@scriptc/compiler 0.0.17 → 0.0.19

package/dist/library/int-infer.d.ts

@@ -1,4 +1,4 @@
-import type { IrModule, IrNumBinOp, SrcLoc } from "../ir/nodes.js";
+import type { IrModule, IrNumBinOp, IrType, SrcLoc } from "../ir/nodes.js";
 export declare const SAFE_MAX: number;
 export declare const SAFE_MIN: number;
 /** The set of f64 values a binding may hold at a program point: a closed
@@ -105,6 +105,11 @@ export interface IntSlotConfig {
         path: string;
     }>>;
 }
+/** The IR representations whose PRESENT values can carry one number slot.
+ * A bare f64 is plain; a union of exactly one f64 arm and one or more
+ * null/undefined arms is optional. The abstract interpreter tracks the
+ * possible f64 arm values and treats unit arms as the empty numeric set. */
+export declare function numberCarrierKind(t: IrType, mod: IrModule): "plain" | "optional" | null;
 export declare function hasIntSlots(cfg: IntSlotConfig): boolean;
 /** The class seed for a declared parameter: what the slot's own contract
  * proves about every value that ever arrives through it (internal calls

package/dist/library/int-infer.js

@@ -284,6 +284,30 @@ export function checkBoundary(v, path, cls, loc) {
     }
     return { path, cls, loc, outcome: "prove", provenLo: v.lo, provenHi: v.hi };
 }
+/** The IR representations whose PRESENT values can carry one number slot.
+ * A bare f64 is plain; a union of exactly one f64 arm and one or more
+ * null/undefined arms is optional. The abstract interpreter tracks the
+ * possible f64 arm values and treats unit arms as the empty numeric set. */
+export function numberCarrierKind(t, mod) {
+    if (t.kind === "f64")
+        return "plain";
+    if (t.kind !== "union")
+        return null;
+    const def = mod.unions?.find((u) => u.id === t.unionId);
+    if (def === undefined)
+        return null;
+    let numbers = 0;
+    let units = 0;
+    for (const arm of def.arms) {
+        if (arm.kind === "f64")
+            numbers++;
+        else if (arm.kind === "nullT" || arm.kind === "undefinedT")
+            units++;
+        else
+            return null;
+    }
+    return numbers === 1 && units > 0 ? "optional" : null;
+}
 export function hasIntSlots(cfg) {
     if (cfg.records.size > 0)
         return true;
@@ -307,8 +331,33 @@ export function classSeed(cls) {
         default: return { ...TOP };
     }
 }
+/** Static-access facts share Env's join/clone machinery but have their own
+ * missing-key value: the declared slot seed. A killed field fact therefore
+ * falls back to the same whole-in-class-range assumption a field read had
+ * before access-path refinement, preserving SC4023 rather than degrading
+ * to a spurious SC4022. */
+const PATH_I64_PREFIX = "%path.i64:";
+const PATH_U64_PREFIX = "%path.u64:";
+function pathClassOfKey(id) {
+    if (id.startsWith(PATH_I64_PREFIX))
+        return "i64";
+    if (id.startsWith(PATH_U64_PREFIX))
+        return "u64";
+    return null;
+}
+function clearPathFacts(env) {
+    for (const k of [...env.keys()]) {
+        if (pathClassOfKey(k) !== null)
+            env.delete(k);
+    }
+}
 const isGlobalId = (id) => id.startsWith("%g.");
-const defaultVal = (id) => (isGlobalId(id) ? TOP : BOTTOM);
+const defaultVal = (id) => {
+    const pathClass = pathClassOfKey(id);
+    if (pathClass !== null)
+        return classSeed(pathClass);
+    return isGlobalId(id) ? TOP : BOTTOM;
+};
 function envGet(env, id) {
     return env.get(id) ?? defaultVal(id);
 }
@@ -322,6 +371,10 @@ function joinEnv(a, b) {
     for (const k of keys) {
         out.set(k, join(a.get(k) ?? defaultVal(k), b.get(k) ?? defaultVal(k)));
     }
+    // A real flow join ends the cheap straight-line access-path proof even
+    // when both incoming facts happen to agree. A sole reachable edge
+    // (early return/throw on the other edge) retains its dominated fact.
