diff --git a/.changeset/feat-cfg-formal-verification-stack.md b/.changeset/feat-cfg-formal-verification-stack.md
new file mode 100644
index 000000000..ee651e51e
--- /dev/null
+++ b/.changeset/feat-cfg-formal-verification-stack.md
@@ -0,0 +1,17 @@
+---
+"oxlint-plugin-react-doctor": patch
+---
+
+Add a formal-verification stack to the control-flow graph and three path-sensitive rules.
+
+`@react-doctor/cfg` gains four layers on top of its CFG/SSA engine, all pure-TS, bundled at build time, lazy (a rule that never reads a layer pays nothing), and run once per scan:
+
+- **Dataflow framework** — `solveDataflow`, a generic monotone worklist fixpoint over a `Lattice<Fact>` (one solver subsumes many analyses), and `analyzeDefiniteAssignment` built on it: a forward must-analysis over the SSA occurrence stream answering _is this read reached unassigned on some path?_ (a `declare` like `let x;` is neither read nor write, so a bare declaration never counts as an assignment).
+- **Typestate engine** — `verifyTypestate(cfg, { automaton, classifier })` generalizes resource-protocol checking into a reusable automaton verified over the CFG, reporting error transitions (an illegal event) and leaked resources (a resource left non-accepting on a normal-completion path). Events are attributed to their real block and deduplicated, so the whole-body implicit-return never double-counts a call.
+- **Path feasibility** — a bounded, dependency-free checker (`isPathFeasible` + `lowerGuard` / `pathConditionFacts`) that lowers a path's branch guards into facts over SSA values and refutes correlated-branch counterexamples via union-find congruence closure. It only ever _suppresses_ a diagnostic when the path search is complete and every counterexample is provably infeasible (e.g. `if (x) open(); … if (x) close();`), so it strictly removes false positives and is never unsound for bug-finding.
+
+Three new rules consume them:
+
+- `correctness/no-use-before-define` — a block-scoped binding (`let` / `const` / `class` / `using`) used lexically before its declaration runs, in the same synchronous execution, which always throws a `ReferenceError` from the Temporal Dead Zone. Sound by construction: quiet for hoisted `var` / function declarations, params, globals, and any access nested in a closure or class body that may run after the declaration. A declared-but-unassigned `let` read (`let x; if (c) x = 1; use(x)`) is `undefined`, not a TDZ crash, so it is deliberately not reported.
+- `state-and-effects/no-stale-closure-capture` — a `useMemo` / `useCallback` closure that captures a `let` binding reassigned later in the same render, so the memoised value/function sees a stale value (the deps array signals the author intended the value at creation time). Quiet for `const` and bindings never reassigned after capture, and for the deferred effect hooks (`useEffect` / `useLayoutEffect`), whose callbacks run after render where reading the binding's final value is the intended pattern, not a stale capture.
+- `state-and-effects/no-unreleased-resource` — a resource opened inside a React effect callback (timer, subscription, event listener, `AbortController`) and released INLINE on some paths but leaked on an early return. Scoped to `useEffect` / `useLayoutEffect` / `useInsertionEffect` (including the namespaced `React.useEffect` form): the returned-cleanup contract stays owned by `effect-cleanup-not-on-every-path`, a `finally`-based release counts as run-on-every-path, and non-effect functions (class lifecycle methods, non-React frameworks like Solid's `createEffect`/`onCleanup`) are left alone.
diff --git a/.changeset/feat-cfg-native-ssa.md b/.changeset/feat-cfg-native-ssa.md
new file mode 100644
index 000000000..556816308
--- /dev/null
+++ b/.changeset/feat-cfg-native-ssa.md
@@ -0,0 +1,9 @@
+---
+"oxlint-plugin-react-doctor": patch
+---
+
+Add native SSA to the control-flow graph and a path-sensitive dead-assignment rule.
+
+`@react-doctor/cfg` now builds variable-level **static single assignment** form over its oxc-native CFG via the Braun, Buchwald, Hack et al. (2013) on-the-fly sealed-block algorithm — the same algorithm the React Compiler's `EnterSSA` implements — followed by their redundant-φ elimination pass. It is a clean-room port (no Babel, MIT attribution): a minimal value model (`SsaIdentifier` / `Place` / `Phi`), per-instruction read/write extraction, a self-contained lexical binding resolver with an injectable seam (the plugin feeds in its own scope analyzer's binding identities), and an `analyzeSsa` query API (`versionAt`, `reachingDefinition`, `isLiveValue`, `isRedefinedBetween`, `bindingOf`, per-function φ + def blocks). The parity suite asserts the Braun φ placement equals the iterated dominance frontier of each binding's definitions (Cytron et al.), and `toDot` renders φ-functions.
+
+New `no-dead-assignment` rule uses it: it flags a write to a reassignable local whose value is never read because every path overwrites it first (`let total = expensive(); total = cheap(); return total;`). This is a value-flow question pure control flow can't answer — it complements `no-unused-vars` (which only sees wholly-unused bindings) and stays quiet for `const`, compound assignments, closure-captured bindings, and any write whose value is read on some path.
diff --git a/.changeset/feat-cfg-structural-parity.md b/.changeset/feat-cfg-structural-parity.md
new file mode 100644
index 000000000..5d7a9dbd7
--- /dev/null
+++ b/.changeset/feat-cfg-structural-parity.md
@@ -0,0 +1,7 @@
+---
+"oxlint-plugin-react-doctor": patch
+---
+
+Upgrade `@react-doctor/cfg` to a full structural control-flow graph.
+
+Each basic block is now a typed instruction list ending in a first-class `Terminal` modeled on the React Compiler HIR taxonomy (`goto` / `if` / `switch` / loops / `logical` / `ternary` / `optional` / `try` / `return` / `throw`), with `fallthrough` join blocks and explicit `goto` lowering of `break` / `continue`. Dominance now uses the Cooper–Harvey–Kennedy immediate-dominator tree over reverse-postorder (plus the Cytron dominance frontier as the SSA seam). New analysis surface: `dominanceFrontier`, `isInfiniteLoopStart` (oxc-parity constant folding), and a Graphviz `toDot` export. The builder is split into `ir/` + `build/` + `analysis/` modules, and curated parity corpora from oxc (`no-fallthrough`, `no-unsafe-finally`, `getter-return`), ESLint code-path analysis, and React Compiler `BuildHIR` are ported as tests. The published plugin behavior is unchanged (all rule tests pass); this is an internal engine upgrade bundled at build time.
diff --git a/.changeset/feat-cfg-verifier-rules.md b/.changeset/feat-cfg-verifier-rules.md
new file mode 100644
index 000000000..73bf429c5
--- /dev/null
+++ b/.changeset/feat-cfg-verifier-rules.md
@@ -0,0 +1,8 @@
+---
+"oxlint-plugin-react-doctor": patch
+---
+
+Add 2 new rules that use the structural control-flow graph as a verifier:
+
+- `no-unreachable-code` (Bugs): flags code that never runs because every path above it returns, throws, breaks, continues, or loops forever (via the CFG's `isUnreachable`). Hoisted function declarations, type-only TS declarations, and a bare `var x;` are left alone, matching ESLint's `no-unreachable` carve-outs. Global rule (runs on all JS/TS), so the defensive trailing `throw` after a switch whose every case returns is reported as dead code, consistent with `no-unreachable`.
+- `no-set-state-in-render-loop` (Bugs): flags a `useState` setter called inside a render-phase loop (via the CFG's `isInsideLoop`), which fires every iteration and restarts rendering ("Too many re-renders"). Complements `no-set-state-in-render`, which only catches setters that run unconditionally; the two partition cleanly on `isUnconditionalFromEntry`, so an unconditional `for (;;)` / `while (true)` setter is owned by `no-set-state-in-render` and never double-reported. Setters in `.map()` / event-handler / effect callbacks (separate functions) stay quiet.
diff --git a/.changeset/refactor-extract-cfg-package.md b/.changeset/refactor-extract-cfg-package.md
new file mode 100644
index 000000000..bfb877adf
--- /dev/null
+++ b/.changeset/refactor-extract-cfg-package.md
@@ -0,0 +1,7 @@
+---
+"oxlint-plugin-react-doctor": patch
+---
+
+Extract the control-flow graph into a dedicated internal `@react-doctor/cfg` package.
+
+The per-function CFG builder and its dominance / reachability analyses now live in their own self-contained package (bundled into the plugin at build time, so the published surface is unchanged). The package ships a typed `analyzeControlFlow` API, a README documenting the modeled terminal taxonomy, and a full port of oxc's `eslint/no-unreachable` `pass` / `fail` corpus asserted directly against the graph's `isUnreachable`.
diff --git a/packages/cfg/README.md b/packages/cfg/README.md
new file mode 100644
index 000000000..496cde4ee
--- /dev/null
+++ b/packages/cfg/README.md
@@ -0,0 +1,245 @@
+# @react-doctor/cfg
+
+Internal (unpublished) per-function **control-flow graph** for an ESTree AST,
+plus the dominance / reachability analyses React Doctor's CFG-backed rules run
+on. The `oxlint-plugin-react-doctor` package bundles it at build time, so it is
+not a runtime dependency of anything published.
+
+It exists so a rule can ask precise control-flow questions — _does this node run
+on every path?_, _is this node reachable from that one?_, _is it inside a
+loop?_ — instead of pattern-matching the AST and hoping the shape generalizes.
+That is the same class of question the React Compiler answers over its HIR and
+oxc answers over `oxc_cfg`.
+
+## API
+
+```ts
+import { analyzeControlFlow } from "@react-doctor/cfg";
+
+const cfg = analyzeControlFlow(programRoot); // ControlFlowAnalysis
+```
+
+`analyzeControlFlow(program)` lazily builds one graph per function it
+encounters and returns a `ControlFlowAnalysis`:
+
+| Method                                | Question it answers                                                               |
+| ------------------------------------- | --------------------------------------------------------------------------------- |
+| `isUnconditionalFromEntry(node)`      | Does `node` run on **every** path from its function's entry to its exit?          |
+| `isReachable(fromNode, toNode)`       | Can control flow from `fromNode` to `toNode` within the same function?            |
+| `dominates(aNode, bNode)`             | Does `aNode` run on every path that reaches `bNode` (a guard before a sink)?      |
+| `postDominates(bNode, aNode)`         | Does `bNode` run on every path from `aNode` to exit (cleanup after a resource)?   |
+| `isInsideLoop(node)`                  | Is `node`'s block part of a cycle in its own function's CFG?                      |
+| `isUnreachable(node)`                 | Is `node`'s block dead code (after an unconditional return / throw / break)?      |
+| `dominanceFrontier(node)`             | The dominance frontier of `node`'s block (Cytron et al.) — the SSA seam.          |
+| `isInfiniteLoopStart(node)`           | Is the loop's test a compile-time truthy constant (oxc `is_infinite_loop_start`)? |
+| `toDot(fn)`                           | Graphviz DOT of the function's CFG (debugging / parity snapshots).                |
+| `cfgFor(fn)` / `enclosingFunction(n)` | The raw `FunctionCfg` (blocks + edges) / the function a node belongs to.          |
+
+Each function boundary (`function` declaration / expression, arrow) gets its own
+acyclic-except-for-loops graph; a callback that escapes a loop is **not** inside
+that loop because it is a separate function.
+
+## Internal model
+
+Each `BasicBlock` is a typed `Instruction[]` (oxc's `InstructionKind`:
+`statement` / `condition` / `iteration` / `return` / `implicit-return` /
+`throw` / `break` / `continue`) ending in a first-class `Terminal`. The
+`Terminal` union mirrors the React Compiler HIR taxonomy (`HIR/HIR.ts`):
+`goto` / `if` / `switch` / `while` / `do-while` / `for` / `for-in` / `for-of` /
+`logical` / `ternary` / `optional` / `try` / `return` / `throw` /
+`unreachable`. Branching terminals carry a `fallthrough` join block (the
+compiler's `TerminalWithFallthrough`), and `break` / `continue` are lowered to
+explicit `goto` terminals at their resolved targets.
+
+Dominators and post-dominators use the **Cooper–Harvey–Kennedy** "A Simple,
+Fast Dominance Algorithm" immediate-dominator tree over reverse-postorder (the
+same algorithm the React Compiler uses), and we also compute the dominance
+frontier (Cytron et al.) — both the public `dominanceFrontier` seam and the
+verification oracle for the SSA layer below.
+
+## SSA (`analyzeSsa`)
+
+Variable-level **static single assignment** form over the same CFG, so a rule
+can ask value-flow questions — _which definition reaches this use?_, _is this
+write dead?_, _is this binding reassigned between two points?_ — that pure
+control flow can't answer.
+
+```ts
+import { analyzeSsa } from "@react-doctor/cfg";
+
+// Self-contained: a built-in lexical resolver assigns binding identities.
+const ssa = analyzeSsa(programRoot);
+
+// Or inject a host scope analyzer's binding ids (the oxlint plugin does this):
+const ssa = analyzeSsa(programRoot, (idNode) => scopes.symbolFor(idNode)?.id ?? null);
+```
+
+| Method                                  | Question it answers                                              |
+| --------------------------------------- | ---------------------------------------------------------------- |
+| `versionAt(node)`                       | The SSA value read or written at an identifier node.             |
+| `reachingDefinition(useNode)`           | The SSA value that flows into a use (its reaching def).          |
+| `isLiveValue(identifier)`               | Is this value ever read (directly or through a live φ)?          |
+| `isRedefinedBetween(from, to, binding)` | Is `binding` written on a path between two nodes?                |
+| `bindingOf(node)` / `ssaFor(fn)`        | The binding an identifier denotes / per-function φ + def blocks. |
+
+Construction is the **Braun, Buchwald, Hack et al. (2013)** on-the-fly
+sealed-block algorithm — the same algorithm the React Compiler's `EnterSSA`
+implements — followed by their `EliminateRedundantPhi` fixpoint pass. It needs
+only `BasicBlock.predecessors`, per-block read/write occurrences, and a version
+counter; no dominator tree. The dominance frontier is used purely as the test
+oracle: minimal-SSA φ placement equals the iterated dominance frontier of each
+binding's definitions (Cytron et al.), and the parity suite asserts exactly
+that. Scope is variable-level (no field-level / `ObjectShape` SSA, no type
+inference, no out-of-SSA `LeaveSSA`); a binding read inside a nested function is
+a closure capture the per-function form leaves opaque.
+
+The algorithm is a clean-room port of the **MIT-licensed** React Compiler
+SSA (`babel-plugin-react-compiler/src/SSA`), carrying no Babel dependency —
+attribution only.
+
+### Source layout
+
+- `src/ir/` — the data model (`instruction.ts`, `terminal.ts`, `basic-block.ts`).
+- `src/build/` — lowering (`cfg-builder.ts`, `build-expression.ts`,
+  `build-statement.ts`, `build-function-cfg.ts`).
+- `src/analysis/` — `reverse-postorder.ts`, `dominators.ts` (forward +
+  post-dominator trees + frontier), `reachability.ts`, `unconditional.ts`,
+  `loops.ts`, `node-order.ts`, `block-edges.ts`. SSA: `defs-uses.ts`
+  (occurrence extraction), `lexical-binding-resolver.ts` (built-in resolver),
+  `enter-ssa.ts` (Braun construction), `eliminate-redundant-phi.ts`.
+- `src/ir/place.ts` — the SSA value model (`SsaIdentifier` / `Place` / `Phi`).
+- `src/dot.ts` — Graphviz export (renders φ-functions). `src/constant-condition.ts`
+  — the infinite-loop constant folder. `src/control-flow-graph.ts` — assembles
+  `analyzeControlFlow`; `src/ssa.ts` — assembles `analyzeSsa`.
+
+## Formal-verification stack
+
+Four layers build on the CFG/SSA above to answer _bug-finding_ questions
+soundly. Everything is pure-TS, bundled at build time, lazy (a rule that never
+reads a layer pays nothing), and runs once per scan — never in a hot loop.
+
+### Dataflow framework (`solveDataflow`, Layer A)
+
+A generic monotone worklist fixpoint over the CFG. Give it a `Lattice<Fact>`
+(`bottom` / `join` / `equals`), a `direction`, a `boundary` fact, and a
+`transfer(block, inFact)`; it iterates reverse-postorder (forward) or its
+reverse (backward) to a fixpoint and returns per-block entry/exit facts. One
+solver subsumes many analyses.
+
+```ts
+import { solveDataflow, analyzeDefiniteAssignment } from "@react-doctor/cfg";
+```
+
+`analyzeDefiniteAssignment(program, resolveBinding?, { resolveValue? })` is the
+first analysis built on it: a forward _must_ analysis (set-intersection at
+joins) over the SSA occurrence stream. `isMaybeUnassignedAt(node)` answers
+_does some entry→read path reach this read with no prior write?_ — the signal a
+TDZ / read-before-write rule keys off. A `declare` occurrence (`let x;`) is
+neither a read nor a write, so a bare declaration never counts as an assignment.
+
+### Typestate protocol engine (`verifyTypestate`, Layer C)
+
+Generalizes resource-protocol checking (e.g. the hand-rolled
+effect-cleanup leak rule) into a reusable automaton verified over the CFG.
+
+```ts
+import { verifyTypestate } from "@react-doctor/cfg";
+
+verifyTypestate(cfg, { automaton, classifier, resolveValue? });
+```
+
+A `TypestateAutomaton` is `{ initial, transition(state, event), errorStates,
+acceptingStates }`; the `classifier` maps each instruction node to the protocol
+events (`{ resource, event, node }`) in its subtree. Built on `solveDataflow`
+(fact = each resource's set of possible states, joined by union), it reports two
+failure modes: an **error transition** (an illegal event drove a resource into
+an error state) and a **leaked resource** (a resource resting in a non-accepting
+state on a normal-completion path — the exit joined over non-`throw`
+predecessors). Events are attributed to the block they actually execute in
+(`cfg.blockOf`) and deduplicated by node, so the whole-body `implicit-return`
+instruction never double-counts a call.
+
+### Path feasibility (`isPathFeasible`, Layer D)
+
+A bounded, dependency-free consistency checker that refines B/C by **pruning
+infeasible counterexample paths**. `lowerGuard` / `pathConditionFacts` lower a
+path's branch guards (`if` / `&&` / `||` / `!` / equality) into facts over SSA
+values (keyed by `versionAt`, so the _same_ value at two branches is one atom).
+`isPathFeasible(facts)` runs a union-find congruence closure plus truthiness /
+disequality constraints and returns `feasible` / `infeasible` / `unknown`
+(`unknown` past the caps in `constants.ts`).
+
+The integration is deliberately one-directional: a diagnostic is suppressed
+**only** when the path search is complete and _every_ counterexample is provably
+`infeasible`. Any `feasible` / `unknown` counterexample, or an incomplete search,
+leaves the diagnostic standing — so Layer D only ever removes false positives
+(e.g. `if (x) open(); … if (x) close();` — the open-without-close path needs `x`
+truthy and falsy at once) and is never unsound for bug-finding. Opt in by
+passing `resolveValue` to `analyzeDefiniteAssignment` / `verifyTypestate`.
+
+Source: `src/dataflow/` (`lattice.ts`, `solve.ts`, `definite-assignment.ts`),
+`src/typestate/` (`automaton.ts`, `verify.ts`), `src/path/`
+(`literal-facts.ts`, `path-condition.ts`, `feasibility.ts`,
+`enumerate-paths.ts`, `prune-infeasible.ts`). Tested by `tests/dataflow.test.ts`,
+`tests/typestate.test.ts`, `tests/path-feasibility.test.ts`.
+
+## What it models
+
+Statement-level terminals: `if` / `switch` / `for` / `for-in` / `for-of` /
+`while` / `do-while` / labeled `break` & `continue` / `return` / `throw` /
+`try` / `catch` / `finally` (normal completion is routed through `finalize` /
+`join` edges so reachability after a `try` is correct).
+
+Expression-level terminals, lowered into basic blocks the way the React
+Compiler lowers its HIR — so a hook or `setState` buried in a branch is seen as
+conditional:
+
+- ternary `a ? b : c`
+- logical `&&` / `||` / `??` (and logical-assignment `&&=` / `||=` / `??=`)
+- optional chaining `a?.b?.()` (each `?.` branches to a shared short-circuit
+  target)
+
+Every node maps to the block where its evaluation **completes** (its join
+point), which keeps dominance / reachability accurate through nested
+expressions.
+
+Deliberately **not** modeled: per-instruction "maybe-throw" edges (every call
+can throw); `var` / function-declaration hoisting as a reachability fact (that
+is a rule policy, not a CFG fact). Both are documented at the top of
+`src/ir/basic-block.ts`.
+
+## Tests & fixture provenance
+
+Parity is the deliverable: curated slices of three upstream suites, asserted
+through the primitives above (and terminal-shape snapshots), so we can claim we
+replicate oxc / ESLint / React Compiler CFG semantics.
