fix(javascript): converge cyclic aliases with explicit projection widening

Replace initializer-history and full-path enumeration with a finite projection
join at each source read. Retain conservative local returned-reference effects
and disclose precision loss through static, semantic and captured-web results.
Close full-binding callback cycles while preserving narrowed read semantics.

Fixes #4348
Fixes #5138
Refs #4349
Refs #4364

Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Fuxuan-CN <3072252442@qq.com>

src/application/javascript/JavaScriptSemanticGraphBuilder.ts

@@ -39,6 +39,7 @@ import {
   unknownSemanticEvidence,
 } from "./JavaScriptSemanticGraphEvidence.js";
 import {
+  RETURNED_REFERENCE_WIDENING_LIMITATION,
   semanticCoverageResourceLimits,
   semanticResourceLimitCoverage,
 } from "../../domain/javascript/javascriptSemanticCoverage.js";
@@ -555,6 +556,19 @@ function* projectFileSteps(
   if (moduleNode === null) return [];
   state.roots.add(moduleNode.node_id);
   projectFileResourceLimits({ file, ir, state, moduleNode });
+  for (const location of ir.coverage.widenedReturnedReferences ?? [])
+    addSemanticGraphUnknown(state, {
+      node_id: moduleNode.node_id,
+      family: "data-flow",
+      relation_kinds: ["defines"],
+      reason: "dynamic-property",
+      detail: RETURNED_REFERENCE_WIDENING_LIMITATION,
+      candidate_node_ids: [],
+      evidence: {
+        ...unknownSemanticEvidence(file, location),
+        limitations: [RETURNED_REFERENCE_WIDENING_LIMITATION],
+      },
+    });
   yield* projectElectronSemanticCallPaths(file, paths, state);
   // Node creation keeps source order, which the per-file node budget relies
   // on; yields between nodes do not change it.