+    clearPathFacts(out);
     return out;
 }
 function envEquals(a, b) {
@@ -338,6 +391,7 @@ function widenEnv(prev, next) {
     for (const k of keys) {
         out.set(k, widen(prev.get(k) ?? defaultVal(k), next.get(k) ?? defaultVal(k)));
     }
+    clearPathFacts(out);
     return out;
 }
 function globalEffectsOf(mod) {
@@ -553,7 +607,7 @@ class FnAnalyzer {
         const env = new Map();
         const slots = this.cfg.fns.get(fn.name);
         fn.params.forEach((p, i) => {
-            if (p.type.kind !== "f64")
+            if (!this.bindingCarriesNumber(p.localId))
                 return;
             const declared = slots?.params[i] ?? null;
             const seed = slots?.paramSeeds[i] ?? null;
@@ -589,13 +643,15 @@ class FnAnalyzer {
                 if (s.init === null)
                     return env;
                 const v = this.evalExpr(s.init, env);
-                if (this.bindingIsF64(s.localId))
+                this.clearPathsRootedAt(env, s.localId);
+                if (this.bindingCarriesNumber(s.localId))
                     env.set(s.localId, v);
                 return env;
             }
             case "assign": {
                 const v = this.evalExpr(s.value, env);
-                if (this.bindingIsF64(s.localId))
+                this.clearPathsRootedAt(env, s.localId);
+                if (this.bindingCarriesNumber(s.localId))
                     env.set(s.localId, v);
                 return env;
             }
@@ -604,8 +660,9 @@ class FnAnalyzer {
                 return env;
             case "if": {
                 this.evalExpr(s.cond, env);
-                const thenEnv = this.refine(cloneEnv(env), s.cond, true);
-                const elseEnv = this.refine(cloneEnv(env), s.cond, false);
+                const allowPaths = this.stablePathGuard(s.cond);
+                const thenEnv = this.refine(cloneEnv(env), s.cond, true, allowPaths);
+                const elseEnv = this.refine(cloneEnv(env), s.cond, false, allowPaths);
                 const a = thenEnv === null ? null : this.execStmts(s.then, thenEnv);
                 const b = s.else_ === null ? elseEnv : elseEnv === null ? null : this.execStmts(s.else_, elseEnv);
                 return joinEnv(a, b);
@@ -629,7 +686,7 @@ class FnAnalyzer {
                 return this.execLoop(env, { cond: s.cond, body: s.body, labels: s.labels ?? [], doWhile: true });
             case "forOf": {
                 this.evalExpr(s.iterable, env);
-                const elemF64 = this.bindingIsF64(s.localId);
+                const elemF64 = this.bindingCarriesNumber(s.localId);
                 return this.execLoop(env, {
                     body: s.body,
                     labels: s.labels ?? [],
@@ -668,10 +725,12 @@ class FnAnalyzer {
                 this.evalExpr(s.arr, env);
                 this.evalExpr(s.index, env);
                 this.evalExpr(s.value, env);
+                clearPathFacts(env);
                 return env;
             case "fieldSet":
                 this.evalExpr(s.obj, env);
                 this.evalExpr(s.value, env);
+                clearPathFacts(env);
                 return env;
             case "recordSet": {
                 this.evalExpr(s.obj, env);
@@ -679,16 +738,33 @@ class FnAnalyzer {
                 const slot = this.cfg.records.get(s.shapeId)?.get(s.field);
                 if (slot !== undefined)
                     this.emit(v, slot.path, slot.cls, s.loc);
+                // The RHS and its boundary obligation observe the pre-write value;
+                // only the completed heap write invalidates paths (JS evaluation
+                // order, and what lets `m.count = m.count + 1` prove).
+                clearPathFacts(env);
                 return env;
             }
-            case "recordKeySet":
+            case "recordKeySet": {
                 this.evalExpr(s.obj, env);
                 this.evalExpr(s.key, env);
-                this.evalExpr(s.value, env);
+                const v = this.evalExpr(s.value, env);
+                // A runtime key can dispatch to any declared field of the shape.
+                // overflowOnly proves a literal key names no declared field; every
+                // other keyed write must therefore discharge every integer slot it
+                // could select. Multiple classified fields intentionally emit
+                // independent obligations (their classes and paths may differ).