+
+- `tests/control-flow-graph.oxc-no-unreachable.test.ts` — full port of oxc's
+  `eslint/no-unreachable` `pass` / `fail` corpus
+  (`crates/oxc_linter/src/rules/eslint/no_unreachable.rs`), via `isUnreachable`
+  (`dead()` / `live()` markers).
+- `tests/control-flow-graph.oxc-no-fallthrough.test.ts` — oxc's
+  `eslint/no_fallthrough.rs`, as switch-case `isReachable` facts.
+- `tests/control-flow-graph.oxc-no-unsafe-finally.test.ts` — oxc's
+  `eslint/no_unsafe_finally.rs`: an abrupt `finally` swallows normal completion.
+- `tests/control-flow-graph.returns-every-path.test.ts` — oxc's
+  `eslint/getter_return.rs` / `consistent-return` post-dominance shapes.
+- `tests/control-flow-graph.eslint-code-path.test.ts` — representative ESLint
+  code-path-analysis segment reachability (`no-unreachable`, `consistent-return`).
+- `tests/control-flow-graph.react-compiler.test.ts` — React Compiler `BuildHIR`
+  control-flow shapes (if / switch / loops / try / logical / ternary / optional).
+- `tests/control-flow-graph.terminal-shape.test.ts` — each construct lowers to
+  its React Compiler HIR `Terminal` kind.
+- `tests/control-flow-graph.loops-dot.test.ts` — `isInfiniteLoopStart` const
+  folding + a DOT export snapshot.
+- `tests/control-flow-graph.try-finally.test.ts` — `try` / `catch` / `finally`
+  normal-completion edges.
+- `tests/control-flow-graph.expression-flow.test.ts` — the expression-level
+  terminals above.
+- `tests/control-flow-graph.regression.test.ts` — React-shaped regressions
+  (conditional hooks, `setState` in a branch).
+- `tests/control-flow-graph.test.ts` — core graph construction.
+- `tests/ssa.test.ts` — SSA φ-placement parity vs. the iterated dominance
+  frontier oracle, value queries, and the φ DOT rendering.
+
+Run `pnpm --filter @react-doctor/cfg test`.
diff --git a/packages/cfg/package.json b/packages/cfg/package.json
new file mode 100644
index 000000000..09dc17212
--- /dev/null
+++ b/packages/cfg/package.json
@@ -0,0 +1,30 @@
+{
+  "name": "@react-doctor/cfg",
+  "version": "0.5.6",
+  "private": true,
+  "description": "Internal: per-function control-flow graph + dominance/reachability analyses over an ESTree AST. Models the React Compiler HIR / oxc_cfg terminal taxonomy so rules can ask whether a node runs unconditionally, is reachable, dominates, or sits inside a loop. Not published.",
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && cross-env NODE_ENV=production vp pack",
+    "test": "vp test run",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@typescript-eslint/types": "^8.59.3"
+  },
+  "devDependencies": {
+    "@types/node": "^25.6.0",
+    "oxc-parser": "^0.135.0"
+  },
+  "engines": {
+    "node": "^20.19.0 || >=22.13.0"
+  }
+}
diff --git a/packages/cfg/src/analysis/block-edges.ts b/packages/cfg/src/analysis/block-edges.ts
new file mode 100644
index 000000000..4a8a825bb
--- /dev/null
+++ b/packages/cfg/src/analysis/block-edges.ts
@@ -0,0 +1,11 @@
+import type { BasicBlock } from "../ir/basic-block.js";
+
+// The successor blocks of `block`, dropping edge kinds. The forward
+// relation for RPO / dominator walks.
+export const successorBlocks = (block: BasicBlock): BasicBlock[] =>
+  block.successors.map((edge) => edge.to);
+
+// The predecessor blocks of `block`. The reverse relation, and the input
+// to SSA φ construction.
+export const predecessorBlocks = (block: BasicBlock): BasicBlock[] =>
+  block.predecessors.map((edge) => edge.from);
diff --git a/packages/cfg/src/analysis/defs-uses.ts b/packages/cfg/src/analysis/defs-uses.ts
new file mode 100644
index 000000000..0d8ad817e
--- /dev/null
+++ b/packages/cfg/src/analysis/defs-uses.ts
@@ -0,0 +1,167 @@
+import type { EsTreeNode } from "../ast/es-tree-node.js";
+import { forEachChildNode } from "../ast/for-each-child-node.js";
+import { isFunctionLike } from "../ast/is-function-like.js";
+import { isNodeOfType } from "../ast/is-node-of-type.js";
+import type { Place, ResolveBinding } from "../ir/place.js";
+
+// Lower an ESTree subtree into the ordered list of binding reads/writes
+// (`Place`s) the SSA builder consumes — the variable-level analogue of the
+// React Compiler's `BuildHIR` operand/lvalue extraction, minus field-level
+// granularity. We walk in evaluation order so a block's occurrence list
+// matches the order the Braun renamer must see (`x = x + 1` reads the old
+// `x` before writing the new one). Nested functions are skipped: each owns
+// its own CFG and SSA.
+
+interface PlaceEmitter {
+  (place: Place): void;
+}
+
+const emitIdentifier = (
+  node: EsTreeNode,
+  kind: "read" | "write" | "declare",
+  resolveBinding: ResolveBinding,
+  emit: PlaceEmitter,
+): void => {
+  if (!isNodeOfType(node, "Identifier")) return;
+  const binding = resolveBinding(node);
+  if (binding === null) return;
+  emit({ binding, name: node.name, kind, node });
+};
+
+// A binding *target* (assignment lhs, declarator id, for-in/of left): an
+// Identifier is a write; a member access writes a field we don't model, so
+// its object is merely read; destructuring patterns recurse.
+const walkWriteTarget = (
+  node: EsTreeNode,
+  resolveBinding: ResolveBinding,
+  emit: PlaceEmitter,
+): void => {
+  if (isNodeOfType(node, "Identifier")) {
+    emitIdentifier(node, "write", resolveBinding, emit);
+    return;
+  }
+  if (isNodeOfType(node, "ObjectPattern")) {
+    for (const property of node.properties) {
+      if (isNodeOfType(property, "RestElement")) {
+        walkWriteTarget(property.argument as EsTreeNode, resolveBinding, emit);
+        continue;
+      }
+      if (property.computed) walkReads(property.key as EsTreeNode, resolveBinding, emit);
+      walkWriteTarget(property.value as EsTreeNode, resolveBinding, emit);
+    }
+    return;
+  }
+  if (isNodeOfType(node, "ArrayPattern")) {
+    for (const element of node.elements) {
+      if (element) walkWriteTarget(element as EsTreeNode, resolveBinding, emit);
+    }
+    return;
+  }
+  if (isNodeOfType(node, "AssignmentPattern")) {
+    walkReads(node.right as EsTreeNode, resolveBinding, emit);
+    walkWriteTarget(node.left as EsTreeNode, resolveBinding, emit);
+    return;
+  }
+  if (isNodeOfType(node, "RestElement")) {
+    walkWriteTarget(node.argument as EsTreeNode, resolveBinding, emit);
+    return;
+  }
+  // `obj.x = …` / anything else: the target itself is read, not a binding write.
+  walkReads(node, resolveBinding, emit);
+};
+
+// Read occurrences in evaluation order. The default branch threads children
+// left-to-right (source order ≈ evaluation order for the constructs SSA
+// reasons about); the explicit cases fix the spots where they diverge.
+const walkReads = (node: EsTreeNode, resolveBinding: ResolveBinding, emit: PlaceEmitter): void => {
+  if (isFunctionLike(node)) {
+    // A function declaration binds its own name; its body has its own SSA.
+    if (isNodeOfType(node, "FunctionDeclaration") && node.id) {
+      emitIdentifier(node.id as EsTreeNode, "write", resolveBinding, emit);
+    }
+    return;
+  }
+
+  if (isNodeOfType(node, "Identifier")) {
+    emitIdentifier(node, "read", resolveBinding, emit);
+    return;
+  }
+
+  if (isNodeOfType(node, "VariableDeclaration")) {
+    for (const declarator of node.declarations) {
+      if (declarator.init) {
+        walkReads(declarator.init as EsTreeNode, resolveBinding, emit);
+        walkWriteTarget(declarator.id as EsTreeNode, resolveBinding, emit);
+        continue;
+      }
+      // `let x;` / `var x;` — a binding declared without a value. Only a
+      // bare Identifier can lack an initializer (init-less patterns are a
+      // syntax error), so this is the binding's declaration, not a store.
+      emitIdentifier(declarator.id as EsTreeNode, "declare", resolveBinding, emit);
+    }
+    return;
+  }
+
+  if (isNodeOfType(node, "AssignmentExpression")) {
+    // Compound assignment (`+=`) reads the lhs before the rhs; plain `=`
+    // evaluates the rhs first, then stores.
+    if (node.operator !== "=") walkReadTarget(node.left as EsTreeNode, resolveBinding, emit);
+    walkReads(node.right as EsTreeNode, resolveBinding, emit);
+    walkWriteTarget(node.left as EsTreeNode, resolveBinding, emit);
+    return;
+  }
+
+  if (isNodeOfType(node, "UpdateExpression")) {
+    walkReadTarget(node.argument as EsTreeNode, resolveBinding, emit);
+    walkWriteTarget(node.argument as EsTreeNode, resolveBinding, emit);
+    return;
+  }
+
+  if (isNodeOfType(node, "MemberExpression")) {
+    walkReads(node.object as EsTreeNode, resolveBinding, emit);
+    if (node.computed) walkReads(node.property as EsTreeNode, resolveBinding, emit);
+    return;
+  }
+
+  if (isNodeOfType(node, "Property")) {
+    if (node.computed) walkReads(node.key as EsTreeNode, resolveBinding, emit);
+    walkReads(node.value as EsTreeNode, resolveBinding, emit);
+    return;
+  }
+
+  forEachChildNode(node, (child) => walkReads(child, resolveBinding, emit));
+};
+
+// A binding target evaluated as a read (compound-assignment / update lhs).
+const walkReadTarget = (
+  node: EsTreeNode,
+  resolveBinding: ResolveBinding,
+  emit: PlaceEmitter,
+): void => {
+  if (isNodeOfType(node, "Identifier")) {
+    emitIdentifier(node, "read", resolveBinding, emit);
+    return;
+  }
+  walkReads(node, resolveBinding, emit);
+};
+
+// Ordered read/write occurrences of resolvable bindings inside `node`,
+// stopping at nested function boundaries.
+export const collectPlaces = (node: EsTreeNode, resolveBinding: ResolveBinding): Place[] => {
+  const places: Place[] = [];
+  walkReads(node, resolveBinding, (place) => places.push(place));
+  return places;
+};
+
+// Parameter bindings are written once, at the function entry, before any
+// body instruction runs. Default values are reads evaluated at entry too.
+export const collectParameterPlaces = (
+  parameters: ReadonlyArray<EsTreeNode>,
+  resolveBinding: ResolveBinding,
+): Place[] => {
+  const places: Place[] = [];
+  for (const parameter of parameters) {
+    walkWriteTarget(parameter, resolveBinding, (place) => places.push(place));
+  }
+  return places;
+};
diff --git a/packages/cfg/src/analysis/dominators.ts b/packages/cfg/src/analysis/dominators.ts
new file mode 100644
index 000000000..0ca3c8e17
--- /dev/null
+++ b/packages/cfg/src/analysis/dominators.ts
@@ -0,0 +1,123 @@
+import type { BasicBlock } from "../ir/basic-block.js";
+import { predecessorBlocks, successorBlocks } from "./block-edges.js";
+import { reversePostorder } from "./reverse-postorder.js";
+
+export interface DominatorTree {
+  // Blocks reachable from the tree's root (entry for dominators, exit for
+  // post-dominators). Queries outside this set return false.
+  readonly reachable: ReadonlySet<BasicBlock>;
+  // The immediate dominator of `block` (the root maps to itself); null if
+  // `block` is unreachable from the root.
+  readonly immediateDominatorOf: (block: BasicBlock) => BasicBlock | null;
+  // `ancestor` dominates `node`: it lies on `node`'s idom chain (a node
+  // dominates itself). For a post-dominator tree this reads as "`ancestor`
+  // post-dominates `node`".
+  readonly dominates: (ancestor: BasicBlock, node: BasicBlock) => boolean;
+  // The dominance frontier of `block` (Cytron et al.): the blocks where
+  // `block`'s dominance stops. The SSA-construction seam; no consumer uses
+  // it yet, but it is a cheap, high-fidelity parity artifact.
+  readonly dominanceFrontierOf: (block: BasicBlock) => ReadonlySet<BasicBlock>;
+}
+
+// Cooper–Harvey–Kennedy "A Simple, Fast Dominance Algorithm": iterate the
+// idom array over reverse-postorder until it stabilizes. `successorsOf`
+// drives the RPO walk from `root`; `predecessorsOf` feeds the intersection
+// step. For a post-dominator tree, callers pass the reversed relations
+// (root = exit, successors = CFG predecessors, predecessors = CFG
+// successors). Same algorithm the React Compiler uses (`Dominator.ts`).
+export const buildDominatorTree = (
+  root: BasicBlock,
+  successorsOf: (block: BasicBlock) => ReadonlyArray<BasicBlock>,
+  predecessorsOf: (block: BasicBlock) => ReadonlyArray<BasicBlock>,
+): DominatorTree => {
+  const order = reversePostorder(root, successorsOf);
+  const rpoNumber = new Map<BasicBlock, number>();
+  order.forEach((block, index) => rpoNumber.set(block, index));
+
+  const idom = new Map<BasicBlock, BasicBlock | null>();
+  for (const block of order) idom.set(block, null);
+  idom.set(root, root);
+
+  // Walk both fingers up the partially-built tree until they meet — the
+  // nearest common dominator of two already-processed blocks.
+  const intersect = (left: BasicBlock, right: BasicBlock): BasicBlock => {
+    let finger1 = left;
+    let finger2 = right;
+    while (finger1 !== finger2) {
+      while (rpoNumber.get(finger1)! > rpoNumber.get(finger2)!) finger1 = idom.get(finger1)!;
+      while (rpoNumber.get(finger2)! > rpoNumber.get(finger1)!) finger2 = idom.get(finger2)!;
+    }
+    return finger1;
+  };
+
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const block of order) {
+      if (block === root) continue;
+      let newIdom: BasicBlock | null = null;
+      for (const predecessor of predecessorsOf(block)) {
+        // Skip predecessors not yet processed (or unreachable from root —
+        // dead code can't influence runtime dominance).
+        if (idom.get(predecessor) == null) continue;
+        newIdom = newIdom === null ? predecessor : intersect(predecessor, newIdom);
+      }
+      if (newIdom !== null && idom.get(block) !== newIdom) {
+        idom.set(block, newIdom);
+        changed = true;
+      }
+    }
+  }
+
+  const reachable = new Set(order);
+
+  const dominates = (ancestor: BasicBlock, node: BasicBlock): boolean => {
+    if (!reachable.has(ancestor) || !reachable.has(node)) return false;
+    let current: BasicBlock | null = node;
+    while (current !== null) {
+      if (current === ancestor) return true;
+      const next: BasicBlock | null = idom.get(current) ?? null;
+      if (next === current) return false; // reached the root
+      current = next;
+    }
+    return false;
+  };
+
+  // Cytron et al.: for every join block (≥2 reachable predecessors), each
+  // predecessor `runner` adds the join to its dominance frontier until it
+  // hits the join's immediate dominator.
+  const dominanceFrontier = new Map<BasicBlock, Set<BasicBlock>>();
+  for (const block of order) dominanceFrontier.set(block, new Set());
+  for (const block of order) {
+    const predecessors = predecessorsOf(block).filter((predecessor) => reachable.has(predecessor));
+    if (predecessors.length < 2) continue;
+    const blockIdom = idom.get(block);
+    for (const predecessor of predecessors) {
+      let runner: BasicBlock | null = predecessor;
+      while (runner !== null && runner !== blockIdom) {
+        dominanceFrontier.get(runner)!.add(block);
+        const next: BasicBlock | null = idom.get(runner) ?? null;
+        if (next === runner) break;
+        runner = next;
+      }
+    }
+  }
+
+  const emptyFrontier: ReadonlySet<BasicBlock> = new Set();
+
+  return {
+    reachable,
+    immediateDominatorOf: (block) => idom.get(block) ?? null,
+    dominates,
+    dominanceFrontierOf: (block) => dominanceFrontier.get(block) ?? emptyFrontier,
+  };
+};
+
+// Forward dominator tree rooted at the function entry.
+export const computeDominatorTree = (entry: BasicBlock): DominatorTree =>
+  buildDominatorTree(entry, successorBlocks, predecessorBlocks);
+
+// Post-dominator tree: the dominator tree of the reversed graph rooted at
+// the function exit. `tree.dominates(a, b)` then means "a post-dominates b".
+export const computePostDominatorTree = (exit: BasicBlock): DominatorTree =>
+  buildDominatorTree(exit, predecessorBlocks, successorBlocks);
diff --git a/packages/cfg/src/analysis/eliminate-redundant-phi.ts b/packages/cfg/src/analysis/eliminate-redundant-phi.ts
new file mode 100644
index 000000000..93cf90467
--- /dev/null
+++ b/packages/cfg/src/analysis/eliminate-redundant-phi.ts
@@ -0,0 +1,68 @@
+import type { FunctionCfg } from "../ir/basic-block.js";
+import type { Phi, SsaIdentifier } from "../ir/place.js";
+import type { SsaConstruction } from "./enter-ssa.js";
+import { successorBlocks } from "./block-edges.js";
+import { reversePostorder } from "./reverse-postorder.js";
+
+// Strip the trivial φs the on-the-fly builder leaves behind — a φ whose
+// operands are all the same value `v` (ignoring self-references) is just
+// `v`. Ports the React Compiler's `EliminateRedundantPhi`: a reverse-
+// postorder rewrite pass repeated to a fixpoint, since collapsing one φ can
+// expose another. Mutates the CFG's `block.phis` and rewrites every
+// recorded read/write occurrence through the resulting substitution.
+export const eliminateRedundantPhis = (cfg: FunctionCfg, construction: SsaConstruction): void => {
+  const order = reversePostorder(cfg.entry, successorBlocks);
+  const rewrite = new Map<SsaIdentifier, SsaIdentifier>();
+  const removed = new Set<Phi>();
+
+  const resolve = (identifier: SsaIdentifier): SsaIdentifier => {
+    let current = identifier;
+    while (rewrite.has(current)) current = rewrite.get(current)!;
+    return current;
+  };
+
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const block of order) {
+      for (const phi of block.phis) {
+        if (removed.has(phi)) continue;
+        let unique: SsaIdentifier | null = null;
+        let redundant = true;
+        for (const operand of phi.operands.values()) {
+          const resolved = resolve(operand);
+          if (resolved === phi.identifier) continue; // self-reference: ignore
+          if (unique === null) {
+            unique = resolved;
+          } else if (unique !== resolved) {
+            redundant = false;
+            break;
+          }
+        }
+        if (redundant && unique !== null) {
+          rewrite.set(phi.identifier, unique);
+          removed.add(phi);
+          changed = true;
+        }
+      }
+    }
+  }
+
+  for (const block of order) {
+    const kept = block.phis.filter((phi) => !removed.has(phi));
+    block.phis.length = 0;
+    for (const phi of kept) {
+      for (const [predecessor, operand] of phi.operands) {
+        phi.operands.set(predecessor, resolve(operand));
+      }
+      block.phis.push(phi);
+    }
+  }
+
+  for (const [node, identifier] of construction.readIdentifierAt) {
+    construction.readIdentifierAt.set(node, resolve(identifier));
+  }
+  for (const [node, identifier] of construction.writeIdentifierAt) {
+    construction.writeIdentifierAt.set(node, resolve(identifier));
+  }
+};
diff --git a/packages/cfg/src/analysis/enter-ssa.ts b/packages/cfg/src/analysis/enter-ssa.ts
new file mode 100644
index 000000000..13803f05e
--- /dev/null
+++ b/packages/cfg/src/analysis/enter-ssa.ts
@@ -0,0 +1,160 @@
+import type { EsTreeNode } from "../ast/es-tree-node.js";
+import type { BasicBlock, FunctionCfg } from "../ir/basic-block.js";
+import type { BindingId, Phi, Place, SsaIdentifier } from "../ir/place.js";
+import { successorBlocks } from "./block-edges.js";
+import { reversePostorder } from "./reverse-postorder.js";
+
+export interface SsaConstruction {
+  // The SSA value flowing INTO each read occurrence (its reaching def).
+  readonly readIdentifierAt: Map<EsTreeNode, SsaIdentifier>;
+  // The SSA value DEFINED at each write occurrence.
+  readonly writeIdentifierAt: Map<EsTreeNode, SsaIdentifier>;
+  // Reachable blocks that write each binding — the φ-placement oracle input.
