fix(javascript): preserve builtin identity and share alias traversal

Track module writes and escapes at their owner, preserve capture and reassignment ordering, and share CommonJS/default namespace identity without erasing parent-slot changes. Carry write sites into ambient alias resolution and use parsed write targets across consumers. Deduplicate returned-reference work with cycle context; retain unchanged temporal selection identity so provenance memoization stays effective.

Reviewed fixes include #2041, #2465, #2830, #2881, and #2948. Remove superseded mutation representations and the ineffective per-markValue dedup layer.

Validation: 380 focused JavaScript tests passed under a 384 MiB heap cap, including the previously aborting 30-level/128-call alias regression. Six public CLI/MCP builtin tests passed. Exact pdf.js completed-workflow performance remains unmeasured.

src/domain/javascript/javascriptSemanticAmbientWrites.ts

@@ -16,6 +16,7 @@ import {
   type JavaScriptSemanticAnalysisState,
 } from "./javascriptSemanticState.js";
 import { isImportMetaUrl } from "./javascriptStaticAnalysisHelpers.js";
+import { semanticMutationInitializers } from "./javascriptSemanticMutationInitializers.js";
 
 const GLOBAL_OBJECT_NAMES = ["globalThis", "global", "window", "self"];
 
@@ -51,8 +52,8 @@ const createAmbientPathResolver = (
   possibleWrites: boolean,
 ) => {
   const cached = new WeakMap<t.Node, readonly AmbientPath[]>();
-  return (node: t.Node): readonly AmbientPath[] => {
-    const prior = cached.get(node);
+  return (node: t.Node, capture?: t.Node): readonly AmbientPath[] => {
+    const prior = possibleWrites ? undefined : cached.get(node);
     if (prior !== undefined) return prior;
     const result = new Map<string, AmbientPath>();
     const pending: { node: t.Node; suffix: AmbientProjection }[] = [
@@ -126,7 +127,13 @@ const createAmbientPathResolver = (
         if (binding === undefined) continue;
         const stable = semanticStableInitializer(binding, state);
         const initializers = possibleWrites
-          ? binding.initializers
+          ? capture === undefined
+            ? binding.initializers
+            : semanticMutationInitializers(
+                binding,
+                capture,
+                state.parentsByNode,
+              ).initializers
           : stable === undefined
             ? []
             : [stable];
@@ -221,7 +228,7 @@ const createAmbientPathResolver = (
       }
     }
     const paths = [...result.values()];
-    cached.set(node, paths);
+    if (!possibleWrites) cached.set(node, paths);
     return paths;
   };
 };
@@ -248,7 +255,7 @@ export function* indexJavaScriptAmbientWritesSteps(
   });
   yield* collectJavaScriptIdentityWritesSteps(
     program,
-    (root, kind) => {
+    (root, kind, writeSite) => {
       if (kind === "opaque-call") return [];
       // Reassigning a local alias changes the binding, not the referenced object.
       if (kind === "binding")
@@ -256,13 +263,14 @@ export function* indexJavaScriptAmbientWritesSteps(
           isUnshadowedGlobal(root, state, root.name)
           ? [["global", root.name]]
           : [];
-      return ambientWrites(root);
+      return ambientWrites(root, writeSite);
     },
     interop.intrinsicInvocation,
     interop.staticString,
     interop.isFreshObject,
-    (_node, path) => {
+    (node, path) => {
       state.ambientWrites.retain(path);
+      state.ambientWriteEffects.push({ path, node });
     },
   );
 }