+                if (s.overflowOnly !== true) {
+                    for (const slot of this.cfg.records.get(s.shapeId)?.values() ?? []) {
+                        this.emit(v, slot.path, slot.cls, s.loc);
+                    }
+                }
+                clearPathFacts(env);
                 return env;
+            }
             case "recordKeyDelete":
                 this.evalExpr(s.obj, env);
                 this.evalExpr(s.key, env);
+                clearPathFacts(env);
                 return env;
             case "return": {
                 if (s.value !== null) {
@@ -820,7 +896,7 @@ class FnAnalyzer {
         };
         tryBody.forEach(visitStmt);
         for (const id of assigned) {
-            if (this.bindingIsF64(id))
+            if (this.bindingCarriesNumber(id))
                 out.set(id, { ...TOP });
         }
         // Globals: any callee may have written before the throw.
@@ -828,10 +904,14 @@ class FnAnalyzer {
             if (isGlobalId(k))
                 out.delete(k); // absent global = TOP
         }
+        clearPathFacts(out);
         return out;
     }
     /* ── loops: header widening + body-edge refinement ──────────────────── */
     execLoop(env, opts) {
+        // Loop headers/backedges are outside the deliberately straight-line
+        // access-path scope. Guards inside the body can establish fresh facts.
+        clearPathFacts(env);
         const savedCollect = this.collect;
         this.collect = false;
         let head = cloneEnv(env);
@@ -870,10 +950,10 @@ class FnAnalyzer {
         // (`for (;;)`) exits only through breaks.
         let exit = null;
         if (opts.doWhile ?? false) {
-            exit = opts.cond !== undefined && final.postBody !== null ? this.refine(final.postBody, opts.cond, false) : null;
+            exit = opts.cond !== undefined && final.postBody !== null ? this.refine(final.postBody, opts.cond, false, false) : null;
         }
         else if (opts.cond !== undefined) {
-            exit = this.refine(cloneEnv(head), opts.cond, false);
+            exit = this.refine(cloneEnv(head), opts.cond, false, false);
         }
         else if (opts.alwaysExits ?? false) {
             exit = cloneEnv(head); // for-of ends when the array runs out
@@ -894,7 +974,7 @@ class FnAnalyzer {
         let bodyIn = cloneEnv(head);
         if (opts.cond !== undefined && !(opts.doWhile ?? false)) {
             this.evalExpr(opts.cond, bodyIn);
-            bodyIn = this.refine(bodyIn, opts.cond, true);
+            bodyIn = this.refine(bodyIn, opts.cond, true, false);
         }
         if (bodyIn !== null && opts.seedEachIteration !== undefined) {
             bodyIn.set(opts.seedEachIteration, { ...TOP });
@@ -915,7 +995,7 @@ class FnAnalyzer {
         if ((opts.doWhile ?? false) && opts.cond !== undefined && out !== null) {
             this.evalExpr(opts.cond, out);
             postBody = cloneEnv(out);
-            out = this.refine(out, opts.cond, true);
+            out = this.refine(out, opts.cond, true, false);
         }
         return { back: out, postBody };
     }
@@ -925,7 +1005,7 @@ class FnAnalyzer {
      * false when either side is NaN, so the edge where one HELD proves both
      * operands NaN-free; on the failed edge NaN survives while the negated
      * comparison still refines the numeric members. */
-    refine(env, cond, branch) {
+    refine(env, cond, branch, allowPaths = false) {
         if (env === null)
             return null;
         switch (cond.kind) {
@@ -933,19 +1013,39 @@ class FnAnalyzer {
                 return cond.value === branch ? env : null;
             case "unary":
                 if (cond.op === "!")
-                    return this.refine(env, cond.operand, !branch);
+                    return this.refine(env, cond.operand, !branch, allowPaths);
                 return env;
             case "logical": {
                 const isAnd = cond.op === "&&";
                 if (isAnd === branch) {
                     // (a && b) true  — both held; (a || b) false — both failed.
-                    return this.refine(this.refine(env, cond.left, branch), cond.right, branch);
+                    return this.refine(this.refine(env, cond.left, branch, allowPaths), cond.right, branch, allowPaths);
                 }
                 // (a && b) false — a failed, or a held and b failed; dually for ||.