+  readonly defBlocks: Map<BindingId, Set<BasicBlock>>;
+}
+
+// On-the-fly SSA construction via Braun, Buchwald, Hack et al. (2013),
+// "Simple and Efficient Construction of Static Single Assignment Form"
+// (the algorithm the React Compiler's `EnterSSA` also implements). It needs
+// only `BasicBlock.predecessors`, the per-block read/write occurrences, and
+// a version counter — no dominator tree. Loop headers are read before their
+// back-edge predecessor is filled, so they receive *incomplete* φs that are
+// completed when the header is sealed (all predecessors filled).
+export const enterSsa = (
+  cfg: FunctionCfg,
+  placesByBlock: ReadonlyMap<BasicBlock, ReadonlyArray<Place>>,
+): SsaConstruction => {
+  const readIdentifierAt = new Map<EsTreeNode, SsaIdentifier>();
+  const writeIdentifierAt = new Map<EsTreeNode, SsaIdentifier>();
+  const defBlocks = new Map<BindingId, Set<BasicBlock>>();
+
+  // currentDef[binding][block] — the SSA value of `binding` at the end of
+  // `block` (or the in-progress phi result, to break read cycles).
+  const currentDef = new Map<BindingId, Map<BasicBlock, SsaIdentifier>>();
+  const sealed = new Set<BasicBlock>();
+  const filled = new Set<BasicBlock>();
+  const incompletePhis = new Map<BasicBlock, Map<BindingId, Phi>>();
+  const versionCounter = new Map<BindingId, number>();
+
+  const newVersion = (binding: BindingId, name: string): SsaIdentifier => {
+    const version = versionCounter.get(binding) ?? 0;
+    versionCounter.set(binding, version + 1);
+    return { binding, version, name };
+  };
+
+  const writeVariable = (binding: BindingId, block: BasicBlock, value: SsaIdentifier): void => {
+    let perBlock = currentDef.get(binding);
+    if (!perBlock) {
+      perBlock = new Map();
+      currentDef.set(binding, perBlock);
+    }
+    perBlock.set(block, value);
+  };
+
+  const recordPhi = (block: BasicBlock, phi: Phi): void => {
+    block.phis.push(phi);
+  };
+
+  const addPhiOperands = (binding: BindingId, block: BasicBlock, phi: Phi, name: string): void => {
+    for (const edge of block.predecessors) {
+      phi.operands.set(edge.from, readVariable(binding, edge.from, name));
+    }
+  };
+
+  const readVariableRecursive = (
+    binding: BindingId,
+    block: BasicBlock,
+    name: string,
+  ): SsaIdentifier => {
+    if (!sealed.has(block)) {
+      const identifier = newVersion(binding, name);
+      const phi: Phi = { identifier, operands: new Map() };
+      let perBlock = incompletePhis.get(block);
+      if (!perBlock) {
+        perBlock = new Map();
+        incompletePhis.set(block, perBlock);
+      }
+      perBlock.set(binding, phi);
+      writeVariable(binding, block, identifier);
+      return identifier;
+    }
+    if (block.predecessors.length === 1) {
+      const value = readVariable(binding, block.predecessors[0]!.from, name);
+      writeVariable(binding, block, value);
+      return value;
+    }
+    if (block.predecessors.length === 0) {
+      // Use of an unwritten binding (globals, use-before-def): a fresh,
+      // operand-less version standing in for the undefined value.
+      const identifier = newVersion(binding, name);
+      writeVariable(binding, block, identifier);
+      return identifier;
+    }
+    const identifier = newVersion(binding, name);
+    const phi: Phi = { identifier, operands: new Map() };
+    writeVariable(binding, block, identifier); // break cycles first
+    addPhiOperands(binding, block, phi, name);
+    recordPhi(block, phi);
+    return identifier;
+  };
+
+  const readVariable = (binding: BindingId, block: BasicBlock, name: string): SsaIdentifier => {
+    const local = currentDef.get(binding)?.get(block);
+    if (local) return local;
+    return readVariableRecursive(binding, block, name);
+  };
+
+  const sealBlock = (block: BasicBlock): void => {
+    const incomplete = incompletePhis.get(block);
+    if (incomplete) {
+      for (const [binding, phi] of incomplete) {
+        addPhiOperands(binding, block, phi, phi.identifier.name);
+        recordPhi(block, phi);
+      }
+    }
+    sealed.add(block);
+  };
+
+  const fillBlock = (block: BasicBlock): void => {
+    for (const place of placesByBlock.get(block) ?? []) {
+      if (place.kind === "read") {
+        readIdentifierAt.set(place.node, readVariable(place.binding, block, place.name));
+        continue;
+      }
+      const identifier = newVersion(place.binding, place.name);
+      writeVariable(place.binding, block, identifier);
+      writeIdentifierAt.set(place.node, identifier);
+      let blocks = defBlocks.get(place.binding);
+      if (!blocks) {
+        blocks = new Set();
+        defBlocks.set(place.binding, blocks);
+      }
+      blocks.add(block);
+    }
+    filled.add(block);
+  };
+
+  const order = reversePostorder(cfg.entry, successorBlocks);
+  const allPredecessorsFilled = (block: BasicBlock): boolean =>
+    block.predecessors.every((edge) => filled.has(edge.from));
+
+  for (const block of order) {
+    if (allPredecessorsFilled(block)) sealBlock(block);
+    fillBlock(block);
+  }
+  // Seal the blocks left unsealed (loop headers, whose back-edge
+  // predecessor was filled only after the header). Repeat to a fixpoint:
+  // sealing a header can spawn incomplete φs on other unsealed blocks.
+  let progressed = true;
+  while (progressed) {
+    progressed = false;
+    for (const block of order) {
+      if (!sealed.has(block)) {
+        sealBlock(block);
+        progressed = true;
+      }
+    }
+  }
+
+  return { readIdentifierAt, writeIdentifierAt, defBlocks };
+};
diff --git a/packages/cfg/src/analysis/enumerate-functions.ts b/packages/cfg/src/analysis/enumerate-functions.ts
new file mode 100644
index 000000000..e005b0772
--- /dev/null
+++ b/packages/cfg/src/analysis/enumerate-functions.ts
@@ -0,0 +1,19 @@
+import type { EsTreeNode } from "../ast/es-tree-node.js";
+import { forEachChildNode } from "../ast/for-each-child-node.js";
+import { isFunctionLike } from "../ast/is-function-like.js";
+import { isNodeOfType } from "../ast/is-node-of-type.js";
+
+// Every CFG owner in a program: the `Program` itself (its top-level code is
+// a graph) plus every nested function-like. The shared driver for the
+// per-function passes (SSA, definite-assignment) so they agree on exactly
+// which scopes get a CFG.
+export const enumerateFunctions = (program: EsTreeNode): EsTreeNode[] => {
+  const functionNodes: EsTreeNode[] = [];
+  if (isNodeOfType(program, "Program")) functionNodes.push(program);
+  const collect = (node: EsTreeNode): void => {
+    if (isFunctionLike(node)) functionNodes.push(node);
+    forEachChildNode(node, collect);
+  };
+  collect(program);
+  return functionNodes;
+};
diff --git a/packages/cfg/src/analysis/lexical-binding-resolver.ts b/packages/cfg/src/analysis/lexical-binding-resolver.ts
new file mode 100644
index 000000000..de3f284ef
--- /dev/null
+++ b/packages/cfg/src/analysis/lexical-binding-resolver.ts
@@ -0,0 +1,163 @@
+import type { EsTreeNode } from "../ast/es-tree-node.js";
+import { forEachChildNode } from "../ast/for-each-child-node.js";
+import { isFunctionLike } from "../ast/is-function-like.js";
+import { isNodeOfType } from "../ast/is-node-of-type.js";
+import type { BindingId, ResolveBinding } from "../ir/place.js";
+
+interface LexicalScope {
+  readonly parent: LexicalScope | null;
+  // A function or the program — the target `var`/`function` declarations
+  // hoist to, regardless of the block they appear in. Block scopes are not.
+  readonly isHoistBoundary: boolean;
+  readonly bindings: Map<string, BindingId>;
+}
+
+// The nearest enclosing hoist boundary (function or program).
+const hoistScopeOf = (scope: LexicalScope): LexicalScope => {
+  let current = scope;
+  while (!current.isHoistBoundary && current.parent !== null) current = current.parent;
+  return current;
+};
+
+// A block-like node opens a fresh lexical scope for its `let`/`const`/class
+// declarations. Function bodies open a scope through the function itself
+// (which also holds the parameters), so the body BlockStatement nesting is
+// harmless.
+const opensBlockScope = (node: EsTreeNode): boolean =>
+  isNodeOfType(node, "BlockStatement") ||
+  isNodeOfType(node, "ForStatement") ||
+  isNodeOfType(node, "ForInStatement") ||
+  isNodeOfType(node, "ForOfStatement") ||
+  isNodeOfType(node, "SwitchStatement") ||
+  isNodeOfType(node, "CatchClause");
+
+// A lightweight lexical scope/shadowing/hoisting resolver, self-contained
+// so SSA is testable without a host. Declarations are registered while
+// walking; resolution is deferred until the whole tree is seen, so forward
+// references and hoisting (`x; var x;`) resolve by scope-chain lookup. The
+// oxlint plugin can inject its richer `scope-analysis` resolver instead.
+export const createLexicalBindingResolver = (program: EsTreeNode): ResolveBinding => {
+  let nextBindingId = 0;
+  const scopeOfIdentifier = new Map<EsTreeNode, LexicalScope>();
+
+  const declare = (scope: LexicalScope, name: string): void => {
+    if (!scope.bindings.has(name)) scope.bindings.set(name, nextBindingId++);
+  };
+
+  // Register the binding names a destructuring/parameter pattern introduces
+  // (default-value and computed-key expressions are handled by the generic
+  // child walk, so they are skipped here).
+  const declarePattern = (pattern: EsTreeNode, scope: LexicalScope): void => {
+    if (isNodeOfType(pattern, "Identifier")) {
+      declare(scope, pattern.name);
+      return;
+    }
+    if (isNodeOfType(pattern, "ObjectPattern")) {
+      for (const property of pattern.properties) {
+        if (isNodeOfType(property, "RestElement")) {
+          declarePattern(property.argument as EsTreeNode, scope);
+        } else {
+          declarePattern(property.value as EsTreeNode, scope);
+        }
+      }
+      return;
+    }
+    if (isNodeOfType(pattern, "ArrayPattern")) {
+      for (const element of pattern.elements) {
+        if (element) declarePattern(element as EsTreeNode, scope);
+      }
+      return;
+    }
+    if (isNodeOfType(pattern, "AssignmentPattern")) {
+      declarePattern(pattern.left as EsTreeNode, scope);
+      return;
+    }
+    if (isNodeOfType(pattern, "RestElement")) {
+      declarePattern(pattern.argument as EsTreeNode, scope);
+    }
+  };
+
+  const registerDeclarations = (node: EsTreeNode, scope: LexicalScope): void => {
+    if (isNodeOfType(node, "VariableDeclaration")) {
+      const target = node.kind === "var" ? hoistScopeOf(scope) : scope;
+      for (const declarator of node.declarations) {
+        declarePattern(declarator.id as EsTreeNode, target);
+      }
+      return;
+    }
+    if (isNodeOfType(node, "FunctionDeclaration") && node.id) {
+      declare(hoistScopeOf(scope), node.id.name);
+      return;
+    }
+    if (isNodeOfType(node, "ClassDeclaration") && node.id) {
+      declare(scope, node.id.name);
+      return;
+    }
+    if (isNodeOfType(node, "ImportDeclaration")) {
+      for (const specifier of node.specifiers) {
+        declare(hoistScopeOf(scope), specifier.local.name);
+      }
+    }
+  };
+
+  const walk = (node: EsTreeNode, scope: LexicalScope): void => {
+    if (isNodeOfType(node, "Identifier")) {
+      scopeOfIdentifier.set(node, scope);
+      return;
+    }
+
+    // A function declaration's own name belongs to the enclosing scope, not
+    // the function's; register it before descending into the new scope.
+    registerDeclarations(node, scope);
+
+    if (isFunctionLike(node)) {
+      const functionScope: LexicalScope = {
+        parent: scope,
+        isHoistBoundary: true,
+        bindings: new Map(),
+      };
+      // A named function expression's name is visible only inside itself.
+      if (isNodeOfType(node, "FunctionExpression") && node.id) {
+        declare(functionScope, node.id.name);
+      }
+      for (const parameter of node.params) declarePattern(parameter as EsTreeNode, functionScope);
+      forEachChildNode(node, (child) => walk(child, functionScope));
+      return;
+    }
+
+    if (opensBlockScope(node)) {
+      const blockScope: LexicalScope = {
+        parent: scope,
+        isHoistBoundary: false,
+        bindings: new Map(),
+      };
+      if (isNodeOfType(node, "CatchClause") && node.param) {
+        declarePattern(node.param as EsTreeNode, blockScope);
+      }
+      forEachChildNode(node, (child) => walk(child, blockScope));
+      return;
+    }
+
+    forEachChildNode(node, (child) => walk(child, scope));
+  };
+
+  const rootScope: LexicalScope = {
+    parent: null,
+    isHoistBoundary: true,
+    bindings: new Map(),
+  };
+  // Resolution is deferred, so a single declaration-registering walk
+  // suffices — top-level forward references and hoisting resolve by chain.
+  forEachChildNode(program, (child) => walk(child, rootScope));
+
+  return (identifier: EsTreeNode): BindingId | null => {
+    if (!isNodeOfType(identifier, "Identifier")) return null;
+    let scope: LexicalScope | null = scopeOfIdentifier.get(identifier) ?? rootScope;
+    while (scope !== null) {
+      const binding = scope.bindings.get(identifier.name);
+      if (binding !== undefined) return binding;
+      scope = scope.parent;
+    }
+    return null;
+  };
+};
diff --git a/packages/cfg/src/analysis/loops.ts b/packages/cfg/src/analysis/loops.ts
new file mode 100644
index 000000000..dfe110008
--- /dev/null
+++ b/packages/cfg/src/analysis/loops.ts
@@ -0,0 +1,30 @@
+import type { BasicBlock, FunctionCfg } from "../ir/basic-block.js";
+
+// A block is on a cycle iff it can reach itself by following non-throw
+// successor edges (loop back-edges are normal "uncond" edges; a
+// throw→catch edge is not a loop).
+export const computeCyclicBlocks = (cfg: FunctionCfg): Set<BasicBlock> => {
+  const cyclicBlocks = new Set<BasicBlock>();
+  for (const startBlock of cfg.blocks) {
+    const visited = new Set<BasicBlock>();
+    const queue: BasicBlock[] = [];
+    for (const edge of startBlock.successors) {
+      if (edge.kind !== "throw") queue.push(edge.to);
+    }
+    let isOnCycle = false;
+    while (queue.length > 0) {
+      const block = queue.shift()!;
+      if (block === startBlock) {
+        isOnCycle = true;
+        break;
+      }
+      if (visited.has(block)) continue;
+      visited.add(block);
+      for (const edge of block.successors) {
+        if (edge.kind !== "throw") queue.push(edge.to);
+      }
+    }
+    if (isOnCycle) cyclicBlocks.add(startBlock);
+  }
+  return cyclicBlocks;
+};
diff --git a/packages/cfg/src/analysis/node-order.ts b/packages/cfg/src/analysis/node-order.ts
new file mode 100644
index 000000000..b285ce1b0
--- /dev/null
+++ b/packages/cfg/src/analysis/node-order.ts
@@ -0,0 +1,22 @@
+import type { EsTreeNode } from "../ast/es-tree-node.js";
+import { forEachChildNode } from "../ast/for-each-child-node.js";
+import { isFunctionLike } from "../ast/is-function-like.js";
+
+// Source-order index for every node owned by this function (not
+// descending into nested functions). Used to break ties for two nodes
+// that share a basic block: within a straight-line block the earlier
+// node dominates the later one.
+export const computeNodeOrder = (
+  functionNode: EsTreeNode,
+  body: EsTreeNode,
+): Map<EsTreeNode, number> => {
+  const nodeOrder = new Map<EsTreeNode, number>();
+  let nextOrder = 0;
+  const walk = (node: EsTreeNode): void => {
+    if (!nodeOrder.has(node)) nodeOrder.set(node, nextOrder++);
+    if (node !== functionNode && isFunctionLike(node)) return;
+    forEachChildNode(node, walk);
+  };
+  walk(body);
+  return nodeOrder;
+};
diff --git a/packages/cfg/src/analysis/places-by-block.ts b/packages/cfg/src/analysis/places-by-block.ts
new file mode 100644
index 000000000..268fdcb66
--- /dev/null
+++ b/packages/cfg/src/analysis/places-by-block.ts
@@ -0,0 +1,35 @@
+import type { EsTreeNode } from "../ast/es-tree-node.js";
+import { isFunctionLike } from "../ast/is-function-like.js";
+import type { BasicBlock, FunctionCfg } from "../ir/basic-block.js";
+import type { Place, ResolveBinding } from "../ir/place.js";
+import { collectParameterPlaces, collectPlaces } from "./defs-uses.js";
+
+// The ordered binding reads/writes of one function's CFG, bucketed into the
+// block each occurrence executes in (`cfg.blockOf`). Parameters are written
+// at the entry, before any body occurrence. This is the single source of
+// truth feeding both SSA construction (`ssa.ts`) and the SSA-keyed dataflow
+// analyses (`dataflow/definite-assignment.ts`) — both need the same
+// per-block, evaluation-ordered occurrence stream.
+export const collectPlacesByBlock = (
+  cfg: FunctionCfg,
+  owner: EsTreeNode,
+  resolveBinding: ResolveBinding,
+): Map<BasicBlock, Place[]> => {
+  const parameters = isFunctionLike(owner) ? (owner.params as EsTreeNode[]) : [];
+  const body = isFunctionLike(owner) ? (owner.body as EsTreeNode) : owner;
+  const parameterPlaces = collectParameterPlaces(parameters, resolveBinding);
+  const bodyPlaces = collectPlaces(body, resolveBinding);
+
+  const placesByBlock = new Map<BasicBlock, Place[]>();
+  const append = (block: BasicBlock, place: Place): void => {
+    const existing = placesByBlock.get(block);
+    if (existing) existing.push(place);
+    else placesByBlock.set(block, [place]);
+  };
+  for (const place of parameterPlaces) append(cfg.entry, place);
+  for (const place of bodyPlaces) {
+    const block = cfg.blockOf(place.node);
+    if (block) append(block, place);
+  }
+  return placesByBlock;
+};
diff --git a/packages/cfg/src/analysis/reachability.ts b/packages/cfg/src/analysis/reachability.ts
new file mode 100644
index 000000000..77f25e1d6
--- /dev/null
+++ b/packages/cfg/src/analysis/reachability.ts
@@ -0,0 +1,37 @@
+import type { BasicBlock, CfgEdge, FunctionCfg } from "../ir/basic-block.js";
+
+export const isBlockReachableFromBlock = (
+  fromBlock: BasicBlock,
+  toBlock: BasicBlock,
+  includeEdge: (edge: CfgEdge) => boolean = () => true,
+): boolean => {
+  const visited = new Set<BasicBlock>();
+  const queue: BasicBlock[] = [fromBlock];
+  while (queue.length > 0) {
+    const block = queue.shift()!;
+    for (const edge of block.successors) {
+      if (!includeEdge(edge)) continue;
+      if (edge.to === toBlock) return true;
+      if (!visited.has(edge.to)) {
+        visited.add(edge.to);
+        queue.push(edge.to);
+      }
+    }
+  }
+  return false;
+};
+
+// Blocks reachable from entry over EVERY edge kind (including catch
+// edges). Used to answer `isUnreachable` — a block with no path from
+// entry is dead code.
+export const computeReachableFromEntry = (cfg: FunctionCfg): Set<BasicBlock> => {
+  const visited = new Set<BasicBlock>();
+  const queue: BasicBlock[] = [cfg.entry];
+  while (queue.length > 0) {
+    const block = queue.shift()!;
+    if (visited.has(block)) continue;
+    visited.add(block);
+    for (const edge of block.successors) queue.push(edge.to);
+  }
+  return visited;
+};
diff --git a/packages/cfg/src/analysis/reverse-postorder.ts b/packages/cfg/src/analysis/reverse-postorder.ts
new file mode 100644
index 000000000..636746462
--- /dev/null
+++ b/packages/cfg/src/analysis/reverse-postorder.ts
@@ -0,0 +1,33 @@
+import type { BasicBlock } from "../ir/basic-block.js";
+
+// Reverse-postorder of every block reachable from `root` over the given
+// successor relation. RPO guarantees a block appears before all blocks it
+// strictly dominates, which is the ordering the Cooper-Harvey-Kennedy
+// dominance algorithm and forward dataflow both require. Iterative DFS so
+// deep CFGs can't blow the call stack.
