what the widening recognizes.
+// 3. Total call budget: absolute bound on the unrolled call tree so no
+//    pathological branching shape can exhaust memory; analysis of any file
+//    stays linear in this budget.
+const MAX_CALL_DEPTH = 64;
+const MAX_TOTAL_CALLS = 200_000;
+const CYCLE_TUPLE_CAP = 4;
+const CYCLE_PROP_CAP = 8;
+let _callDepth = 0;
+let _totalCalls = 0;
+const _activeCallKeys: string[] = [];
+const _fnCallIds = new WeakMap<object, string>();
+let _fnCallIdSeq = 0;
+
+// Observed return values per function value: completed (non-truncated)
+// calls accumulate their results so a budget-truncated re-entry — deep
+// recursion or the re-evaluation fan-out heterogeneous union arguments
+// trigger — degrades to "what this function has actually returned" instead
+// of poisoning the caller's union with unknown. Keyed on the fn value, so
+// entries die with it; no reset hook needed.
+const _fnResultObs = new WeakMap<object, TypeValue[]>();
+const FN_RESULT_OBS_CAP = 16;
+
+function recordFnResultObs(fn: TypeValue & { kind: "function" }, value: TypeValue): void {
+  // never (always throws) and unknown carry no shape information; recording
+  // unknown would just re-poison the fallback union.
+  if (value.kind === "never" || value.kind === "unknown") return;
+  let obs = _fnResultObs.get(fn);
+  if (!obs) {
+    obs = [];
+    _fnResultObs.set(fn, obs);
+  }
+  // Cap keeps the table bounded; dedupe keeps one dominant result from
+  // exhausting the cap before a second shape is ever seen.
+  if (obs.length >= FN_RESULT_OBS_CAP) return;
+  if (obs.some((o) => typeValueEquals(o, value))) return;
+  obs.push(value);
+}
+
+function observedResultFallback(fn: TypeValue & { kind: "function" }): TypeValue | undefined {
+  const obs = _fnResultObs.get(fn);
+  if (!obs || obs.length === 0) return undefined;
+  // Union of observed results; >4 same-base literal members collapse to
+  // the base type so long observation tails stay a primitive, not a
+  // sixteen-way literal union.
+  const union = collapseLiteralUnion(simplifyUnion(obs), 4);
+  return union.kind === "never" ? undefined : union;
+}
+
+// Memoized per type value: the same argument values are keyed on every
+// call of a loop (fixture-scale structures made this the dominant cost of
+// callsite harvesting). Stale entries after in-place property mutation can
+// only trigger earlier cycle-truncation (sound: result widens to unknown),
+// never a missed one that would over-run the depth budget.
+const cycleArgKeyCache = new WeakMap<object, string>();
+
+function cycleArgKey(tv: TypeValue): string {
+  if (tv.kind === "tuple" || tv.kind === "object" || tv.kind === "union") {
+    const cached = cycleArgKeyCache.get(tv);
+    if (cached !== undefined) return cached;
+    const key = cycleArgKeyUncached(tv);
+    cycleArgKeyCache.set(tv, key);
+    return key;
+  }
+  return cycleArgKeyUncached(tv);
+}
+
+function cycleArgKeyUncached(tv: TypeValue): string {
+  if (tv.kind === "tuple") {
+    if (tv.elements.length > CYCLE_TUPLE_CAP) {
+      return `[${tv.elements.slice(0, CYCLE_TUPLE_CAP).map(cycleArgKey).join(",")},…widened]`;
+    }
+    return `[${tv.elements.map(cycleArgKey).join(",")}]`;
+  }
+  if (tv.kind === "object") {
+    const entries = Object.entries(tv.properties);
+    if (entries.length > CYCLE_PROP_CAP) {
+      return `{${entries.slice(0, CYCLE_PROP_CAP).map(([k, v]) => `${k}:${cycleArgKey(v)}`).join(",")},…widened}`;
     }
+    return `{${entries.map(([k, v]) => `${k}:${cycleArgKey(v)}`).join(",")}}`;
+  }
+  if (tv.kind === "union") {