-                const viaLeft = this.refine(cloneEnv(env), cond.left, branch);
-                const viaRight = this.refine(this.refine(cloneEnv(env), cond.left, !branch), cond.right, branch);
+                const viaLeft = this.refine(cloneEnv(env), cond.left, branch, allowPaths);
+                const viaRight = this.refine(this.refine(cloneEnv(env), cond.left, !branch, allowPaths), cond.right, branch, allowPaths);
                 return joinEnv(viaLeft, viaRight);
             }
+            case "unionIsTag": {
+                const unionType = { kind: "union", unionId: cond.unionId };
+                if (numberCarrierKind(unionType, this.mod) !== "optional")
+                    return env;
+                const def = this.mod.unions?.find((u) => u.id === cond.unionId);
+                const arm = def?.arms[cond.tag];
+                const key = this.refinementKey(cond.value, allowPaths);
+                if (arm === undefined || key === null)
+                    return env;
+                const tagMatches = cond.negated ? !branch : branch;
+                // The abstract value describes only PRESENT f64 inhabitants. A
+                // branch selecting a unit arm has no numeric inhabitants; likewise
+                // a branch excluding the optional carrier's sole f64 arm.
+                if ((tagMatches && arm.kind !== "f64") || (!tagMatches && arm.kind === "f64")) {
+                    const out = cloneEnv(env);
+                    out.set(key, { ...BOTTOM });
+                    return out;
+                }
+                return env;
+            }
             case "bin": {
                 if (!CMP_OPS.has(cond.op))
                     return env;
@@ -961,17 +1061,22 @@ class FnAnalyzer {
                 const a = this.evalPure(cond.left, env);
                 const b = this.evalPure(cond.right, env);
                 const out = cloneEnv(env);
-                if (cond.left.kind === "varRef")
-                    out.set(cond.left.localId, refineLhs(op, a, b, clearNaN));
-                if (cond.right.kind === "varRef")
-                    out.set(cond.right.localId, refineLhs(FLIP[op], b, a, clearNaN));
+                const leftKey = this.refinementKey(cond.left, allowPaths);
+                const rightKey = this.refinementKey(cond.right, allowPaths);
+                if (leftKey !== null)
+                    out.set(leftKey, refineLhs(op, a, b, clearNaN));
+                if (rightKey !== null)
+                    out.set(rightKey, refineLhs(FLIP[op], b, a, clearNaN));
                 return out;
             }
             case "toBool": {
                 const inner = cond.operand;
-                if (inner.type.kind !== "f64" || inner.kind !== "varRef" || !this.isPure(inner))
+                if (inner.type.kind !== "f64" || !this.isPure(inner))
+                    return env;
+                const key = this.refinementKey(inner, allowPaths);
+                if (key === null)
                     return env;
-                const v = envGet(env, inner.localId);
+                const v = this.evalPure(inner, env);
                 const out = cloneEnv(env);
                 if (branch) {
                     // Truthy: not NaN, not zero — endpoint exclusion when whole.
@@ -980,11 +1085,11 @@ class FnAnalyzer {
                         r = absVal(1, r.hi, r.whole, false, r.spelling);
                     else if (r.whole && r.hi === 0 && r.lo <= -1)
                         r = absVal(r.lo, -1, r.whole, false, r.spelling);
-                    out.set(inner.localId, r);
+                    out.set(key, r);
                 }
                 else {
                     // Falsy: 0, -0, or NaN.