+export const reversePostorder = (
+  root: BasicBlock,
+  successorsOf: (block: BasicBlock) => ReadonlyArray<BasicBlock>,
+): BasicBlock[] => {
+  const postorder: BasicBlock[] = [];
+  const visited = new Set<BasicBlock>([root]);
+  const stack: Array<{ block: BasicBlock; nextSuccessor: number }> = [
+    { block: root, nextSuccessor: 0 },
+  ];
+  while (stack.length > 0) {
+    const frame = stack[stack.length - 1]!;
+    const successors = successorsOf(frame.block);
+    if (frame.nextSuccessor < successors.length) {
+      const next = successors[frame.nextSuccessor++]!;
+      if (!visited.has(next)) {
+        visited.add(next);
+        stack.push({ block: next, nextSuccessor: 0 });
+      }
+    } else {
+      postorder.push(frame.block);
+      stack.pop();
+    }
+  }
+  postorder.reverse();
+  return postorder;
+};
diff --git a/packages/cfg/src/analysis/unconditional.ts b/packages/cfg/src/analysis/unconditional.ts
new file mode 100644
index 000000000..0883cc307
--- /dev/null
+++ b/packages/cfg/src/analysis/unconditional.ts
@@ -0,0 +1,54 @@
+import type { BasicBlock, FunctionCfg } from "../ir/basic-block.js";
+
+// A block B is "unconditional from entry" iff every execution path
+// from entry to exit passes through B. We compute this by, for each
+// block B, asking: if we removed B from the graph, is exit still
+// reachable from entry? If NO, B is on every path → unconditional.
+//
+// Cost: O(|blocks|^2) — fine for function-sized CFGs (typically <100
+// blocks). Avoids needing a full dominator tree.
+export const computeUnconditionalSet = (cfg: FunctionCfg): Set<BasicBlock> => {
+  // Skip "throw" edges when computing reachability — uncaught throws
+  // don't represent a normal completion path. This makes
+  // `if (x) throw; useHook();` evaluate as unconditional (the
+  // `useHook` block is the only normal path to exit).
+  const reachableFromEntry = (excluded: BasicBlock | null): Set<BasicBlock> => {
+    const visited = new Set<BasicBlock>();
+    const queue: BasicBlock[] = [];
+    if (cfg.entry !== excluded) queue.push(cfg.entry);
+    while (queue.length > 0) {
+      const block = queue.shift()!;
+      if (visited.has(block)) continue;
+      visited.add(block);
+      for (const edge of block.successors) {
+        if (edge.kind === "throw") continue;
+        if (edge.to === excluded) continue;
+        queue.push(edge.to);
+      }
+    }
+    return visited;
+  };
+
+  // Whole-graph reachability: any block NOT in this set is dead code
+  // (e.g. statements after an unconditional `return;` / `throw;`).
+  // Dead-code blocks vacuously satisfy "unconditional from entry"
+  // because the call site is never reached at runtime — there's
+  // nothing to constrain.
+  const reachableFromEntryFull = reachableFromEntry(null);
+
+  const unconditional = new Set<BasicBlock>();
+  // Entry is trivially on every path.
+  unconditional.add(cfg.entry);
+  // Exit is on every (terminating) path.
+  unconditional.add(cfg.exit);
+  for (const block of cfg.blocks) {
+    if (unconditional.has(block)) continue;
+    if (!reachableFromEntryFull.has(block)) {
+      unconditional.add(block);
+      continue;
+    }
+    const stillReaches = reachableFromEntry(block).has(cfg.exit);
+    if (!stillReaches) unconditional.add(block);
+  }
+  return unconditional;
+};
diff --git a/packages/cfg/src/ast/es-tree-node-of-type.ts b/packages/cfg/src/ast/es-tree-node-of-type.ts
new file mode 100644
index 000000000..277c3dea4
--- /dev/null
+++ b/packages/cfg/src/ast/es-tree-node-of-type.ts
@@ -0,0 +1,19 @@
+import type { TSESTree } from "@typescript-eslint/types";
+import type { EsTreeNode } from "./es-tree-node.js";
+import type { EsTreeNodeType } from "./es-tree-node-type.js";
+
+// Distributes over the union so we can override `parent` without collapsing
+// discriminants. TSESTree pins each node's parent to a specific node kind
+// (e.g. JSXAttribute.parent: JSXOpeningElement), but a walker assigns parent
+// freely as it descends, so we relax it to `EsTreeNode | null` here.
+type WithLooseParent<NodeType> = NodeType extends NodeType
+  ? Omit<NodeType, "parent"> & { parent?: EsTreeNode | null }
+  : never;
+
+// Resolves a string `type` discriminant to the real TSESTree shape when known,
+// falling back to a loose `EsTreeNode & { type }` for nodes that TSESTree
+// doesn't model (none today, but keeps the helper safe under future TS evolution).
+export type EsTreeNodeOfType<NodeType extends EsTreeNodeType> =
+  Extract<TSESTree.Node, { type: NodeType }> extends never
+    ? EsTreeNode & { type: NodeType }
+    : WithLooseParent<Extract<TSESTree.Node, { type: NodeType }>>;
diff --git a/packages/cfg/src/ast/es-tree-node-type.ts b/packages/cfg/src/ast/es-tree-node-type.ts
new file mode 100644
index 000000000..9c876f215
--- /dev/null
+++ b/packages/cfg/src/ast/es-tree-node-type.ts
@@ -0,0 +1,7 @@
+import type { TSESTree } from "@typescript-eslint/types";
+
+// TSESTree models `type` as `AST_NODE_TYPES` enum members. Wrapping the union
+// in a template literal widens it to the underlying string-literal values, so
+// callers can pass plain strings like `"FunctionDeclaration"` to `isNodeOfType`
+// without importing the enum.
+export type EsTreeNodeType = `${TSESTree.Node["type"]}`;
diff --git a/packages/cfg/src/ast/es-tree-node.ts b/packages/cfg/src/ast/es-tree-node.ts
new file mode 100644
index 000000000..2f451088d
--- /dev/null
+++ b/packages/cfg/src/ast/es-tree-node.ts
@@ -0,0 +1,15 @@
+import type { TSESTree } from "@typescript-eslint/types";
+
+// Distributes over the TSESTree.Node union so each member gets its `parent`
+// relaxed independently — TSESTree pins each node's parent to a specific
+// kind (e.g. JSXAttribute.parent: JSXOpeningElement) but a walker assigns
+// parent freely as it descends, so we re-broaden to `EsTreeNode | null` here.
+type WithLooseParent<NodeType> = NodeType extends NodeType
+  ? Omit<NodeType, "parent"> & { parent?: EsTreeNode | null }
+  : never;
+
+// THE AST node type the CFG builder walks. It's the full TSESTree
+// discriminated union (every concrete node kind) with the `parent` field
+// relaxed. Structurally identical to the consuming plugin's own
+// `EsTreeNode`, so nodes cross the package boundary without a cast.
+export type EsTreeNode = WithLooseParent<TSESTree.Node>;
diff --git a/packages/cfg/src/ast/for-each-child-node.ts b/packages/cfg/src/ast/for-each-child-node.ts
new file mode 100644
index 000000000..2e9870008
--- /dev/null
+++ b/packages/cfg/src/ast/for-each-child-node.ts
@@ -0,0 +1,19 @@
+import type { EsTreeNode } from "./es-tree-node.js";
+import { isAstNode } from "./is-ast-node.js";
+
+// Visit every direct child AST node of `node` (array entries and single
+// nodes alike), skipping the `parent` back-reference. The shared traversal
+// mechanics behind the recursive walkers in build/ and analysis/; callers
+// own the recursion and any function-boundary stop.
+export const forEachChildNode = (node: EsTreeNode, visit: (child: EsTreeNode) => void): void => {
+  const record = node as unknown as Record<string, unknown>;
+  for (const key of Object.keys(record)) {
+    if (key === "parent") continue;
+    const child = record[key];
+    if (Array.isArray(child)) {
+      for (const item of child) if (isAstNode(item)) visit(item);
+    } else if (isAstNode(child)) {
+      visit(child);
+    }
+  }
+};
diff --git a/packages/cfg/src/ast/has-type-property.ts b/packages/cfg/src/ast/has-type-property.ts
new file mode 100644
index 000000000..544ffdbda
--- /dev/null
+++ b/packages/cfg/src/ast/has-type-property.ts
@@ -0,0 +1,4 @@
+import type { ValueWithType } from "./value-with-type.js";
+
+export const hasTypeProperty = (value: unknown): value is ValueWithType =>
+  Boolean(value && typeof value === "object" && "type" in value);
diff --git a/packages/cfg/src/ast/is-ast-node.ts b/packages/cfg/src/ast/is-ast-node.ts
new file mode 100644
index 000000000..839a3e860
--- /dev/null
+++ b/packages/cfg/src/ast/is-ast-node.ts
@@ -0,0 +1,7 @@
+import type { EsTreeNode } from "./es-tree-node.js";
+import { hasTypeProperty } from "./has-type-property.js";
+
+export const isAstNode = (value: unknown): value is EsTreeNode => {
+  if (!hasTypeProperty(value)) return false;
+  return typeof value.type === "string";
+};
diff --git a/packages/cfg/src/ast/is-function-like.ts b/packages/cfg/src/ast/is-function-like.ts
new file mode 100644
index 000000000..ab75d37af
--- /dev/null
+++ b/packages/cfg/src/ast/is-function-like.ts
@@ -0,0 +1,21 @@
+import type { EsTreeNode } from "./es-tree-node.js";
+import type { EsTreeNodeOfType } from "./es-tree-node-of-type.js";
+import { isNodeOfType } from "./is-node-of-type.js";
+
+// Type-guard for the three "function-like" ESTree node shapes:
+// `ArrowFunctionExpression`, `FunctionExpression`, `FunctionDeclaration`.
+// Accepts `null | undefined` so callers walking parent chains don't need
+// their own pre-check. A function boundary is where the CFG stops
+// descending — every function gets its own graph.
+export const isFunctionLike = (
+  node: EsTreeNode | null | undefined,
+): node is
+  | EsTreeNodeOfType<"ArrowFunctionExpression">
+  | EsTreeNodeOfType<"FunctionExpression">
+  | EsTreeNodeOfType<"FunctionDeclaration"> =>
+  Boolean(
+    node &&
+    (isNodeOfType(node, "ArrowFunctionExpression") ||
+      isNodeOfType(node, "FunctionExpression") ||
+      isNodeOfType(node, "FunctionDeclaration")),
+  );
diff --git a/packages/cfg/src/ast/is-node-of-type.ts b/packages/cfg/src/ast/is-node-of-type.ts
new file mode 100644
index 000000000..04045075b
--- /dev/null
+++ b/packages/cfg/src/ast/is-node-of-type.ts
@@ -0,0 +1,8 @@
+import type { EsTreeNodeOfType } from "./es-tree-node-of-type.js";
+import type { EsTreeNodeType } from "./es-tree-node-type.js";
+import { hasTypeProperty } from "./has-type-property.js";
+
+export const isNodeOfType = <NodeType extends EsTreeNodeType>(
+  node: unknown,
+  type: NodeType,
+): node is EsTreeNodeOfType<NodeType> => Boolean(hasTypeProperty(node) && node.type === type);
diff --git a/packages/cfg/src/ast/value-with-type.ts b/packages/cfg/src/ast/value-with-type.ts
new file mode 100644
index 000000000..e85a2cc5c
--- /dev/null
+++ b/packages/cfg/src/ast/value-with-type.ts
@@ -0,0 +1,3 @@
+export interface ValueWithType {
+  type?: unknown;
+}
diff --git a/packages/cfg/src/build/build-expression.ts b/packages/cfg/src/build/build-expression.ts
new file mode 100644
index 000000000..784b35c21
--- /dev/null
+++ b/packages/cfg/src/build/build-expression.ts
@@ -0,0 +1,190 @@
+import type { EsTreeNode } from "../ast/es-tree-node.js";
+import { forEachChildNode } from "../ast/for-each-child-node.js";
+import { isAstNode } from "../ast/is-ast-node.js";
+import { isFunctionLike } from "../ast/is-function-like.js";
+import { isNodeOfType } from "../ast/is-node-of-type.js";
+import type { BasicBlock } from "../ir/basic-block.js";
+import { addEdge, createBlock, mapDescendantsToBlock, setTerminal } from "./cfg-builder.js";
+import type { CfgBuilder } from "./cfg-builder.js";
+
+const LOGICAL_ASSIGNMENT_OPERATORS = new Set(["&&=", "||=", "??="]);
+
+export const isLogicalAssignment = (node: EsTreeNode): boolean =>
+  isNodeOfType(node, "AssignmentExpression") &&
+  LOGICAL_ASSIGNMENT_OPERATORS.has((node as { operator: string }).operator);
+
+// True when an expression subtree contains short-circuiting control flow
+// we model as branches: a ternary, a `&&` / `||` / `??`, or a logical
+// assignment (`&&=` / `||=` / `??=`). Stops at nested function boundaries —
+// those get their own CFG. Lets `buildStatement` keep the cheap
+// `mapDescendantsToBlock` path for straight-line code and only pay the
+// block-splitting cost when an expression actually branches.
+export const containsExpressionControlFlow = (node: EsTreeNode): boolean => {
+  let found = false;
+  const visit = (current: EsTreeNode): void => {
+    if (found) return;
+    if (
+      isNodeOfType(current, "ConditionalExpression") ||
+      isNodeOfType(current, "LogicalExpression") ||
+      isNodeOfType(current, "ChainExpression") ||
+      isLogicalAssignment(current)
+    ) {
+      found = true;
+      return;
+    }
+    if (isFunctionLike(current)) return;
+    forEachChildNode(current, visit);
+  };
+  visit(node);
+  return found;
+};
+
+// Lower an expression's embedded control flow into the CFG — mirroring how
+// the React Compiler's HIR (and oxc_cfg) give a ternary's arms, a logical
+// operator's right operand, and a logical assignment's right operand their
+// own basic blocks. A hook / setState / effect nested in any of those is
+// then correctly seen as CONDITIONAL (short-circuited on some path), which
+// statement-level lowering alone cannot see. Returns — and maps the node to
+// — the block where its value becomes available (its join): a node's effect
+// happens AFTER its operands, so a `wrap(cond ? a : b)` call lands in the
+// post-arms block, not the pre-test one. Never descends into nested
+// functions (they get their own CFG).
+export const buildExpression = (
+  builder: CfgBuilder,
+  node: EsTreeNode | null | undefined,
+  current: BasicBlock,
+): BasicBlock => {
+  if (!node) return current;
+  if (isFunctionLike(node)) {
+    builder.nodeBlock.set(node, current);
+    return current;
+  }
+
+  if (isNodeOfType(node, "ConditionalExpression")) {
+    const afterTest = buildExpression(builder, node.test as EsTreeNode, current);
+    const consequentBlock = createBlock(builder);
+    const alternateBlock = createBlock(builder);
+    const merge = createBlock(builder);
+    addEdge(afterTest, consequentBlock, "cond");
+    addEdge(afterTest, alternateBlock, "cond");
+    setTerminal(afterTest, { kind: "ternary", fallthrough: merge });
+    const consequentEnd = buildExpression(builder, node.consequent as EsTreeNode, consequentBlock);
+    const alternateEnd = buildExpression(builder, node.alternate as EsTreeNode, alternateBlock);
+    addEdge(consequentEnd, merge, "uncond");
+    addEdge(alternateEnd, merge, "uncond");
+    builder.nodeBlock.set(node, merge);
+    return merge;
+  }
+
+  if (isNodeOfType(node, "LogicalExpression") || isLogicalAssignment(node)) {
+    // The left/target operand is always evaluated; the right operand is
+    // conditional (short-circuited). From the post-left block one successor
+    // evaluates the RHS and one skips straight to the join.
+    const afterLeft = buildExpression(builder, (node as { left: EsTreeNode }).left, current);
+    const rightBlock = createBlock(builder);
+    const merge = createBlock(builder);
+    addEdge(afterLeft, rightBlock, "cond");
+    addEdge(afterLeft, merge, "cond");
+    setTerminal(afterLeft, { kind: "logical", fallthrough: merge });
+    const rightEnd = buildExpression(builder, (node as { right: EsTreeNode }).right, rightBlock);
+    addEdge(rightEnd, merge, "uncond");
+    builder.nodeBlock.set(node, merge);
+    return merge;
+  }
+
+  if (isNodeOfType(node, "ChainExpression")) {
+    // Optional chain (`a?.b.c?.()`). The React Compiler models this with a
+    // SINGLE shared short-circuit target: any nullish optional link jumps to
+    // the same continuation (value = undefined). Everything to the right of
+    // a `?.` is conditional; the chain value is available at `merge`, where
+    // the short-circuit and the fully-evaluated paths rejoin.
+    const merge = createBlock(builder);
+    const chainEnd = buildOptionalChainLink(
+      builder,
+      (node as { expression: EsTreeNode }).expression,
+      current,
+      merge,
+    );
+    addEdge(chainEnd, merge, "uncond");
+    builder.nodeBlock.set(node, merge);
+    return merge;
+  }
+
+  // Generic expression: evaluate children left-to-right, threading the
+  // block so a control-flow child splits the siblings that follow it. The
+  // node itself completes in the final cursor block.
+  let cursor = current;
+  forEachChildNode(node, (child) => {
+    cursor = buildExpression(builder, child, cursor);
+  });
+  builder.nodeBlock.set(node, cursor);
+  return cursor;
+};
+
+// Lower one link of an optional chain in evaluation order (innermost
+// object/callee first), branching to the shared `merge` (short-circuit) at
+// each optional `?.`. Mirrors the compiler's `lowerOptional*Expression`:
+// the base is evaluated unconditionally, then anything to the right of the
+// `?.` — a computed property, a deeper access, or a call's arguments —
+// evaluates in the conditional continuation. Returns the block where this
+// link's value is available on the non-short-circuit path.
+const buildOptionalChainLink = (
+  builder: CfgBuilder,
+  node: EsTreeNode,
+  current: BasicBlock,
+  merge: BasicBlock,
+): BasicBlock => {
+  if (isNodeOfType(node, "MemberExpression")) {
+    const afterObject = buildOptionalChainLink(builder, node.object as EsTreeNode, current, merge);
+    let cursor = afterObject;
+    if ((node as { optional?: boolean }).optional) {
+      const continuation = createBlock(builder);
+      addEdge(afterObject, continuation, "cond"); // base non-nullish → continue
+      addEdge(afterObject, merge, "cond"); // base nullish → short-circuit
+      setTerminal(afterObject, { kind: "optional", fallthrough: merge });
+      cursor = continuation;
+    }
+    // A computed key (`a?.[expr]`) is only evaluated once the base is known
+    // non-nullish, so it belongs in the post-branch continuation.
+    if ((node as { computed?: boolean }).computed) {
+      cursor = buildExpression(builder, node.property as EsTreeNode, cursor);
+    }
+    builder.nodeBlock.set(node, cursor);
+    return cursor;
+  }
+
+  if (isNodeOfType(node, "CallExpression")) {
+    const afterCallee = buildOptionalChainLink(builder, node.callee as EsTreeNode, current, merge);
+    let cursor = afterCallee;
+    if ((node as { optional?: boolean }).optional) {
+      const continuation = createBlock(builder);
+      addEdge(afterCallee, continuation, "cond");
+      addEdge(afterCallee, merge, "cond");
+      setTerminal(afterCallee, { kind: "optional", fallthrough: merge });
+      cursor = continuation;
+    }
+    for (const argument of (node as { arguments: ReadonlyArray<EsTreeNode> }).arguments) {
+      if (isAstNode(argument)) cursor = buildExpression(builder, argument, cursor);
+    }
+    builder.nodeBlock.set(node, cursor);
+    return cursor;
+  }
+
+  // Chain base (an identifier, a parenthesized expression, a non-optional
+  // sub-expression): evaluate it normally.
+  return buildExpression(builder, node, current);
+};
+
+// Evaluate a sub-expression in `current`, returning the block where its
+// value is available. Falls back to the cheap whole-subtree mapping when
+// the expression has no embedded control flow.