+    return tv.members.map(cycleArgKey).join("|");
+  }
+  // Cheap leaf tokens: full typeValueToString rendering of instances and
+  // functions (method tables!) dominates key-building on fixture-scale args.
+  // A coarser token can only merge distinct states into one cycle key —
+  // earlier truncation, which widens to unknown (sound).
+  if (tv.kind === "instance") {
+    const propNames = Object.keys(tv.properties).slice(0, CYCLE_PROP_CAP).join(",");
+    return `inst(${tv.className}{${propNames}})`;
+  }
+  if (tv.kind === "function") return `fn#${objectId(tv)}`;
+  if (tv.kind === "refined") return cycleArgKey(tv.base);
+  if (tv.kind === "promise") return `prom(${cycleArgKey(tv.value)})`;
+  if (tv.kind === "literal") {
+    const s = String(tv.value);
+    return `lit(${typeof tv.value}:${s.length > 24 ? s.slice(0, 24) + "…" : s})`;
+  }
+  if (tv.kind === "primitive") return `prim(${tv.type})`;
+  return tv.kind;
+}
+
+function fnCallKey(fn: TypeValue & { kind: "function" }, args: TypeValue[], thisVal?: TypeValue): string {
+  let id = _fnCallIds.get(fn);
+  if (!id) {
+    id = `fn#${++_fnCallIdSeq}`;
+    _fnCallIds.set(fn, id);
+  }
+  const thisKey = thisVal ? `@${cycleArgKey(thisVal)}` : "";
+  return `${id}${thisKey}(${args.map(cycleArgKey).join(",")})`;
+}
+
+function callBudgetExhausted(fnName: string, loc: Node["loc"]): CallResult {
+  // kind "global" reuses the existing UnknownRecord union (the analyzer
+  // renders it as a warning-level record; no analyzer change needed).
+  recordUnknown({
+    kind: "global",
+    name: `recursion:${fnName}`,
+    loc,
+    reason: `recursive call truncated to unknown (cycle, depth > ${MAX_CALL_DEPTH}, or work budget)`,
+  });
+  return { value: T.unknown, throws: T.never };
+}
+
+function callFunctionFull(
+  fn: TypeValue & { kind: "function" },
+  args: TypeValue[],
+  thisVal?: TypeValue,
+): CallResult {
+  const callKey = fnCallKey(fn, args, thisVal);
+  const fnName = (fn as any)._name ?? "<anonymous>";
+  if (_activeCallKeys.includes(callKey) || _callDepth >= MAX_CALL_DEPTH || _totalCalls >= MAX_TOTAL_CALLS) {
+    // Diagnostic unchanged (truncation stays visible); the value degrades to
+    // this function's observed results before unknown. The truncated call
+    // shape itself stays unmemoized — this is not its true result.
+    const exhausted = callBudgetExhausted(fnName, fn.body?.loc);
+    const observed = observedResultFallback(fn);
+    return observed !== undefined ? { value: observed, throws: exhausted.throws } : exhausted;
+  }
+  _totalCalls++;
+  _callDepth++;
+  _activeCallKeys.push(callKey);
+  const fnOrigin = _fnModuleTags.get(fn);
+  _execOriginStack.push(fnOrigin ?? _execOriginStack[_execOriginStack.length - 1]);
+  try {
+    const result = callFunctionUnchecked(fn, args, thisVal);
+    recordFnResultObs(fn, result.value);
+    return result;
+  } finally {
+    _execOriginStack.pop();
+    _activeCallKeys.pop();
+    _callDepth--;
+  }
+}
+
+function callFunctionUnchecked(
+  fn: TypeValue & { kind: "function" },
+  args: TypeValue[],
+  thisVal?: TypeValue,
+): CallResult {
+  // Check for direct return value (used by sinon mocks)
+  const directReturn = (fn as any)._directReturn as TypeValue | undefined;
+  if (directReturn) {
+    return { value: directReturn, throws: T.never };
+  }
+
+  // Check for function signature impl (used by @nudo:env / @nudo:mock-module)
+  const sig = getFnSig(fn);
+  if (sig) {
+    const implResult = sig.impl?.(args, thisVal);
+    return { value: implResult ?? sig.returnType, throws: sig.throwsType };
   }
 