-                    out.set(inner.localId, meetInterval(v, 0, 0, false));
+                    out.set(key, meetInterval(v, 0, 0, false));
                 }
                 return out;
             }
@@ -1019,11 +1124,21 @@ class FnAnalyzer {
             case "boolLit":
             case "varRef":
             case "unitLit":
+            case "selfRef":
                 return true;
+            case "recordGet":
+            case "fieldGet":
+                return this.staticAccessPath(e) !== null;
+            case "unionNarrow":
+                return this.isPure(e.value);
             case "bin":
                 return this.isPure(e.left) && this.isPure(e.right);
             case "unary":
                 return this.isPure(e.operand);
+            case "logical":
+                return this.isPure(e.left) && this.isPure(e.right);
+            case "toBool":
+                return this.isPure(e.operand);
             default:
                 return false;
         }
@@ -1034,7 +1149,18 @@ class FnAnalyzer {
             case "numLit":
                 return constVal(e.value, e.spelling);
             case "varRef":
-                return e.type.kind === "f64" ? envGet(env, e.localId) : { ...TOP };
+                return this.bindingCarriesNumber(e.localId) ? envGet(env, e.localId) : { ...TOP };
+            case "recordGet": {
+                const slot = this.cfg.records.get(e.shapeId)?.get(e.field);
+                if (slot === undefined || numberCarrierKind(e.type, this.mod) === null)
+                    return { ...TOP };
+                const key = this.pathKey(e, slot.cls);
+                return key === null ? classSeed(slot.cls) : envGet(env, key);
+            }
+            case "unionNarrow":
+                return e.type.kind === "f64" && numberCarrierKind(e.value.type, this.mod) === "optional"
+                    ? this.evalPure(e.value, env)
+                    : { ...TOP };
             case "unary":
                 if (e.op === "-")
                     return transferNeg(this.evalPure(e.operand, env));
@@ -1049,6 +1175,91 @@ class FnAnalyzer {
                 return { ...TOP };
         }
     }
+    /** A canonical static data path. Source spellings that lower to the same
+     * IR access (`m.total`, `m["total"]`) intentionally share a key; distinct
+     * receiver bindings never do. Accessors/dynamic keys/computed receivers
+     * have different IR nodes and are excluded. */
+    staticAccessPath(e) {
+        switch (e.kind) {
+            case "varRef":
+                return { rootId: e.localId, steps: [["var", e.localId]] };
+            case "selfRef":
+                return { rootId: null, steps: [["self"]] };
+            case "recordGet": {
+                const base = this.staticAccessPath(e.obj);
+                if (base === null)
+                    return null;
+                return { rootId: base.rootId, steps: [...base.steps, ["record", e.shapeId, e.field]] };
+            }
+            case "unionNarrow":
+                return this.staticAccessPath(e.value);
+            case "fieldGet": {
+                const base = this.staticAccessPath(e.obj);
+                if (base === null)
+                    return null;
+                return { rootId: base.rootId, steps: [...base.steps, ["field", e.className, e.field]] };
+            }
+            default:
+                return null;
+        }
+    }
+    pathRoots = new Map();
+    pathKey(e, cls) {
+        const path = this.staticAccessPath(e);
+        if (path === null)
+            return null;
+        const prefix = cls === "i64" ? PATH_I64_PREFIX : PATH_U64_PREFIX;
+        const key = `${prefix}${JSON.stringify(path.steps)}`;
+        this.pathRoots.set(key, path.rootId);
+        return key;
+    }
+    refinementKey(e, allowPaths) {
+        if (e.kind === "varRef")
+            return e.localId;
+        if (e.kind === "unionNarrow" && e.type.kind === "f64") {
+            return this.refinementKey(e.value, allowPaths);
+        }
+        if (!allowPaths || e.kind !== "recordGet" || numberCarrierKind(e.type, this.mod) === null)
+            return null;
+        const slot = this.cfg.records.get(e.shapeId)?.get(e.field);
+        return slot === undefined ? null : this.pathKey(e, slot.cls);
+    }
+    /** Path facts are admitted only when the entire guard is synchronous,
+     * call-free, assignment-free static data access. This prevents a later
+     * subexpression from mutating a field and `refine` subsequently
+     * reconstructing a stale fact from the guard syntax. */
+    stablePathGuard(e) {
+        switch (e.kind) {
+            case "numLit":
+            case "strLit":
+            case "boolLit":
+            case "unitLit":
+            case "varRef":
+            case "selfRef":
+                return true;
+            case "recordGet":
+            case "fieldGet":
+                return this.staticAccessPath(e) !== null;
+            case "unionIsTag":
+                return this.stablePathGuard(e.value);
+            case "unionNarrow":
+                return this.stablePathGuard(e.value);
+            case "bin":
+            case "logical":