+export const buildSubExpression = (
+  builder: CfgBuilder,
+  node: EsTreeNode | null | undefined,
+  current: BasicBlock,
+): BasicBlock => {
+  if (!node) return current;
+  if (containsExpressionControlFlow(node)) return buildExpression(builder, node, current);
+  mapDescendantsToBlock(builder, node, current);
+  return current;
+};
diff --git a/packages/cfg/src/build/build-function-cfg.ts b/packages/cfg/src/build/build-function-cfg.ts
new file mode 100644
index 000000000..d778e7859
--- /dev/null
+++ b/packages/cfg/src/build/build-function-cfg.ts
@@ -0,0 +1,60 @@
+import type { EsTreeNode } from "../ast/es-tree-node.js";
+import { isNodeOfType } from "../ast/is-node-of-type.js";
+import type { BasicBlock, FunctionCfg } from "../ir/basic-block.js";
+import {
+  addEdge,
+  appendInstruction,
+  createBlock,
+  createBuilder,
+  setTerminal,
+} from "./cfg-builder.js";
+import { buildSubExpression } from "./build-expression.js";
+import { buildStatements } from "./build-statement.js";
+
+// Back-fill the terminal of every block that merely falls through: a
+// single successor becomes a `goto` (normal variant); a block with no
+// successor keeps the `unreachable` sentinel (a genuine orphan or the
+// function exit). Branching blocks already carry an explicit terminal.
+const finalizeTerminals = (blocks: ReadonlyArray<BasicBlock>, exit: BasicBlock): void => {
+  for (const block of blocks) {
+    if (block === exit) continue;
+    if (block.terminal.kind !== "unreachable") continue;
+    if (block.successors.length === 1) {
+      setTerminal(block, { kind: "goto", block: block.successors[0]!.to, variant: "normal" });
+    }
+  }
+};
+
+export const buildFunctionCfg = (functionNode: EsTreeNode, body: EsTreeNode): FunctionCfg => {
+  const builder = createBuilder();
+  const entry = createBlock(builder);
+  const exit = createBlock(builder);
+  builder.entry = entry;
+  builder.exit = exit;
+
+  let bodyEnd: BasicBlock;
+  if (isNodeOfType(body, "BlockStatement") || isNodeOfType(body, "Program")) {
+    bodyEnd = buildStatements(builder, body.body as EsTreeNode[], entry);
+  } else {
+    // Arrow expression body: a single Expression. Lower its control flow so
+    // `() => cond ? useA() : useB()` sees the hooks as conditional.
+    bodyEnd = buildSubExpression(builder, body, entry);
+  }
+  // Implicit return / fall-off the end of the function body.
+  addEdge(bodyEnd, exit, "uncond");
+  if (bodyEnd.terminal.kind === "unreachable") {
+    appendInstruction(bodyEnd, body, "implicit-return");
+    setTerminal(bodyEnd, { kind: "return", argument: null });
+  }
+  finalizeTerminals(builder.blocks, exit);
+
+  const blockOf = (node: EsTreeNode): BasicBlock | null => builder.nodeBlock.get(node) ?? null;
+
+  return {
+    owner: functionNode,
+    entry,
+    exit,
+    blocks: builder.blocks,
+    blockOf,
+  };
+};
diff --git a/packages/cfg/src/build/build-statement.ts b/packages/cfg/src/build/build-statement.ts
new file mode 100644
index 000000000..2bf2373f9
--- /dev/null
+++ b/packages/cfg/src/build/build-statement.ts
@@ -0,0 +1,476 @@
+import type { EsTreeNode } from "../ast/es-tree-node.js";
+import { isNodeOfType } from "../ast/is-node-of-type.js";
+import { isBlockReachableFromBlock } from "../analysis/reachability.js";
+import { isConstantTruthyTest } from "../constant-condition.js";
+import type { BasicBlock } from "../ir/basic-block.js";
+import type { TerminalCase } from "../ir/terminal.js";
+import {
+  addEdge,
+  appendInstruction,
+  appendNode,
+  createBlock,
+  mapDescendantsToBlock,
+  setTerminal,
+} from "./cfg-builder.js";
+import type { CfgBuilder } from "./cfg-builder.js";
+import {
+  buildExpression,
+  buildSubExpression,
+  containsExpressionControlFlow,
+} from "./build-expression.js";
+
+// Returns true if the node introduces internal control flow we want to
+// expand into the CFG (rather than treat as a single statement).
+const hasInternalControlFlow = (node: EsTreeNode): boolean => {
+  switch (node.type) {
+    case "IfStatement":
+    case "WhileStatement":
+    case "DoWhileStatement":
+    case "ForStatement":
+    case "ForInStatement":
+    case "ForOfStatement":
+    case "SwitchStatement":
+    case "TryStatement":
+    case "ReturnStatement":
+    case "ThrowStatement":
+    case "BreakStatement":
+    case "ContinueStatement":
+    case "BlockStatement":
+    case "LabeledStatement":
+      return true;
+    default:
+      return false;
+  }
+};
+
+const findLabel = (
+  builder: CfgBuilder,
+  name: string | null,
+): { merge: BasicBlock; header: BasicBlock | null } | null => {
+  if (name === null) {
+    // Unlabeled break/continue → innermost loop or switch.
+    if (builder.loopStack.length > 0) {
+      const top = builder.loopStack[builder.loopStack.length - 1]!;
+      return { merge: top.merge, header: top.header };
+    }
+    if (builder.switchStack.length > 0) {
+      const top = builder.switchStack[builder.switchStack.length - 1]!;
+      return { merge: top.merge, header: null };
+    }
+    return null;
+  }
+  for (let index = builder.labelStack.length - 1; index >= 0; index--) {
+    const entry = builder.labelStack[index]!;
+    if (entry.label === name) return { merge: entry.merge, header: entry.header };
+  }
+  return null;
+};
+
+// A loop wrapped by one or more `LabeledStatement`s is the `continue <label>`
+// target for those labels. Their entries are pushed with `header: null` (the
+// `break <label>` merge is known up front, but the continue target only
+// exists once the loop builds its header), so point them at this header now —
+// otherwise a labeled `continue` resolves to a header-less entry and the
+// builder emits no back-edge, diverging from real control flow.
+const linkEnclosingLabelsToLoopHeader = (
+  builder: CfgBuilder,
+  statement: EsTreeNode,
+  header: BasicBlock,
+): void => {
+  let parent = statement.parent ?? null;
+  let stackIndex = builder.labelStack.length - 1;
+  while (parent && isNodeOfType(parent, "LabeledStatement") && stackIndex >= 0) {
+    const entry = builder.labelStack[stackIndex]!;
+    if (entry.label !== parent.label.name) break;
+    entry.header = header;
+    stackIndex -= 1;
+    parent = parent.parent ?? null;
+  }
+};
+
+// A protected region (the `try` body or a `catch` body) "completes
+// normally" iff its end block is reachable from its entry without
+// leaving via an exception (`throw`) or diverting into the `finally`
+// (`finalize`). `return` / `throw` / `break` route elsewhere and strand
+// the region end as an orphan, so it stays unreachable here.
+const completesNormally = (regionEntry: BasicBlock, regionEnd: BasicBlock): boolean =>
+  regionEntry === regionEnd ||
+  isBlockReachableFromBlock(
+    regionEntry,
+    regionEnd,
+    (edge) => edge.kind !== "throw" && edge.kind !== "finalize",
+  );
+
+// Process a list of statements inside a block. Returns the block where
+// fall-through control flow ends up. Caller is responsible for
+// connecting that to the next block (e.g. exit, merge).
+export const buildStatements = (
+  builder: CfgBuilder,
+  statements: ReadonlyArray<EsTreeNode>,
+  current: BasicBlock,
+): BasicBlock => {
+  let cursor = current;
+  for (const statement of statements) {
+    cursor = buildStatement(builder, statement, cursor);
+  }
+  return cursor;
+};
+
+// Process a single statement. Returns the block where control flow
+// ends up after the statement (possibly an orphan if the statement is
+// terminating).
+export const buildStatement = (
+  builder: CfgBuilder,
+  statement: EsTreeNode,
+  current: BasicBlock,
+): BasicBlock => {
+  // Tag the statement node itself with the current block before
+  // descending — even for control-flow statements, the syntactic
+  // statement itself is "in" the current block.
+  builder.nodeBlock.set(statement, current);
+
+  if (!hasInternalControlFlow(statement)) {
+    appendNode(builder, current, statement);
+    // A plain statement can still carry expression-level control flow
+    // (`const x = cond ? useA() : useB()`, `cond && setState()`): lower it
+    // so the branched sub-expressions land in their own blocks. Otherwise
+    // every descendant maps to the current block (cheap path).
+    if (containsExpressionControlFlow(statement)) {
+      return buildExpression(builder, statement, current);
+    }
+    mapDescendantsToBlock(builder, statement, current);
+    return current;
+  }
+
+  if (isNodeOfType(statement, "BlockStatement")) {
+    return buildStatements(builder, statement.body as EsTreeNode[], current);
+  }
+
+  if (isNodeOfType(statement, "LabeledStatement")) {
+    // Push the label onto the stack with a placeholder; the body will
+    // create the merge block for `break <label>`.
+    const merge = createBlock(builder);
+    const labelEntry = {
+      label: statement.label.name,
+      merge,
+      header: null as BasicBlock | null,
+    };
+    builder.labelStack.push(labelEntry);
+    const body = (statement as { body: EsTreeNode }).body;
+    const end = buildStatement(builder, body, current);
+    builder.labelStack.pop();
+    addEdge(end, merge, "uncond");
+    return merge;
+  }
+
+  if (isNodeOfType(statement, "ReturnStatement")) {
+    const afterArgument = buildSubExpression(
+      builder,
+      statement.argument as EsTreeNode | null,
+      current,
+    );
+    appendInstruction(afterArgument, statement, "return");
+    setTerminal(afterArgument, {
+      kind: "return",
+      argument: (statement.argument as EsTreeNode | null) ?? null,
+    });
+    addEdge(afterArgument, builder.exit, "uncond");
+    // Any subsequent statement is unreachable; create an orphan.
+    return createBlock(builder);
+  }
+
+  if (isNodeOfType(statement, "ThrowStatement")) {
+    const afterArgument = buildSubExpression(
+      builder,
+      statement.argument as EsTreeNode | null,
+      current,
+    );
+    // If we're in a try-catch, route to the catch (uncond — it's a
+    // normal control-flow successor for our analysis). Otherwise the
+    // throw escapes the function: route to exit but tag the edge as
+    // "throw" so the unconditional-from-entry analysis can ignore it
+    // (rules-of-hooks treats `if (x) throw; useHook();` as
+    // unconditional because the throw branch never normally returns).
+    appendInstruction(afterArgument, statement, "throw");
+    setTerminal(afterArgument, {
+      kind: "throw",
+      argument: statement.argument as EsTreeNode,
+    });
+    const top = builder.tryStack[builder.tryStack.length - 1];
+    if (top?.catch) {
+      addEdge(afterArgument, top.catch, "uncond");
+    } else if (top?.finally) {
+      addEdge(afterArgument, top.finally, "uncond");
+    } else {
+      addEdge(afterArgument, builder.exit, "throw");
+    }
+    return createBlock(builder);
+  }
+
+  if (isNodeOfType(statement, "BreakStatement")) {
+    const targetLabel = statement.label ? statement.label.name : null;
+    const target = findLabel(builder, targetLabel);
+    appendInstruction(current, statement, "break");
+    const gotoTarget = target ? target.merge : builder.exit;
+    addEdge(current, gotoTarget, "uncond");
+    setTerminal(current, { kind: "goto", block: gotoTarget, variant: "break" });
+    return createBlock(builder);
+  }
+
+  if (isNodeOfType(statement, "ContinueStatement")) {
+    const targetLabel = statement.label ? statement.label.name : null;
+    const target = findLabel(builder, targetLabel);
+    appendInstruction(current, statement, "continue");
+    if (target?.header) {
+      addEdge(current, target.header, "backedge");
+      setTerminal(current, { kind: "goto", block: target.header, variant: "continue" });
+    }
+    return createBlock(builder);
+  }
+
+  if (isNodeOfType(statement, "IfStatement")) {
+    // Evaluate the test (its own short-circuits, e.g. `if (a && useX())`,
+    // become real branches); the if then forks from the post-test block.
+    const afterTest = buildSubExpression(builder, statement.test as EsTreeNode, current);
+    appendInstruction(afterTest, statement.test as EsTreeNode, "condition");
+    const thenBlock = createBlock(builder);
+    const merge = createBlock(builder);
+    addEdge(afterTest, thenBlock, "cond");
+    const thenEnd = buildStatement(builder, statement.consequent as EsTreeNode, thenBlock);
+    addEdge(thenEnd, merge, "uncond");
+    let alternateBlock = merge;
+    if (statement.alternate) {
+      alternateBlock = createBlock(builder);
+      addEdge(afterTest, alternateBlock, "cond");
+      const elseEnd = buildStatement(builder, statement.alternate as EsTreeNode, alternateBlock);
+      addEdge(elseEnd, merge, "uncond");
+    } else {
+      addEdge(afterTest, merge, "cond");
+    }
+    setTerminal(afterTest, {
+      kind: "if",
+      test: statement.test as EsTreeNode,
+      consequent: thenBlock,
+      alternate: alternateBlock,
+      fallthrough: merge,
+    });
+    return merge;
+  }
+
+  if (isNodeOfType(statement, "WhileStatement") || isNodeOfType(statement, "DoWhileStatement")) {
+    const isDoWhile = isNodeOfType(statement, "DoWhileStatement");
+    const isInfinite = isConstantTruthyTest(statement.test as EsTreeNode);
+    const header = createBlock(builder);
+    const body = createBlock(builder);
+    const merge = createBlock(builder);
+    // The test is re-evaluated on the header every iteration, so its nodes
+    // belong to the header — not the pre-header `current` block.
+    mapDescendantsToBlock(builder, statement.test as EsTreeNode, header);
+    appendInstruction(header, statement.test as EsTreeNode, "condition");
+    if (isDoWhile) {
+      // do-while: enter body first.
+      addEdge(current, body, "uncond");
+    } else {
+      addEdge(current, header, "uncond");
+      addEdge(header, body, "cond");
+      if (!isInfinite) addEdge(header, merge, "cond");
+    }
+    linkEnclosingLabelsToLoopHeader(builder, statement, header);
+    builder.loopStack.push({ header, merge, label: null });
+    const bodyEnd = buildStatement(builder, statement.body as EsTreeNode, body);
+    builder.loopStack.pop();
+    if (isDoWhile) {
+      // After body, test is evaluated → loop back or merge.
+      addEdge(bodyEnd, header, "backedge");
+      addEdge(header, body, "cond");
+      if (!isInfinite) addEdge(header, merge, "cond");
+    } else {
+      addEdge(bodyEnd, header, "backedge");
+    }
+    setTerminal(header, {
+      kind: isDoWhile ? "do-while" : "while",
+      test: statement.test as EsTreeNode,
+      body,
+      fallthrough: merge,
+    });
+    return merge;
+  }
+
+  if (isNodeOfType(statement, "ForStatement")) {
+    // The init runs once in the pre-header; the test is re-evaluated on the
+    // header every iteration, so only the init stays on `current`.
+    if (statement.init) mapDescendantsToBlock(builder, statement.init as EsTreeNode, current);
+    // `for (;;)` (no test) and `for (; true;)` never exit via condition.
+    const isInfinite = isConstantTruthyTest(statement.test as EsTreeNode | null);
+    const header = createBlock(builder);
+    const body = createBlock(builder);
+    const merge = createBlock(builder);
+    // The update runs after the body on the back-edge, so it gets its own
+    // latch block. Mapping it onto the header (entered first from `init`,
+    // before the body) would model `update` as running before the first
+    // iteration, skewing SSA placement for loop-carried bindings
+    // (`for (let i = 0; i < n; i++)`). `continue` targets the latch too, so
+    // the update still runs on an explicit `continue`. With no update clause
+    // the latch collapses onto the header (identical to a plain back-edge).
+    const latch = statement.update ? createBlock(builder) : header;
+    if (statement.test) mapDescendantsToBlock(builder, statement.test as EsTreeNode, header);
+    addEdge(current, header, "uncond");
+    addEdge(header, body, "cond");
+    if (!isInfinite) addEdge(header, merge, "cond");
+    linkEnclosingLabelsToLoopHeader(builder, statement, latch);
+    builder.loopStack.push({ header: latch, merge, label: null });
+    const bodyEnd = buildStatement(builder, statement.body as EsTreeNode, body);
+    builder.loopStack.pop();
+    if (statement.update) {
+      mapDescendantsToBlock(builder, statement.update as EsTreeNode, latch);
+      addEdge(bodyEnd, latch, "uncond");
+      addEdge(latch, header, "backedge");
+    } else {
+      addEdge(bodyEnd, header, "backedge");
+    }
+    setTerminal(header, { kind: "for", body, fallthrough: merge });
+    return merge;
+  }
+
+  if (isNodeOfType(statement, "ForInStatement") || isNodeOfType(statement, "ForOfStatement")) {
+    mapDescendantsToBlock(builder, statement.right as EsTreeNode, current);
+    mapDescendantsToBlock(builder, statement.left as EsTreeNode, current);
+    // A for-in / for-of iterates a (finite) collection, so the loop can
+    // always complete — the header→merge edge stays.
+    const header = createBlock(builder);
+    const body = createBlock(builder);
+    const merge = createBlock(builder);
+    addEdge(current, header, "uncond");
+    addEdge(header, body, "cond");
+    addEdge(header, merge, "cond");
+    linkEnclosingLabelsToLoopHeader(builder, statement, header);
+    builder.loopStack.push({ header, merge, label: null });
+    const bodyEnd = buildStatement(builder, statement.body as EsTreeNode, body);
+    builder.loopStack.pop();
+    addEdge(bodyEnd, header, "backedge");
+    setTerminal(header, {
+      kind: isNodeOfType(statement, "ForInStatement") ? "for-in" : "for-of",
+      body,
+      fallthrough: merge,
+    });
+    return merge;
+  }
+
+  if (isNodeOfType(statement, "SwitchStatement")) {
+    const afterDiscriminant = buildSubExpression(
+      builder,
+      statement.discriminant as EsTreeNode,
+      current,
+    );
+    const merge = createBlock(builder);
+    appendInstruction(afterDiscriminant, statement.discriminant as EsTreeNode, "condition");
+    builder.switchStack.push({ merge, label: null });
+    let previousCaseEnd: BasicBlock | null = null;
+    let hasDefault = false;
+    const terminalCases: TerminalCase[] = [];
+    for (const switchCase of statement.cases) {
+      const caseBlock = createBlock(builder);
+      addEdge(afterDiscriminant, caseBlock, "cond");
+      // Fall-through from previous case (no break) connects to this case.
+      if (previousCaseEnd) addEdge(previousCaseEnd, caseBlock, "uncond");
+      const caseTest = (switchCase as { test: EsTreeNode | null }).test;
+      terminalCases.push({ test: caseTest, block: caseBlock });
+      const caseEnd = buildStatements(
+        builder,
+        (switchCase as { consequent: ReadonlyArray<EsTreeNode> }).consequent,
+        caseBlock,
+      );
+      previousCaseEnd = caseEnd;
+      if (caseTest === null) hasDefault = true;
+    }
+    builder.switchStack.pop();
+    if (previousCaseEnd) addEdge(previousCaseEnd, merge, "uncond");
+    if (!hasDefault) addEdge(afterDiscriminant, merge, "cond"); // no case matched
+    setTerminal(afterDiscriminant, {
+      kind: "switch",
+      discriminant: statement.discriminant as EsTreeNode,
+      cases: terminalCases,
+      fallthrough: merge,
+    });
+    return merge;
+  }
+
+  if (isNodeOfType(statement, "TryStatement")) {
+    const tryBlock = createBlock(builder);
+    const merge = createBlock(builder);
+    const catchBlock = statement.handler ? createBlock(builder) : null;
+    const finallyBlock = statement.finalizer ? createBlock(builder) : null;
+    addEdge(current, tryBlock, "uncond");
+    setTerminal(current, {
+      kind: "try",
+      block: tryBlock,
+      handler: catchBlock,
+      finalizer: finallyBlock,
+      fallthrough: merge,
+    });
+
+    // Try body. A throw anywhere inside is modeled by a "cond" edge to
+    // catch (conditionally reached, like any branch — keeps catch out of
+    // the "every normal path" set without making it dead).
+    builder.tryStack.push({ catch: catchBlock, finally: finallyBlock });
+    const tryEnd = buildStatements(
+      builder,
+      (statement.block as { body: ReadonlyArray<EsTreeNode> }).body,
+      tryBlock,
+    );
+    builder.tryStack.pop();
+    if (catchBlock) addEdge(tryBlock, catchBlock, "cond");
+    const tryCompletesNormally = completesNormally(tryBlock, tryEnd);
+
+    let catchEnd: BasicBlock | null = null;
+    if (statement.handler && catchBlock) {
+      catchEnd = buildStatement(
+        builder,
+        (statement.handler as { body: EsTreeNode }).body,
+        catchBlock,
+      );
+    }
+    const catchCompletesNormally = catchEnd !== null && completesNormally(catchBlock!, catchEnd);
+
+    // The try STATEMENT can complete normally when its body does, or —
+    // if the throw is caught — when the catch body does.