+  const callEnv = fn.closure.extend({});
+  // `obj.f()` binds the receiver as the callee's `this` before parameters.
+  // Arrow callees ignore it in real JS; their bodies still resolve `this`
+  // through the closure chain here — accepted approximation.
+  if (thisVal) callEnv.bind("this", thisVal);
+  const isAsync = !!(fn as any)._async;
+  bindFunctionParams(fn, args, callEnv);
+
   const savedUnreachable = _unreachableRanges;
   _unreachableRanges = [];
 
@@ -1892,8 +5064,12 @@ function callFunctionFull(fn: TypeValue & { kind: "function" }, args: TypeValue[
   return { value: wrapped, throws: T.never };
 }
 
-function callFunction(fn: TypeValue & { kind: "function" }, args: TypeValue[]): TypeValue {
-  return callFunctionFull(fn, args).value;
+function callFunction(
+  fn: TypeValue & { kind: "function" },
+  args: TypeValue[],
+  thisVal?: TypeValue,
+): TypeValue {
+  return callFunctionFull(fn, args, thisVal).value;
 }
 
 export function evaluateFunction(
@@ -1909,24 +5085,65 @@ export function evaluateFunctionFull(
   args: TypeValue[],
   env: Environment,
 ): CallResult {
-  if (fnNode.type === "FunctionDeclaration" || fnNode.type === "FunctionExpression") {
-    const callEnv = env.extend({});
-    const isAsync = !!(fnNode as any).async;
-    for (let i = 0; i < fnNode.params.length; i++) {
-      bindPattern(fnNode.params[i], args[i] ?? T.undefined, callEnv);
-    }
-    const result = evaluate(fnNode.body, callEnv);
-    if (isThrow(result)) return { value: T.never, throws: result.thrown, throwLoc: result.loc };
-    const value = isReturn(result) ? result.value
-      : isBranch(result) ? result.returnedValue
-      : result;
-    const wrapped = isAsync ? T.promise(value) : value;
-    return { value: wrapped, throws: T.never };
+  // Unwrap export declarations to get the actual function
+  let actualNode = fnNode;
+  if (fnNode.type === "ExportNamedDeclaration" && fnNode.declaration) {
+    actualNode = fnNode.declaration;
+  } else if (fnNode.type === "ExportDefaultDeclaration") {
+    actualNode = fnNode.declaration;
+  }
+
+  if (actualNode.type === "FunctionDeclaration" || actualNode.type === "FunctionExpression" || actualNode.type === "ArrowFunctionExpression") {
+    if (_callDepth >= MAX_CALL_DEPTH) {
+      return callBudgetExhausted((actualNode as any).id?.name ?? "<anonymous>", actualNode.loc);
+    }
+    _callDepth++;
+    try {
+      const callEnv = env.fork();
+      const isAsync = !!(actualNode as any).async;
+      // Named functions can reference themselves; a bare case-evaluation
+      // environment (analyzer's globalEnv normally has the binding, the
+      // directive harness does not) still needs the self-reference for
+      // recursion like `deepClone(obj[key])`.
+      const fnName = (actualNode as any).id?.name as string | undefined;
+      if (fnName) {
+        const paramNames = (actualNode.params as Node[]).map(describeParam);
+        const selfRef = T.fn(paramNames, actualNode.body, callEnv);
+        (selfRef as any)._paramPatterns = actualNode.params;
+        (selfRef as any)._name = fnName;
+        if (isAsync) (selfRef as any)._async = true;
+        callEnv.bind(fnName, selfRef);
+      }
+      for (let i = 0; i < actualNode.params.length; i++) {
+        const pname = describeParam(actualNode.params[i]!);
+        let argVal = args[i] ?? T.undefined;
+        {
+          const tagged = tagParamArg(argVal, pname);
+          copyOrigin(argVal, tagged);
+          argVal = tagged;
+        }
+        bindPattern(actualNode.params[i]!, argVal, callEnv);
+      }
+      const result = evaluate(actualNode.body, callEnv);
+      if (isThrow(result)) return { value: T.never, throws: result.thrown, throwLoc: result.loc };
+      const value = isReturn(result) ? result.value
+        : isBranch(result) ? result.returnedValue
+        : result;
+      // For async functions, unwrap Promise values to avoid double wrapping
+      const wrapped = isAsync
+        ? (value.kind === "promise" ? value : T.promise(value))
+        : value;
+      return { value: wrapped, throws: T.never };
+    } finally {
+      _callDepth--;
+    }
   }
   return { value: T.unknown, throws: T.never };
 }
 
 export function evaluateProgram(node: Node, env: Environment): TypeValue {
+  bindCommonJsGlobals(env);
+  resetPhi();
   const result = evaluate(node, env);
   if (isReturn(result)) return result.value;
   if (isBranch(result)) return result.returnedValue;