+                return this.stablePathGuard(e.left) && this.stablePathGuard(e.right);
+            case "unary":
+            case "toBool":
+                return this.stablePathGuard(e.operand);
+            default:
+                return false;
+        }
+    }
+    clearPathsRootedAt(env, localId) {
+        for (const k of [...env.keys()]) {
+            if (pathClassOfKey(k) !== null && this.pathRoots.get(k) === localId)
+                env.delete(k);
+        }
+    }
     /* ── expression evaluation (side effects applied to env) ────────────── */
     evalMath(e, env, mutate) {
         const arg = (i) => (mutate ? this.evalExpr(e.args[i], env) : this.evalPure(e.args[i], env));
@@ -1064,18 +1275,20 @@ class FnAnalyzer {
             default: return null;
         }
     }
-    bindingIsF64(id) {
-        return this.f64Bindings.has(id);
+    bindingCarriesNumber(id) {
+        return this.numberBindings.has(id);
     }
-    f64Bindings = new Set();
+    numberBindings = new Set();
     seedBindings(fn, mod) {
-        this.f64Bindings = new Set();
-        for (const l of fn.locals)
-            if (l.type.kind === "f64" && l.boxed !== true)
-                this.f64Bindings.add(l.id);
-        for (const g of mod.globals ?? [])
-            if (g.type.kind === "f64")
-                this.f64Bindings.add(g.id);
+        this.numberBindings = new Set();
+        for (const l of fn.locals) {
+            if (numberCarrierKind(l.type, mod) !== null && l.boxed !== true)
+                this.numberBindings.add(l.id);
+        }
+        for (const g of mod.globals ?? []) {
+            if (numberCarrierKind(g.type, mod) !== null)
+                this.numberBindings.add(g.id);
+        }
     }
     /** Evaluate an expression over the environment, applying the side
      * effects of nested writes and calls (a call havocs the globals its
@@ -1096,7 +1309,7 @@ class FnAnalyzer {
             case "chainRecv":
                 return { ...TOP };
             case "varRef":
-                return e.type.kind === "f64" && this.bindingIsF64(e.localId) ? envGet(env, e.localId) : { ...TOP };
+                return this.bindingCarriesNumber(e.localId) ? envGet(env, e.localId) : { ...TOP };
             case "bin": {
                 const a = this.evalExpr(e.left, env);
                 const b = this.evalExpr(e.right, env);
@@ -1115,22 +1328,24 @@ class FnAnalyzer {
                 return { ...TOP };
             }
             case "incDec": {
-                const old = this.bindingIsF64(e.localId) ? envGet(env, e.localId) : { ...TOP };
+                const old = this.bindingCarriesNumber(e.localId) ? envGet(env, e.localId) : { ...TOP };
                 const next = transferAdd(old, constVal(e.op === "+" ? 1 : -1));
-                if (this.bindingIsF64(e.localId))
+                if (this.bindingCarriesNumber(e.localId))
                     env.set(e.localId, next);
                 return e.prefix ? next : old;
             }
             case "assignExpr": {
                 const v = this.evalExpr(e.value, env);
-                if (this.bindingIsF64(e.localId))
+                this.clearPathsRootedAt(env, e.localId);
+                if (this.bindingCarriesNumber(e.localId))
                     env.set(e.localId, v);
                 return v;
             }
             case "ternary": {
                 this.evalExpr(e.cond, env);
-                const thenEnv = this.refine(cloneEnv(env), e.cond, true);
-                const elseEnv = this.refine(cloneEnv(env), e.cond, false);
+                const allowPaths = this.stablePathGuard(e.cond);
+                const thenEnv = this.refine(cloneEnv(env), e.cond, true, allowPaths);
+                const elseEnv = this.refine(cloneEnv(env), e.cond, false, allowPaths);
                 const a = thenEnv === null ? BOTTOM : this.evalExpr(e.then, thenEnv);
                 const b = elseEnv === null ? BOTTOM : this.evalExpr(e.else_, elseEnv);
                 mergeInto(env, joinEnv(thenEnv, elseEnv));
@@ -1139,18 +1354,18 @@ class FnAnalyzer {
             case "logical":
             case "nullish":
             case "orDefault": {
-                this.evalExpr(e.left, env);
+                const left = this.evalExpr(e.left, env);
                 const rightEnv = cloneEnv(env);
-                this.evalExpr(e.right, rightEnv);
+                const right = this.evalExpr(e.right, rightEnv);
                 mergeInto(env, joinEnv(env, rightEnv));
-                return { ...TOP };
+                return numberCarrierKind(e.type, this.mod) !== null ? join(left, right) : { ...TOP };
             }
             case "optChain": {
                 this.evalExpr(e.receiver, env);
                 const bodyEnv = cloneEnv(env);
-                this.evalExpr(e.body, bodyEnv);
+                const body = this.evalExpr(e.body, bodyEnv);
                 mergeInto(env, joinEnv(env, bodyEnv));
-                return { ...TOP };
+                return numberCarrierKind(e.type, this.mod) !== null ? body : { ...TOP };
             }
             case "seqExpr": {
                 // Expression-position statements: no jumps can escape them.