+    const protectedCompletesNormally = catchBlock
+      ? tryCompletesNormally || catchCompletesNormally
+      : tryCompletesNormally;
+
+    if (finallyBlock && statement.finalizer) {
+      // `finally` runs on every path through the region — wire it from
+      // the region entries so a `return`/`throw` in try/catch can't make
+      // it unreachable. Also connect the normal ends so dominance sees
+      // the in-order path.
+      addEdge(tryBlock, finallyBlock, "finalize");
+      if (catchBlock) addEdge(catchBlock, finallyBlock, "finalize");
+      if (tryCompletesNormally && tryEnd !== tryBlock) addEdge(tryEnd, finallyBlock, "finalize");
+      if (catchEnd && catchCompletesNormally && catchEnd !== catchBlock) {
+        addEdge(catchEnd, finallyBlock, "finalize");
+      }
+      const finallyEnd = buildStatements(
+        builder,
+        (statement.finalizer as { body: ReadonlyArray<EsTreeNode> }).body,
+        finallyBlock,
+      );
+      // Resume-after-finally: code after the try is reachable only if the
+      // protected region could complete normally. (If `finally` itself
+      // completes abruptly, `finallyEnd` is an orphan and this join is
+      // dead regardless.)
+      if (protectedCompletesNormally) addEdge(finallyEnd, merge, "join");
+      return merge;
+    }
+
+    // No finally: after-try is reached from whichever of try / catch can
+    // complete normally.
+    if (tryCompletesNormally) addEdge(tryEnd, merge, "uncond");
+    if (catchEnd && catchCompletesNormally) addEdge(catchEnd, merge, "uncond");
+    return merge;
+  }
+
+  // Fallback (unhandled control-flow construct): treat as plain.
+  appendNode(builder, current, statement);
+  mapDescendantsToBlock(builder, statement, current);
+  return current;
+};
diff --git a/packages/cfg/src/build/cfg-builder.ts b/packages/cfg/src/build/cfg-builder.ts
new file mode 100644
index 000000000..4aefc76a9
--- /dev/null
+++ b/packages/cfg/src/build/cfg-builder.ts
@@ -0,0 +1,88 @@
+import type { EsTreeNode } from "../ast/es-tree-node.js";
+import { forEachChildNode } from "../ast/for-each-child-node.js";
+import { isFunctionLike } from "../ast/is-function-like.js";
+import type { BasicBlock, CfgEdge, CfgEdgeKind } from "../ir/basic-block.js";
+import type { InstructionKind } from "../ir/instruction.js";
+import type { Terminal } from "../ir/terminal.js";
+
+export interface CfgBuilder {
+  nextBlockId: number;
+  blocks: BasicBlock[];
+  entry: BasicBlock;
+  exit: BasicBlock;
+  // Map every AST node visited inside this function to the block it
+  // was appended to.
+  nodeBlock: Map<EsTreeNode, BasicBlock>;
+  // Stack of "loop-merge" / "loop-header" pairs for break/continue.
+  loopStack: Array<{ header: BasicBlock; merge: BasicBlock; label: string | null }>;
+  // Stack of "switch-merge" + label, for break in switches.
+  switchStack: Array<{ merge: BasicBlock; label: string | null }>;
+  // Stack of try-catch contexts: where to route ThrowStatement to.
+  tryStack: Array<{ catch: BasicBlock | null; finally: BasicBlock | null }>;
+  // Labels currently in scope: maps label name → loop/switch entry.
+  labelStack: Array<{ label: string; merge: BasicBlock; header: BasicBlock | null }>;
+}
+
+export const createBuilder = (): CfgBuilder => ({
+  nextBlockId: 0,
+  blocks: [],
+  entry: null as unknown as BasicBlock,
+  exit: null as unknown as BasicBlock,
+  nodeBlock: new Map(),
+  loopStack: [],
+  switchStack: [],
+  tryStack: [],
+  labelStack: [],
+});
+
+export const createBlock = (builder: CfgBuilder): BasicBlock => {
+  const block: BasicBlock = {
+    id: builder.nextBlockId++,
+    instructions: [],
+    // Sentinel; back-filled to `goto`/`unreachable` once the block's
+    // successors are known (see finalizeTerminals).
+    terminal: { kind: "unreachable" },
+    successors: [],
+    predecessors: [],
+    phis: [],
+  };
+  builder.blocks.push(block);
+  return block;
+};
+
+export const addEdge = (from: BasicBlock, to: BasicBlock, kind: CfgEdgeKind): void => {
+  const edge: CfgEdge = { from, to, kind };
+  from.successors.push(edge);
+  to.predecessors.push(edge);
+};
+
+export const setTerminal = (block: BasicBlock, terminal: Terminal): void => {
+  block.terminal = terminal;
+};
+
+export const appendInstruction = (
+  block: BasicBlock,
+  node: EsTreeNode,
+  kind: InstructionKind,
+): void => {
+  block.instructions.push({ node, kind });
+};
+
+export const appendNode = (builder: CfgBuilder, block: BasicBlock, node: EsTreeNode): void => {
+  appendInstruction(block, node, "statement");
+  if (!builder.nodeBlock.has(node)) {
+    builder.nodeBlock.set(node, block);
+  }
+};
+
+// Recursively map every descendant of `node` to `block`, EXCEPT when
+// crossing a function boundary (inner functions get their own CFG).
+export const mapDescendantsToBlock = (
+  builder: CfgBuilder,
+  node: EsTreeNode,
+  block: BasicBlock,
+): void => {
+  builder.nodeBlock.set(node, block);
+  if (isFunctionLike(node)) return;
+  forEachChildNode(node, (child) => mapDescendantsToBlock(builder, child, block));
+};
diff --git a/packages/cfg/src/constant-condition.ts b/packages/cfg/src/constant-condition.ts
new file mode 100644
index 000000000..a523c899a
--- /dev/null
+++ b/packages/cfg/src/constant-condition.ts
@@ -0,0 +1,57 @@
+import type { EsTreeNode } from "./ast/es-tree-node.js";
+import { isNodeOfType } from "./ast/is-node-of-type.js";
+
+// Fold a condition expression to a compile-time boolean, or null when it
+// is not a provable constant. Covers the cases oxc's `is_infinite_loop_start`
+// folds: literals, the `Infinity` / `NaN` / `undefined` globals, a
+// no-substitution template, and unary `!` / `void`.
+//
+// NOTE: like oxc's structural check but unlike a binding-resolving one, the
+// `Infinity` / `NaN` / `undefined` arm matches by identifier name only. A
+// shadowed global (`function f(Infinity) { while (Infinity) … }`) is a known
+// false positive; it is pathological and matches the structural reference.
+const evaluateConstantCondition = (test: EsTreeNode): boolean | null => {
+  if (isNodeOfType(test, "Literal")) {
+    const literalValue = test.value;
+    if (typeof literalValue === "boolean") return literalValue;
+    if (typeof literalValue === "number") return literalValue !== 0;
+    if (typeof literalValue === "string") return literalValue.length > 0;
+    if (typeof literalValue === "bigint") return literalValue !== BigInt(0);
+    if (literalValue === null) return false;
+    return null;
+  }
+
+  if (isNodeOfType(test, "Identifier")) {
+    if (test.name === "Infinity") return true;
+    if (test.name === "NaN" || test.name === "undefined") return false;
+    return null;
+  }
+
+  if (isNodeOfType(test, "TemplateLiteral")) {
+    if (test.expressions.length === 0 && test.quasis.length === 1) {
+      return (test.quasis[0]!.value.cooked ?? "").length > 0;
+    }
+    return null;
+  }
+
+  if (isNodeOfType(test, "UnaryExpression")) {
+    if (test.operator === "void") return false;
+    if (test.operator === "!") {
+      const folded = evaluateConstantCondition(test.argument as EsTreeNode);
+      return folded === null ? null : !folded;
+    }
+  }
+
+  return null;
+};
+
+// A loop whose test is a compile-time truthy constant (`while (true)`,
+// `do … while (1)`) — or a `for (;;)` with no test at all — never exits
+// through its condition. oxc's `is_infinite_loop_start` makes the same
+// call to decide a loop's exit is unreachable; we use it both to omit the
+// loop header→merge edge (so `while (true) {} after();` flags `after()` as
+// unreachable) and to answer the public `isInfiniteLoopStart`.
+export const isConstantTruthyTest = (test: EsTreeNode | null | undefined): boolean => {
+  if (!test) return true;
+  return evaluateConstantCondition(test) === true;
+};
diff --git a/packages/cfg/src/constants.ts b/packages/cfg/src/constants.ts
new file mode 100644
index 000000000..917d31ebf
--- /dev/null
+++ b/packages/cfg/src/constants.ts
@@ -0,0 +1,16 @@
+// Hard caps for the bounded path-feasibility checker (Layer D). Exceeding
+// any cap makes the checker return `unknown` rather than spend unbounded
+// time — and `unknown` never suppresses a diagnostic, so the caps only ever
+// cost precision, never soundness.
+
+// Max number of lowered facts (branch guards) in one path condition.
+export const MAX_PATH_CLAUSES = 64;
+
+// Max number of distinct abstract atoms (SSA values + constants) tracked.
+export const MAX_PATH_VARS = 48;
+
+// Max number of counterexample paths enumerated when refining a diagnostic.
+export const MAX_VIOLATION_PATHS = 32;
+
+// Max block length of any single enumerated counterexample path.
+export const MAX_PATH_BLOCK_LENGTH = 128;
diff --git a/packages/cfg/src/control-flow-graph.ts b/packages/cfg/src/control-flow-graph.ts
new file mode 100644
index 000000000..d294e32ae
--- /dev/null
+++ b/packages/cfg/src/control-flow-graph.ts
@@ -0,0 +1,233 @@
+import type { EsTreeNode } from "./ast/es-tree-node.js";
+import { forEachChildNode } from "./ast/for-each-child-node.js";
+import { isFunctionLike } from "./ast/is-function-like.js";
+import { isNodeOfType } from "./ast/is-node-of-type.js";
+import { computeCyclicBlocks } from "./analysis/loops.js";
+import { computeDominatorTree, computePostDominatorTree } from "./analysis/dominators.js";
+import type { DominatorTree } from "./analysis/dominators.js";
+import { computeNodeOrder } from "./analysis/node-order.js";
+import { computeReachableFromEntry, isBlockReachableFromBlock } from "./analysis/reachability.js";
+import { computeUnconditionalSet } from "./analysis/unconditional.js";
+import { buildFunctionCfg } from "./build/build-function-cfg.js";
+import { isConstantTruthyTest } from "./constant-condition.js";
+import { cfgToDot } from "./dot.js";
+import type { BasicBlock, FunctionCfg } from "./ir/basic-block.js";
+
+export type { BasicBlock, CfgEdge, CfgEdgeKind, FunctionCfg } from "./ir/basic-block.js";
+export type { Instruction, InstructionKind } from "./ir/instruction.js";
+export type { GotoVariant, Terminal, TerminalCase } from "./ir/terminal.js";
+export type { DominatorTree } from "./analysis/dominators.js";
+export { cfgToDot } from "./dot.js";
+
+export interface ControlFlowAnalysis {
+  readonly cfgFor: (functionLike: EsTreeNode) => FunctionCfg | null;
+  readonly enclosingFunction: (node: EsTreeNode) => EsTreeNode | null;
+  // On every path from the enclosing function's entry to its exit.
+  readonly isUnconditionalFromEntry: (node: EsTreeNode) => boolean;
+  // Some control-flow path lets execution flow from `fromNode` to
+  // `toNode` within the same enclosing function. Cross-function pairs
+  // are never reachable.
+  readonly isReachable: (fromNode: EsTreeNode, toNode: EsTreeNode) => boolean;
+  // `aNode` executes on EVERY path that reaches `bNode` (graph
+  // dominance). A guard that dominates a sink runs before it on every
+  // path.
+  readonly dominates: (aNode: EsTreeNode, bNode: EsTreeNode) => boolean;
+  // `bNode` executes on EVERY path from `aNode` to the function exit
+  // (graph post-dominance). A cleanup that post-dominates a
+  // subscription always runs after it.
+  readonly postDominates: (bNode: EsTreeNode, aNode: EsTreeNode) => boolean;
+  // The node's basic block is part of a cycle in ITS OWN function's CFG
+  // — i.e. it executes once per iteration of an enclosing loop. A node
+  // inside a callback that merely escapes a loop is NOT inside the loop
+  // (the callback is a separate function with its own acyclic CFG).
+  readonly isInsideLoop: (node: EsTreeNode) => boolean;
+  // The node's block is not reachable from the function entry (dead
+  // code after an unconditional return / throw / break).
+  readonly isUnreachable: (node: EsTreeNode) => boolean;
+  // The dominance frontier of the node's basic block (Cytron et al.) —
+  // the join points where the node's dominance ends. Exposed raw as the
+  // SSA-construction seam; returns [] for an unreachable / unknown node.
+  readonly dominanceFrontier: (node: EsTreeNode) => BasicBlock[];
+  // The loop statement's test is a compile-time truthy constant (or absent
+  // for `for (;;)`), so the loop never exits via its condition (oxc's
+  // `is_infinite_loop_start`). False for non-loop nodes.
+  readonly isInfiniteLoopStart: (node: EsTreeNode) => boolean;
+  // Graphviz DOT of a function-like (or Program) node's CFG, for
+  // debugging / parity snapshots. Null when the node has no CFG.
+  readonly toDot: (functionLike: EsTreeNode) => string | null;
+}
+
+interface FunctionCfgEntry {
+  cfg: FunctionCfg;
+  unconditionalSet: Set<BasicBlock>;
+  dominatorTree: DominatorTree;
+  postDominatorTree: DominatorTree;
+  cyclicBlocks: Set<BasicBlock>;
+  reachableFromEntry: Set<BasicBlock>;
+  nodeOrder: Map<EsTreeNode, number>;
+}
+
+// Walks the AST building a CFG for every function-like node + the
+// program. Lookups for an arbitrary AST node find the enclosing
+// function and consult that function's CFG.
+export const analyzeControlFlow = (program: EsTreeNode): ControlFlowAnalysis => {
+  const functionCfgs = new Map<EsTreeNode, FunctionCfgEntry>();
+
+  const buildFor = (functionNode: EsTreeNode, body: EsTreeNode): void => {
+    const cfg = buildFunctionCfg(functionNode, body);
+    functionCfgs.set(functionNode, {
+      cfg,
+      unconditionalSet: computeUnconditionalSet(cfg),
+      dominatorTree: computeDominatorTree(cfg.entry),
+      postDominatorTree: computePostDominatorTree(cfg.exit),
+      cyclicBlocks: computeCyclicBlocks(cfg),
+      reachableFromEntry: computeReachableFromEntry(cfg),
+      nodeOrder: computeNodeOrder(functionNode, body),
+    });
+  };
+
+  // Build CFG for the program itself (treat as a "function" for
+  // top-level reasoning); buildFunctionCfg lowers a Program body in place.
+  if (isNodeOfType(program, "Program")) {
+    buildFor(program, program);
+  }
+
+  // Walk every function-like node, build its own CFG.
+  const visit = (node: EsTreeNode): void => {
+    if (isFunctionLike(node)) {
+      const body = (node as { body: EsTreeNode }).body;
+      if (body) buildFor(node, body);
+    }
+    forEachChildNode(node, visit);
+  };
+  visit(program);
+
+  const enclosingFunction = (node: EsTreeNode): EsTreeNode | null => {
+    let current: EsTreeNode | null | undefined = node;
+    while (current) {
+      if (isFunctionLike(current)) return current;
+      if (isNodeOfType(current, "Program")) return current;
+      current = current.parent ?? null;
+    }
+    return null;
+  };
+
+  const cfgFor = (functionLike: EsTreeNode): FunctionCfg | null => {
+    return functionCfgs.get(functionLike)?.cfg ?? null;
+  };
+
+  const isUnconditionalFromEntry = (node: EsTreeNode): boolean => {
+    const owner = enclosingFunction(node);
+    if (!owner) return true;
+    const entry = functionCfgs.get(owner);
+    if (!entry) return true;
+    const block = entry.cfg.blockOf(node);
+    if (!block) return true;
+    return entry.unconditionalSet.has(block);
+  };
+
+  interface LocatedNode {
+    owner: EsTreeNode;
+    entry: FunctionCfgEntry;
+    block: BasicBlock;
+  }
+
+  const locate = (node: EsTreeNode): LocatedNode | null => {
+    const owner = enclosingFunction(node);
+    if (!owner) return null;
+    const entry = functionCfgs.get(owner);
+    if (!entry) return null;
+    const block = entry.cfg.blockOf(node);
+    if (!block) return null;
+    return { owner, entry, block };
+  };
+
+  const isReachable = (fromNode: EsTreeNode, toNode: EsTreeNode): boolean => {
+    const from = locate(fromNode);
+    const to = locate(toNode);
+    if (!from || !to || from.owner !== to.owner) return false;
+    if (from.block === to.block) {
+      if (from.entry.cyclicBlocks.has(from.block)) return true;
+      const fromOrder = from.entry.nodeOrder.get(fromNode) ?? 0;
+      const toOrder = to.entry.nodeOrder.get(toNode) ?? 0;
+      return fromOrder <= toOrder;
+    }
+    return isBlockReachableFromBlock(from.block, to.block);
+  };
+
+  const dominates = (aNode: EsTreeNode, bNode: EsTreeNode): boolean => {
+    const dominator = locate(aNode);
+    const dominated = locate(bNode);
+    if (!dominator || !dominated || dominator.owner !== dominated.owner) return false;
+    if (dominator.block === dominated.block) {
+      const aOrder = dominator.entry.nodeOrder.get(aNode) ?? 0;
+      const bOrder = dominated.entry.nodeOrder.get(bNode) ?? 0;
+      return aOrder <= bOrder;
+    }
+    return dominated.entry.dominatorTree.dominates(dominator.block, dominated.block);
+  };
+
+  const postDominates = (bNode: EsTreeNode, aNode: EsTreeNode): boolean => {
+    const postDominator = locate(bNode);
+    const postDominated = locate(aNode);
+    if (!postDominator || !postDominated || postDominator.owner !== postDominated.owner) {
+      return false;
+    }
+    if (postDominator.block === postDominated.block) {
+      const bOrder = postDominator.entry.nodeOrder.get(bNode) ?? 0;
+      const aOrder = postDominated.entry.nodeOrder.get(aNode) ?? 0;
+      return bOrder >= aOrder;
+    }
+    return postDominated.entry.postDominatorTree.dominates(
+      postDominator.block,
+      postDominated.block,
+    );
+  };
+
+  const isInsideLoop = (node: EsTreeNode): boolean => {
+    const located = locate(node);
+    if (!located) return false;
+    return located.entry.cyclicBlocks.has(located.block);
+  };
+
+  const isUnreachable = (node: EsTreeNode): boolean => {
+    const located = locate(node);
+    if (!located) return false;
+    return !located.entry.reachableFromEntry.has(located.block);
+  };
+
+  const dominanceFrontier = (node: EsTreeNode): BasicBlock[] => {
+    const located = locate(node);
+    if (!located) return [];
+    return [...located.entry.dominatorTree.dominanceFrontierOf(located.block)];
+  };
+
+  const isInfiniteLoopStart = (node: EsTreeNode): boolean => {
+    if (isNodeOfType(node, "ForStatement")) {
+      return isConstantTruthyTest((node.test as EsTreeNode | null) ?? null);
+    }
+    if (isNodeOfType(node, "WhileStatement") || isNodeOfType(node, "DoWhileStatement")) {
+      return isConstantTruthyTest(node.test as EsTreeNode);
+    }
+    return false;
+  };
+
+  const toDot = (functionLike: EsTreeNode): string | null => {
+    const cfg = cfgFor(functionLike);
+    return cfg ? cfgToDot(cfg) : null;
+  };
+
+  return {
+    cfgFor,
+    enclosingFunction,
+    isUnconditionalFromEntry,
+    isReachable,
+    dominates,
+    postDominates,
+    isInsideLoop,
+    isUnreachable,
+    dominanceFrontier,
+    isInfiniteLoopStart,
+    toDot,
+  };
+};
diff --git a/packages/cfg/src/dataflow/definite-assignment.ts b/packages/cfg/src/dataflow/definite-assignment.ts
new file mode 100644
index 000000000..f66ac1190
--- /dev/null
+++ b/packages/cfg/src/dataflow/definite-assignment.ts
@@ -0,0 +1,165 @@
+import type { EsTreeNode } from "../ast/es-tree-node.js";
+import { enumerateFunctions } from "../analysis/enumerate-functions.js";
+import { collectPlacesByBlock } from "../analysis/places-by-block.js";
+import { analyzeControlFlow } from "../control-flow-graph.js";
+import type { BasicBlock } from "../ir/basic-block.js";
+import type { BindingId, Place, ResolveBinding } from "../ir/place.js";
+import { createLexicalBindingResolver } from "../analysis/lexical-binding-resolver.js";
+import { enumerateSimplePaths } from "../path/enumerate-paths.js";
+import type { ResolveValueAtom } from "../path/path-condition.js";
+import { everyCounterexampleInfeasible } from "../path/prune-infeasible.js";
+import type { Lattice } from "./lattice.js";
+import { solveDataflow } from "./solve.js";
+
+// Definite-assignment over the SSA occurrence stream: at each binding read,
+// is the binding guaranteed to have been written on EVERY path from the
+// function entry to that read? A "no" is a possibly-unassigned read — the
+// signal a TDZ / read-before-write rule keys off. This is a forward MUST
+// analysis: a binding is definitely assigned at a merge only if assigned on
+// all predecessors (set intersection at joins). Built on the generic
+// `solveDataflow` worklist.
+export interface DefiniteAssignmentAnalysis {
+  // `node` is a binding read that some entry→read path reaches without a
+  // prior write of that binding. Unknown / unreachable reads answer `false`
+  // (we only ever report a provable maybe-unassigned).
+  readonly isMaybeUnassignedAt: (node: EsTreeNode) => boolean;
+}
+
+export interface DefiniteAssignmentOptions {
+  // Layer D refinement (opt-in): when supplied, a read is reported only if at
+  // least one of its unassigned paths is not provably infeasible. Maps a test
+  // identifier to its abstract atom (the caller keys it by `ssa.versionAt` so
+  // correlated branches collapse to one atom).
+  readonly resolveValue?: ResolveValueAtom;
+}
+
+// The set of bindings definitely assigned so far, or `top` for a block not
+// yet reached by the worklist (the join identity — intersecting with it is
+// a no-op, so an unprocessed predecessor never falsely constrains a join).
+type AssignedFact = ReadonlySet<BindingId> | "top";
+
+const intersect = (left: ReadonlySet<BindingId>, right: ReadonlySet<BindingId>): Set<BindingId> => {
+  const [smaller, larger] = left.size <= right.size ? [left, right] : [right, left];
+  const result = new Set<BindingId>();
+  for (const binding of smaller) {
+    if (larger.has(binding)) result.add(binding);
+  }
+  return result;
+};
+
+const setsEqual = (left: ReadonlySet<BindingId>, right: ReadonlySet<BindingId>): boolean => {
+  if (left.size !== right.size) return false;
+  for (const binding of left) {
+    if (!right.has(binding)) return false;
+  }
+  return true;
+};
+
+const assignedLattice: Lattice<AssignedFact> = {
+  bottom: "top",
+  join: (left, right) => {
+    if (left === "top") return right;
+    if (right === "top") return left;
+    return intersect(left, right);
+  },
+  equals: (left, right) => {
+    if (left === "top" || right === "top") return left === right;
+    return setsEqual(left, right);
+  },
+};
+
+const writeBindingsByBlock = (
+  placesByBlock: ReadonlyMap<BasicBlock, ReadonlyArray<Place>>,
+): Map<BasicBlock, Set<BindingId>> => {
+  const writesByBlock = new Map<BasicBlock, Set<BindingId>>();
+  for (const [block, places] of placesByBlock) {
+    const writes = new Set<BindingId>();
+    for (const place of places) {
+      if (place.kind === "write") writes.add(place.binding);
+    }
+    if (writes.size > 0) writesByBlock.set(block, writes);
+  }
+  return writesByBlock;
+};
+
+export const analyzeDefiniteAssignment = (
+  program: EsTreeNode,
+  resolveBinding: ResolveBinding = createLexicalBindingResolver(program),
+  options: DefiniteAssignmentOptions = {},
+): DefiniteAssignmentAnalysis => {
+  const controlFlow = analyzeControlFlow(program);
+  const maybeUnassignedByNode = new Map<EsTreeNode, boolean>();
+  const { resolveValue } = options;
+
+  for (const owner of enumerateFunctions(program)) {
+    const cfg = controlFlow.cfgFor(owner);
+    if (!cfg) continue;
+    const placesByBlock = collectPlacesByBlock(cfg, owner, resolveBinding);
+    const writesByBlock = writeBindingsByBlock(placesByBlock);
+
+    // Layer D: a flagged read is a false positive iff every entry→read path
+    // that skips all of the binding's writes is provably infeasible. Memoized
+    // by (binding, block): every read of the same binding in one block shares
+    // the same path enumeration, so it runs once rather than per read.
+    const infeasibleByBindingBlock = new Map<string, boolean>();
+    const everyUnassignedPathInfeasible = (readBlock: BasicBlock, binding: BindingId): boolean => {
+      if (!resolveValue) return false;
+      const cacheKey = `${binding}@${readBlock.id}`;
+      const cached = infeasibleByBindingBlock.get(cacheKey);
+      if (cached !== undefined) return cached;
+      const writeBlocks = new Set<BasicBlock>();
+      for (const [candidate, writes] of writesByBlock) {
+        if (writes.has(binding)) writeBlocks.add(candidate);
+      }
+      const result = enumerateSimplePaths({
+        start: cfg.entry,
+        isGoal: (block) => block === readBlock,
+        canTraverse: (block) => !writeBlocks.has(block),
+      });
+      const infeasible = everyCounterexampleInfeasible(result, resolveValue);
+      infeasibleByBindingBlock.set(cacheKey, infeasible);
+      return infeasible;
+    };
+
+    const result = solveDataflow<AssignedFact>({
+      cfg,
+      lattice: assignedLattice,
+      direction: "forward",
+      // Nothing is assigned at the function entry.
+      boundary: new Set<BindingId>(),
+      transfer: (block, incoming) => {
+        if (incoming === "top") return "top";
+        const writes = writesByBlock.get(block);
+        if (!writes) return incoming;
+        const out = new Set(incoming);
+        for (const binding of writes) out.add(binding);
+        return out;
+      },
+    });
+
+    // Resolve each read at its exact occurrence point: the block-entry fact
+    // plus the writes that precede it within the same block.
+    for (const [block, places] of placesByBlock) {
+      const entryFact = result.entryFactOf(block);
+      // An unreachable block (never assigned a real fact) has no live read.
+      if (entryFact === "top") continue;
+      const assigned = new Set(entryFact);
+      for (const place of places) {
+        if (place.kind === "write") {
+          assigned.add(place.binding);
+          continue;
+        }
+        // A `declare` neither assigns nor reads; only a real read can be
+        // possibly-unassigned.
+        if (place.kind === "read" && !assigned.has(place.binding)) {
+          if (everyUnassignedPathInfeasible(block, place.binding)) continue;
+          maybeUnassignedByNode.set(place.node, true);
+        }
+      }
+    }
+  }
+
+  return {
+    isMaybeUnassignedAt: (node) => maybeUnassignedByNode.get(node) ?? false,
+  };
+};
diff --git a/packages/cfg/src/dataflow/lattice.ts b/packages/cfg/src/dataflow/lattice.ts
new file mode 100644
index 000000000..ba9724d9f
--- /dev/null
+++ b/packages/cfg/src/dataflow/lattice.ts
@@ -0,0 +1,12 @@
+// A bounded join-semilattice: the abstract-domain contract a monotone
+// dataflow analysis is parameterized over. `bottom` is the identity for
+// `join` (the most-precise/uninitialized element the worklist seeds
+// interior blocks with); `join` merges facts arriving from multiple
+// control-flow predecessors (or successors, backward); `equals` is the
+// fixpoint test. Implementations MUST make `join` monotone and the lattice
+// finite-height so the worklist terminates.
+export interface Lattice<Fact> {
+  readonly bottom: Fact;
+  readonly join: (left: Fact, right: Fact) => Fact;
+  readonly equals: (left: Fact, right: Fact) => boolean;
+}
diff --git a/packages/cfg/src/dataflow/solve.ts b/packages/cfg/src/dataflow/solve.ts
new file mode 100644
index 000000000..fa5bbefa0
--- /dev/null
+++ b/packages/cfg/src/dataflow/solve.ts
@@ -0,0 +1,80 @@
+import type { BasicBlock, FunctionCfg } from "../ir/basic-block.js";
+import { predecessorBlocks, successorBlocks } from "../analysis/block-edges.js";
+import { reversePostorder } from "../analysis/reverse-postorder.js";
+import type { Lattice } from "./lattice.js";
+
+export type DataflowDirection = "forward" | "backward";
+
+export interface DataflowSpec<Fact> {
+  readonly cfg: FunctionCfg;
+  readonly lattice: Lattice<Fact>;
+  readonly direction: DataflowDirection;
+  // The fact at the graph's open end: the entry's in-fact (forward) or the
+  // exit's out-fact (backward).
+  readonly boundary: Fact;
+  // The block's effect on a fact flowing through it, in the analysis
+  // direction: forward maps the in-fact to the out-fact; backward maps the
+  // out-fact to the in-fact.
+  readonly transfer: (block: BasicBlock, incoming: Fact) => Fact;
+}
+
+export interface DataflowResult<Fact> {
+  // The fact holding at each block's entry / exit (source-order ends,
+  // regardless of analysis direction).
+  readonly entryFactOf: (block: BasicBlock) => Fact;
+  readonly exitFactOf: (block: BasicBlock) => Fact;
+}
+
+// A generic monotone dataflow solver: iterate the transfer functions over a
+// reverse-postorder sweep until the fact assignment reaches a fixpoint.
+// Forward analyses flow over successors from the entry; backward analyses
+// flow over predecessors from the exit. The same RPO-to-fixpoint shape the
+// dominator solver uses (`analysis/dominators.ts`), generalized over an
+// arbitrary `Lattice`. This is the engine the definite-assignment and
+// typestate analyses are built on.
+export const solveDataflow = <Fact>(spec: DataflowSpec<Fact>): DataflowResult<Fact> => {
+  const { cfg, lattice, direction, boundary, transfer } = spec;
+  const isForward = direction === "forward";
+
+  // The "incoming" relation we join over, and the open-end block whose
+  // incoming fact is the boundary rather than a join of neighbors.
+  const root = isForward ? cfg.entry : cfg.exit;
+  const incomingNeighbors = isForward ? predecessorBlocks : successorBlocks;
+  const order = reversePostorder(root, isForward ? successorBlocks : predecessorBlocks);
+
+  // incoming[block] = fact flowing into the block along the analysis
+  // direction; outgoing[block] = transfer(block, incoming[block]).
+  const incoming = new Map<BasicBlock, Fact>();
+  const outgoing = new Map<BasicBlock, Fact>();
+  for (const block of order) {
+    incoming.set(block, lattice.bottom);
+    outgoing.set(block, lattice.bottom);
+  }
+
+  const reachable = new Set(order);
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const block of order) {
+      let incomingFact = block === root ? boundary : lattice.bottom;
+      for (const neighbor of incomingNeighbors(block)) {
+        if (!reachable.has(neighbor)) continue;
+        incomingFact = lattice.join(incomingFact, outgoing.get(neighbor)!);
+      }
+      incoming.set(block, incomingFact);
+      const outgoingFact = transfer(block, incomingFact);
+      if (!lattice.equals(outgoing.get(block)!, outgoingFact)) {
+        outgoing.set(block, outgoingFact);
+        changed = true;
+      }
+    }
+  }
+
+  // Map the direction-relative facts back to source-order entry/exit.
+  const entryFactOf = (block: BasicBlock): Fact =>
+    (isForward ? incoming.get(block) : outgoing.get(block)) ?? lattice.bottom;
+  const exitFactOf = (block: BasicBlock): Fact =>
+    (isForward ? outgoing.get(block) : incoming.get(block)) ?? lattice.bottom;
+
+  return { entryFactOf, exitFactOf };
+};
diff --git a/packages/cfg/src/dot.ts b/packages/cfg/src/dot.ts
new file mode 100644
index 000000000..7eb02c9db
--- /dev/null
+++ b/packages/cfg/src/dot.ts
@@ -0,0 +1,76 @@
+import type { BasicBlock, FunctionCfg } from "./ir/basic-block.js";
+import type { Phi, SsaIdentifier } from "./ir/place.js";
+import type { Terminal } from "./ir/terminal.js";
+
+const ssaName = (identifier: SsaIdentifier): string => `${identifier.name}#${identifier.version}`;
+
+const phiLabel = (phi: Phi): string => {
+  const operands = [...phi.operands]
+    .map(([predecessor, value]) => `b${predecessor.id}:${ssaName(value)}`)
+    .join(", ");
+  return `${ssaName(phi.identifier)} = φ(${operands})`;
+};
+
+const escapeDotLabel = (text: string): string =>
+  text.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\l");
+
+const terminalLabel = (terminal: Terminal): string => {
+  switch (terminal.kind) {
+    case "goto":
+      return `goto b${terminal.block.id} (${terminal.variant})`;
+    case "if":
+      return `if → b${terminal.consequent.id} / b${terminal.alternate.id}`;
+    case "switch":
+      return `switch (${terminal.cases.length} cases)`;
+    case "while":
+    case "do-while":
+      return `${terminal.kind} → b${terminal.body.id}`;
+    case "for":
+    case "for-in":
+    case "for-of":
+      return `${terminal.kind} → b${terminal.body.id}`;
+    case "logical":
+    case "ternary":
+    case "optional":
+      return `${terminal.kind} ↦ b${terminal.fallthrough.id}`;
+    case "try":
+      return `try → b${terminal.block.id}`;
+    case "return":
+      return "return";
+    case "throw":
+      return "throw";
+    case "unreachable":
+      return "unreachable";
+  }
+};
+
+const blockLabel = (block: BasicBlock): string => {
+  const lines = [`#${block.id}`];
+  for (const phi of block.phis) {
+    lines.push(phiLabel(phi));
+  }
+  for (const instruction of block.instructions) {
+    lines.push(`${instruction.kind}: ${instruction.node.type}`);
+  }
+  lines.push(`» ${terminalLabel(block.terminal)}`);
+  return lines.join("\n");
+};
+
+// Graphviz DOT rendering of a function CFG — mirroring oxc_cfg's
+// `DisplayDot`. Blocks become boxes listing their typed instructions and
+// terminal; edges are labeled with their kind. Deterministic (creation
+// order) so it is snapshot-stable. Debugging aid; no rule consumes it.
+export const cfgToDot = (cfg: FunctionCfg): string => {
+  const lines: string[] = ['digraph "cfg" {'];
+  lines.push("  node [shape=box fontname=monospace];");
+  for (const block of cfg.blocks) {
+    lines.push(`  b${block.id} [label="${escapeDotLabel(blockLabel(block))}\\l"];`);
+  }
+  for (const block of cfg.blocks) {
+    for (const edge of block.successors) {
+      lines.push(`  b${edge.from.id} -> b${edge.to.id} [label="${edge.kind}"];`);
+    }
+  }
+  lines.push("}");
+  return lines.join("\n");
+};
diff --git a/packages/cfg/src/index.ts b/packages/cfg/src/index.ts
new file mode 100644
index 000000000..0b41eec34
--- /dev/null
+++ b/packages/cfg/src/index.ts
@@ -0,0 +1,28 @@
+// Public surface of `@react-doctor/cfg`. The package is private and its sole
+// consumer is `oxlint-plugin-react-doctor`, so this barrel exposes only what
+// that consumer imports — the four analysis entry points, their result types,
+// and the shared AST helpers. Everything else (the IR, dataflow framework,
+// path-feasibility primitives, dominator utilities) is an implementation
+// detail reached through deep paths from inside this package and its tests.
+export { analyzeControlFlow } from "./control-flow-graph.js";
+export type { ControlFlowAnalysis } from "./control-flow-graph.js";
+export { analyzeSsa } from "./ssa.js";
+export type { SsaAnalysis } from "./ssa.js";
+export { analyzeDefiniteAssignment } from "./dataflow/definite-assignment.js";
+export type { DefiniteAssignmentAnalysis } from "./dataflow/definite-assignment.js";
+export { verifyTypestate } from "./typestate/verify.js";
+export type {
+  ResourceEvent,
+  TypestateViolation,
+  VerifyTypestateOptions,
+} from "./typestate/verify.js";
+export type { TypestateAutomaton } from "./typestate/automaton.js";
+export { ssaValueResolver } from "./path/ssa-value-atom.js";
+export type { EsTreeNode } from "./ast/es-tree-node.js";
+export type { EsTreeNodeOfType } from "./ast/es-tree-node-of-type.js";
+export type { EsTreeNodeType } from "./ast/es-tree-node-type.js";
+export type { ValueWithType } from "./ast/value-with-type.js";
+export { isAstNode } from "./ast/is-ast-node.js";
+export { isFunctionLike } from "./ast/is-function-like.js";
+export { isNodeOfType } from "./ast/is-node-of-type.js";
+export { hasTypeProperty } from "./ast/has-type-property.js";
diff --git a/packages/cfg/src/ir/basic-block.ts b/packages/cfg/src/ir/basic-block.ts
new file mode 100644
index 000000000..fe6234fbf
--- /dev/null
+++ b/packages/cfg/src/ir/basic-block.ts
@@ -0,0 +1,83 @@
+import type { EsTreeNode } from "../ast/es-tree-node.js";
+import type { Instruction } from "./instruction.js";
+import type { Phi } from "./place.js";
+import type { Terminal } from "./terminal.js";
+
+// Per-function CFG. Mirrors the subset of `oxc_cfg` we need to answer:
+// "Is this AST node guaranteed to execute on every call to its
+// enclosing function?" (isUnconditionalFromEntry — used by rules-of-hooks)
+//
+// Edge kinds, mapped from oxc_cfg's richer `EdgeType` taxonomy to the
+// distinctions our analyses actually consume:
+//   uncond   — sequential fall-through (oxc `Normal`)
+//   cond     — a conditional branch: true / false / loop-enter / case
+//              (oxc `Jump` + the `Normal` else-arm; we don't split them
+//              because reachability/dominance weight every edge equally)
+//   backedge — a loop's back-edge to its header (oxc `Backedge`); the
+//              sole creator of cycles, so loop detection keys off it
+//   throw    — an exception path to a catch/finally or the function exit
+//              (oxc `Error`); excluded from "normal completion" reachability
+//   finalize — entry into a `finally` block, taken on every path through
+//              the protected region — even a `return`/`throw` in `try`
+//              (oxc `Finalize`). An abrupt completion can't sever it, so
+//              the `finally` body stays reachable.
+//   join     — the normal continuation after a `finally` completes, added
+//              only when the protected region can itself complete normally
+//              (oxc `Join`). Its absence is what makes code after
+//              `try { return } finally { … }` unreachable.
+// oxc's `NewFunction` edge is absent by construction: every function gets
+// its own CFG here, so reachability never crosses a function boundary.
+//
+// Coverage vs. the React Compiler's HIR terminal taxonomy (the canonical
+// JS-side CFG, `BuildHIR.ts`). The compiler's terminals are: goto, if,
+// branch, switch, logical, ternary, optional, return, throw, do-while,
+// while, for, for-of, for-in, label, sequence, maybe-throw, try. We model
+// every one as basic blocks + the edges above (see `Terminal`):
+//   - Statement terminals (if / switch / loops / label / return / throw /
+//     try) → `buildStatement`.
+//   - Expression terminals — `ternary`, `logical` (`&&`/`||`/`??` and the
+//     `&&=`/`||=`/`??=` assignments), and `optional` (optional chaining) —
+//     → `buildExpression` / `buildOptionalChainLink`. Lowering these is what
+//     lets a hook / setState / effect nested in a short-circuit read as
+//     conditional, exactly like the compiler's value blocks. `sequence`
+//     (comma / value-block sequencing) needs no dedicated terminal here:
+//     the generic left-to-right child threading already orders it.
+//   - `maybe-throw` (an implicit edge to the nearest handler after EVERY
+//     throwable instruction) is modeled coarsely: a single `cond` edge from
+//     the try ENTRY to the catch. That already makes every later try-body
+//     block skippable via the catch bypass, so the primitives our rules
+//     consume (`isUnconditionalFromEntry`, post-dominance) get the same
+//     answer a per-instruction model would give. The only thing the coarse
+//     model loses is `isReachable(midTryStatement, catchStatement)`, which
+//     no rule needs — so per-instruction maybe-throw is a deliberate
+//     non-goal, not a gap.
+export type CfgEdgeKind = "uncond" | "cond" | "throw" | "backedge" | "finalize" | "join";
+
+export interface CfgEdge {
+  readonly from: BasicBlock;
+  readonly to: BasicBlock;
+  readonly kind: CfgEdgeKind;
+}
+
+export interface BasicBlock {
+  readonly id: number;
+  readonly instructions: Instruction[];
+  // Set as the block is built; blocks that merely fall through are
+  // back-filled with a `goto` (or `unreachable` for orphans) in
+  // buildFunctionCfg. Mutable only during construction.
+  terminal: Terminal;
+  readonly successors: CfgEdge[];
+  readonly predecessors: CfgEdge[];
+  // φ-functions inserted at this block's head by SSA construction. Empty
+  // for every block unless `analyzeSsa` has run over the enclosing
+  // function, so non-SSA consumers pay nothing.