@@ -1185,14 +1400,31 @@ class FnAnalyzer {
                     return classSeed(slots.ret);
                 return { ...TOP };
             }
+            case "unionWrap": {
+                const value = this.evalExpr(e.value, env);
+                if (numberCarrierKind(e.type, this.mod) !== "optional")
+                    return { ...TOP };
+                // Unit arms are absence, not an integer crossing. The one f64 arm
+                // contributes its abstract value unchanged.
+                return e.value.type.kind === "f64" ? value : BOTTOM;
+            }
+            case "unionNarrow": {
+                const value = this.evalExpr(e.value, env);
+                return e.type.kind === "f64" && numberCarrierKind(e.value.type, this.mod) === "optional"
+                    ? value
+                    : { ...TOP };
+            }
             case "libCall": {
                 const math = this.evalMath(e, env, true);
-                if (math !== null)
+                if (math !== null) {
+                    clearPathFacts(env);
                     return math;
+                }
                 for (const a of e.args)
                     this.evalExpr(a, env);
                 if (e.args.some((a) => typeContainsFunc(a.type)))
                     this.havocAllGlobals(env);
+                clearPathFacts(env);
                 return { ...TOP };
             }
             case "callValue":
@@ -1207,13 +1439,23 @@ class FnAnalyzer {
                 this.havocAllGlobals(env);
                 return { ...TOP };
             }
+            case "ffiCall":
+            case "yieldExpr":
+            case "awaitExpr":
+            case "awaitUnionExpr": {
+                for (const v of childExprs(e))
+                    this.evalExpr(v, env);
+                clearPathFacts(env);
+                return { ...TOP };
+            }
             case "recordLit": {
                 const slotMap = this.cfg.records.get(e.type.shapeId);
                 for (const f of e.fields) {
                     const v = this.evalExpr(f.value, env);
                     const slot = slotMap?.get(f.name);
-                    if (slot !== undefined && f.value.type.kind === "f64")
+                    if (slot !== undefined && numberCarrierKind(f.value.type, this.mod) !== null) {
                         this.emit(v, slot.path, slot.cls, f.value.loc);
+                    }
                 }
                 return { ...TOP };
             }
@@ -1226,18 +1468,28 @@ class FnAnalyzer {
                 // — instead of a spurious may-be-NaN wholeness refusal).
                 this.evalExpr(e.obj, env);
                 const slot = this.cfg.records.get(e.shapeId)?.get(e.field);
-                if (slot !== undefined && e.type.kind === "f64")
-                    return classSeed(slot.cls);
+                if (slot !== undefined && numberCarrierKind(e.type, this.mod) !== null) {
+                    const key = this.pathKey(e, slot.cls);
+                    return key === null ? classSeed(slot.cls) : envGet(env, key);
+                }
                 return { ...TOP };
             }
+            case "fieldGet":
+                this.evalExpr(e.obj, env);
+                return { ...TOP };
             default: {
                 for (const v of childExprs(e))
                     this.evalExpr(v, env);
+                // Unmodeled expressions do not participate in the cheap
+                // straight-line proof. Some can invoke runtime/user machinery;
+                // refusing to carry a field fact through them is the safe verdict.
+                clearPathFacts(env);
                 return { ...TOP };
             }
         }
     }
     havocCall(callee, env) {
+        clearPathFacts(env);
         if (this.effects.havocAll.has(callee) || !this.effects.perFn.has(callee)) {
             this.havocAllGlobals(env);
             return;
@@ -1246,6 +1498,7 @@ class FnAnalyzer {
             env.delete(g); // absent global = TOP
     }
     havocAllGlobals(env) {
+        clearPathFacts(env);
         for (const k of [...env.keys()]) {
             if (isGlobalId(k))
                 env.delete(k);