+  readonly phis: Phi[];
+}
+
+export interface FunctionCfg {
+  readonly owner: EsTreeNode;
+  readonly entry: BasicBlock;
+  readonly exit: BasicBlock;
+  readonly blocks: BasicBlock[];
+  readonly blockOf: (node: EsTreeNode) => BasicBlock | null;
+}
diff --git a/packages/cfg/src/ir/instruction.ts b/packages/cfg/src/ir/instruction.ts
new file mode 100644
index 000000000..88985c484
--- /dev/null
+++ b/packages/cfg/src/ir/instruction.ts
@@ -0,0 +1,20 @@
+import type { EsTreeNode } from "../ast/es-tree-node.js";
+
+// A single entry inside a basic block, mirroring oxc_cfg's
+// `InstructionKind` so a block reads as a typed instruction list ending
+// in a `Terminal` rather than an opaque AST-node bag.
+export type InstructionKind =
+  | "statement"
+  | "condition"
+  | "iteration"
+  | "throw"
+  | "return"
+  | "implicit-return"
+  | "break"
+  | "continue"
+  | "unreachable";
+
+export interface Instruction {
+  readonly node: EsTreeNode;
+  readonly kind: InstructionKind;
+}
diff --git a/packages/cfg/src/ir/place.ts b/packages/cfg/src/ir/place.ts
new file mode 100644
index 000000000..3759bbf4b
--- /dev/null
+++ b/packages/cfg/src/ir/place.ts
@@ -0,0 +1,48 @@
+import type { EsTreeNode } from "../ast/es-tree-node.js";
+import type { BasicBlock } from "./basic-block.js";
+
+// Opaque, analysis-stable identity for a resolved local binding (a
+// var/let/const/param/function/catch declaration). Equality is all that
+// matters: two identifier references resolve to the same `BindingId` iff
+// they denote the same declaration. The cfg's built-in lexical resolver
+// mints these; a host (the oxlint plugin) may inject its own numbering.
+export type BindingId = number;
+
+// One SSA value: a specific version of a binding. `binding` + `version`
+// is the identity (interned, so reference equality works); `name` is the
+// source identifier carried for DOT / debugging. Mirrors the React
+// Compiler's `IdentifierId`-per-version model, variable-level.
+export interface SsaIdentifier {
+  readonly binding: BindingId;
+  readonly version: number;
+  readonly name: string;
+}
+
+// A read or write occurrence of a binding at a concrete identifier node —
+// the per-instruction operand / lvalue the Braun builder consumes. The
+// React Compiler's `Place`; we keep only what variable-level SSA needs.
+// `read` / `write` are operands and stores. `declare` is a binding
+// introduced without a value (`let x;`): SSA treats it as a def (it
+// establishes a version, standing for `undefined`), but definite-assignment
+// must NOT count it as an assignment — a later read still reaches no store.
+export interface Place {
+  readonly binding: BindingId;
+  readonly name: string;
+  readonly kind: "read" | "write" | "declare";
+  readonly node: EsTreeNode;
+}
+
+// Maps an identifier node to the binding it references, or null for an
+// unresolved / global identifier (opaque to SSA, like the React
+// Compiler's `#unknown` globals). The injectable seam between the cfg and
+// a host scope analyzer.
+export type ResolveBinding = (identifier: EsTreeNode) => BindingId | null;
+
+// A φ-function sitting at the head of a join block: the merged value of a
+// binding whose definition differs across the block's predecessors.
+// `operands` maps each predecessor block to the SSA value live on that
+// in-edge (Braun et al. 2013, "Simple and Efficient Construction of SSA").
+export interface Phi {
+  readonly identifier: SsaIdentifier;
+  readonly operands: Map<BasicBlock, SsaIdentifier>;
+}
diff --git a/packages/cfg/src/ir/terminal.ts b/packages/cfg/src/ir/terminal.ts
new file mode 100644
index 000000000..9119efe24
--- /dev/null
+++ b/packages/cfg/src/ir/terminal.ts
@@ -0,0 +1,55 @@
+import type { EsTreeNode } from "../ast/es-tree-node.js";
+import type { BasicBlock } from "./basic-block.js";
+
+// How a `break` / `continue` goto resolved (React Compiler's GotoVariant);
+// `normal` is plain fall-through to the next block.
+export type GotoVariant = "normal" | "break" | "continue";
+
+export interface TerminalCase {
+  readonly test: EsTreeNode | null;
+  readonly block: BasicBlock;
+}
+
+// The typed terminal that ends every basic block, modeling the React
+// Compiler HIR terminal taxonomy (BuildHIR / HIR.ts). Branching terminals
+// carry a `fallthrough` join block — the continuation where the construct's
+// arms reconverge — exactly like the compiler's `TerminalWithFallthrough`.
+// `break` / `continue` / `return` / `throw` are lowered to explicit
+// terminals at their resolved targets, so the graph is fully explicit.
+export type Terminal =
+  | { readonly kind: "goto"; readonly block: BasicBlock; readonly variant: GotoVariant }
+  | {
+      readonly kind: "if";
+      readonly test: EsTreeNode;
+      readonly consequent: BasicBlock;
+      readonly alternate: BasicBlock;
+      readonly fallthrough: BasicBlock;
+    }
+  | {
+      readonly kind: "switch";
+      readonly discriminant: EsTreeNode;
+      readonly cases: ReadonlyArray<TerminalCase>;
+      readonly fallthrough: BasicBlock;
+    }
+  | {
+      readonly kind: "while" | "do-while";
+      readonly test: EsTreeNode | null;
+      readonly body: BasicBlock;
+      readonly fallthrough: BasicBlock;
+    }
+  | {
+      readonly kind: "for" | "for-in" | "for-of";
+      readonly body: BasicBlock;
+      readonly fallthrough: BasicBlock;
+    }
+  | { readonly kind: "logical" | "ternary" | "optional"; readonly fallthrough: BasicBlock }
+  | {
+      readonly kind: "try";
+      readonly block: BasicBlock;
+      readonly handler: BasicBlock | null;
+      readonly finalizer: BasicBlock | null;
+      readonly fallthrough: BasicBlock;
+    }
+  | { readonly kind: "return"; readonly argument: EsTreeNode | null }
+  | { readonly kind: "throw"; readonly argument: EsTreeNode }
+  | { readonly kind: "unreachable" };
diff --git a/packages/cfg/src/path/enumerate-paths.ts b/packages/cfg/src/path/enumerate-paths.ts
new file mode 100644
index 000000000..17193574e
--- /dev/null
+++ b/packages/cfg/src/path/enumerate-paths.ts
@@ -0,0 +1,67 @@
+import { MAX_PATH_BLOCK_LENGTH, MAX_VIOLATION_PATHS } from "../constants.js";
+import type { BasicBlock, CfgEdge } from "../ir/basic-block.js";
+
+export interface SimplePathQuery {
+  readonly start: BasicBlock;
+  readonly isGoal: (block: BasicBlock) => boolean;
+  // Non-goal blocks the search may pass through. Pruning a block drops every
+  // path through it from the result — how a caller carves "no write of the
+  // binding" / "no release of the resource" counterexample paths. Goal blocks
+  // are always reachable regardless of this predicate.
+  readonly canTraverse?: (block: BasicBlock) => boolean;
+  // Edge kinds the search may follow; defaults to every kind except `throw`
+  // (a leak / use-before-define on an exceptional path is a separate concern).
+  readonly canFollow?: (edge: CfgEdge) => boolean;
+  readonly maxPaths?: number;
+  readonly maxLength?: number;
+}
+
+export interface SimplePathResult {
+  readonly paths: ReadonlyArray<ReadonlyArray<BasicBlock>>;
+  // `false` once a cap cut the search short: the set is partial, so a caller
+  // must NOT read "every path here is infeasible" as "every path is".
+  readonly complete: boolean;
+}
+
+// Enumerate the simple (acyclic) paths from `start` to a goal block. The
+// acyclicity constraint bounds loops to a single unrolling and guarantees
+// termination; the caps bound the blow-up on diamond-heavy CFGs. Used only to
+// refine diagnostics, never in a hot loop.
+export const enumerateSimplePaths = (query: SimplePathQuery): SimplePathResult => {
+  const canFollow = query.canFollow ?? ((edge) => edge.kind !== "throw");
+  const canTraverse = query.canTraverse ?? (() => true);
+  const maxPaths = query.maxPaths ?? MAX_VIOLATION_PATHS;
+  const maxLength = query.maxLength ?? MAX_PATH_BLOCK_LENGTH;
+
+  const paths: BasicBlock[][] = [];
+  const onStack = new Set<BasicBlock>();
+  let complete = true;
+
+  const visit = (block: BasicBlock, trail: BasicBlock[]): void => {
+    if (!complete) return;
+    if (query.isGoal(block)) {
+      paths.push([...trail, block]);
+      if (paths.length > maxPaths) complete = false;
+      return;
+    }
+    if (trail.length + 1 > maxLength) {
+      complete = false;
+      return;
+    }
+    onStack.add(block);
+    trail.push(block);
+    for (const edge of block.successors) {
+      if (!complete) break;
+      if (!canFollow(edge)) continue;
+      const next = edge.to;
+      if (onStack.has(next)) continue;
+      if (!query.isGoal(next) && !canTraverse(next)) continue;
+      visit(next, trail);
+    }
+    trail.pop();
+    onStack.delete(block);
+  };
+
+  visit(query.start, []);
+  return { paths, complete };
+};
diff --git a/packages/cfg/src/path/feasibility.ts b/packages/cfg/src/path/feasibility.ts
new file mode 100644
index 000000000..db30ea9ae
--- /dev/null
+++ b/packages/cfg/src/path/feasibility.ts
@@ -0,0 +1,106 @@
+import { MAX_PATH_CLAUSES, MAX_PATH_VARS } from "../constants.js";
+import type { Atom, PathFact } from "./literal-facts.js";
+import { atomKey, createUnionFind } from "./literal-facts.js";
+
+// `infeasible` — the conjunction of facts is provably contradictory (no
+// runtime state satisfies them), so a counterexample path carrying them is a
+// false positive. `feasible` — no contradiction detected. `unknown` — caps
+// exceeded. ONLY `infeasible` may suppress a diagnostic; `feasible` and
+// `unknown` leave behavior unchanged, so the checker is never unsound for
+// bug-finding.
+export type Feasibility = "feasible" | "infeasible" | "unknown";
+
+interface ClassFacts {
+  // The constant value keys equated into this class (`x === 1` → "n:1").
+  readonly constKeys: Set<string>;
+  // Truthiness requirements placed on the class (`if (x)` → true).
+  readonly requiredTruthiness: Set<boolean>;
+  // Truthiness of any constant in the class (a literal is its own truth).
+  readonly constTruthiness: Set<boolean>;
+}
+
+const classFactsOf = (byRoot: Map<string, ClassFacts>, root: string): ClassFacts => {
+  let facts = byRoot.get(root);
+  if (!facts) {
+    facts = { constKeys: new Set(), requiredTruthiness: new Set(), constTruthiness: new Set() };
+    byRoot.set(root, facts);
+  }
+  return facts;
+};
+
+// A bounded consistency check over a single path's conjunction of facts: a
+// union-find congruence closure for equalities, plus truthiness and
+// disequality constraints layered on the resulting classes. A path condition
+// is a pure conjunction (one branch outcome per edge), so no boolean search
+// is needed — only contradiction detection. Returns `infeasible` only on a
+// proof; `unknown` when the caps trip.
+export const isPathFeasible = (facts: ReadonlyArray<PathFact>): Feasibility => {
+  if (facts.length > MAX_PATH_CLAUSES) return "unknown";
+
+  const atoms = new Set<string>();
+  for (const fact of facts) {
+    if (fact.kind === "truthy") atoms.add(atomKey(fact.atom));
+    else {
+      atoms.add(atomKey(fact.left));
+      atoms.add(atomKey(fact.right));
+    }
+  }
+  if (atoms.size > MAX_PATH_VARS) return "unknown";
+
+  const unionFind = createUnionFind();
+  const disequalities: Array<[string, string]> = [];
+  const constTruthByKey = new Map<string, boolean>();
+  const truthyConstraints: Array<{ key: string; polarity: boolean }> = [];
+
+  const noteConst = (atom: Atom): void => {
+    if (atom.kind === "const") constTruthByKey.set(atomKey(atom), atom.truthy);
+  };
+
+  for (const fact of facts) {
+    if (fact.kind === "truthy") {
+      noteConst(fact.atom);
+      truthyConstraints.push({ key: atomKey(fact.atom), polarity: fact.polarity });
+      continue;
+    }
+    noteConst(fact.left);
+    noteConst(fact.right);
+    const leftKey = atomKey(fact.left);
+    const rightKey = atomKey(fact.right);
+    if (fact.polarity) unionFind.union(leftKey, rightKey);
+    else disequalities.push([leftKey, rightKey]);
+  }
+
+  // Aggregate per equality class.
+  const byRoot = new Map<string, ClassFacts>();
+  for (const [key, truthy] of constTruthByKey) {
+    const facts = classFactsOf(byRoot, unionFind.find(key));
+    facts.constKeys.add(key);
+    facts.constTruthiness.add(truthy);
+  }
+  for (const constraint of truthyConstraints) {
+    classFactsOf(byRoot, unionFind.find(constraint.key)).requiredTruthiness.add(
+      constraint.polarity,
+    );
+  }
+
+  for (const classFacts of byRoot.values()) {
+    // Two distinct constants equated: `x === 1 && x === 2`.
+    if (classFacts.constKeys.size > 1) return "infeasible";
+    // A value required both truthy and falsy: `if (x) … if (!x)` on one path.
+    if (classFacts.requiredTruthiness.size > 1) return "infeasible";
+    // A constant whose truthiness contradicts the requirement: `x === 0` on a
+    // path that also needs `x` truthy.
+    const allTruthiness = new Set([
+      ...classFacts.constTruthiness,
+      ...classFacts.requiredTruthiness,
+    ]);
+    if (allTruthiness.size > 1) return "infeasible";
+  }
+
+  // `x !== y` while `x === y` was also asserted.
+  for (const [left, right] of disequalities) {
+    if (unionFind.find(left) === unionFind.find(right)) return "infeasible";
+  }
+
+  return "feasible";
+};
diff --git a/packages/cfg/src/path/literal-facts.ts b/packages/cfg/src/path/literal-facts.ts
new file mode 100644
index 000000000..001ab6d46
--- /dev/null
+++ b/packages/cfg/src/path/literal-facts.ts
@@ -0,0 +1,79 @@
+// The abstract domain the path-feasibility checker reasons over: atoms are
+// either an SSA value (identified by an opaque key the caller mints from
+// `ssa.versionAt`) or a constant literal (with its truthiness precomputed,
+// since `if (x)` reasons about truthiness, not just equality). Facts are the
+// conjuncts a path condition lowers to — a value's truthiness, or an
+// (in)equality between two atoms.
+
+export type Atom =
+  | { readonly kind: "value"; readonly key: string }
+  | { readonly kind: "const"; readonly key: string; readonly truthy: boolean };
+
+export type PathFact =
+  | { readonly kind: "truthy"; readonly atom: Atom; readonly polarity: boolean }
+  | {
+      readonly kind: "equality";
+      readonly left: Atom;
+      readonly right: Atom;
+      // `true` for `===`/`==`, `false` for `!==`/`!=`.
+      readonly polarity: boolean;
+    };
+
+export const valueAtom = (key: string): Atom => ({ kind: "value", key });
+
+// Canonicalize a literal into a constant atom, or null when its value can't
+// be represented (so the guard is dropped — sound, just less precise).
+export const constAtomOf = (value: unknown): Atom | null => {
+  if (value === null) return { kind: "const", key: "null", truthy: false };
+  switch (typeof value) {
+    case "boolean":
+      return { kind: "const", key: `b:${value}`, truthy: value };
+    case "number":
+      return { kind: "const", key: `n:${value}`, truthy: value !== 0 && !Number.isNaN(value) };
+    case "string":
+      return { kind: "const", key: `s:${value}`, truthy: value.length > 0 };
+    case "bigint":
+      return { kind: "const", key: `i:${value}`, truthy: value !== BigInt(0) };
+    default:
+      return null;
+  }
+};
+
+export const atomKey = (atom: Atom): string => (atom.kind === "value" ? `v:${atom.key}` : atom.key);
+
+// A union-find over atom keys: the congruence-closure backbone for equality
+// reasoning. `===` facts union two atoms; membership of the same class is
+// then what makes a `!==` between them, or two distinct constants in one
+// class, a contradiction.
+export interface UnionFind {
+  readonly find: (key: string) => string;
+  readonly union: (left: string, right: string) => void;
+}
+
+export const createUnionFind = (): UnionFind => {
+  const parent = new Map<string, string>();
+
+  const find = (key: string): string => {
+    let root = parent.get(key) ?? key;
+    if (!parent.has(key)) parent.set(key, key);
+    while (root !== (parent.get(root) ?? root)) {
+      root = parent.get(root) ?? root;
+    }
+    // Path compression.
+    let current = key;
+    while (current !== root) {
+      const nextParent = parent.get(current) ?? current;
+      parent.set(current, root);
+      current = nextParent;
+    }
+    return root;
+  };
+
+  const union = (left: string, right: string): void => {
+    const leftRoot = find(left);
+    const rightRoot = find(right);
+    if (leftRoot !== rightRoot) parent.set(leftRoot, rightRoot);
+  };
+
+  return { find, union };
+};
diff --git a/packages/cfg/src/path/path-condition.ts b/packages/cfg/src/path/path-condition.ts
new file mode 100644
index 000000000..dc18beb37
--- /dev/null
+++ b/packages/cfg/src/path/path-condition.ts
@@ -0,0 +1,106 @@
+import type { EsTreeNode } from "../ast/es-tree-node.js";
+import { isNodeOfType } from "../ast/is-node-of-type.js";
+import type { BasicBlock } from "../ir/basic-block.js";
+import type { Atom, PathFact } from "./literal-facts.js";
+import { constAtomOf } from "./literal-facts.js";
+
+// Maps a test-expression identifier to its abstract atom — the seam onto
+// SSA: the caller keys the atom by `ssa.versionAt(node)` so the SAME value
+// read at two branches lowers to the SAME atom (the crux of correlated-
+// branch reasoning). Returns null for an unresolved / non-value operand.
+export interface ResolveValueAtom {
+  (identifier: EsTreeNode): Atom | null;
+}
+
+const lowerOperand = (node: EsTreeNode, resolveValue: ResolveValueAtom): Atom | null => {
+  if (isNodeOfType(node, "Identifier")) return resolveValue(node);
+  if (isNodeOfType(node, "Literal")) return constAtomOf(node.value);
+  return null;
+};
+
+// Only STRICT equality lowers to an identity fact. Loose `==` / `!=` does not
+// imply value identity (`[] == 0`, `1 == "1"`, `null == undefined` are all
+// true across distinct/typed values), so treating it as `===` would let the
+// checker "prove" a satisfiable path infeasible and suppress a real
+// diagnostic. Dropping the fact is sound: fewer facts only make a path look
+// MORE feasible, never less.
+const STRICT_EQUALITY_OPERATORS = new Set(["===", "!=="]);
+
+// Lower a branch test taken with the given truthiness into path facts. Only
+// the shapes the checker understands are emitted; anything else yields no
+// facts (so the guard is simply dropped — sound, since fewer facts can only
+// make a path look MORE feasible, never less).
+export const lowerGuard = (
+  test: EsTreeNode,
+  polarity: boolean,
+  resolveValue: ResolveValueAtom,
+): PathFact[] => {
+  if (isNodeOfType(test, "UnaryExpression") && test.operator === "!") {
+    return lowerGuard(test.argument as EsTreeNode, !polarity, resolveValue);
+  }
+
+  if (isNodeOfType(test, "LogicalExpression")) {
+    // `a && b` taken true ⇒ both true; `a || b` taken false ⇒ both false.
+    // The mixed cases are disjunctions a single conjunction can't capture.
+    if (test.operator === "&&" && polarity) {
+      return [
+        ...lowerGuard(test.left as EsTreeNode, true, resolveValue),
+        ...lowerGuard(test.right as EsTreeNode, true, resolveValue),
+      ];
+    }
+    if (test.operator === "||" && !polarity) {
+      return [
+        ...lowerGuard(test.left as EsTreeNode, false, resolveValue),
+        ...lowerGuard(test.right as EsTreeNode, false, resolveValue),
+      ];
+    }
+    return [];
+  }
+
+  if (isNodeOfType(test, "BinaryExpression") && STRICT_EQUALITY_OPERATORS.has(test.operator)) {
+    const left = lowerOperand(test.left as EsTreeNode, resolveValue);
+    const right = lowerOperand(test.right as EsTreeNode, resolveValue);
+    if (!left || !right) return [];
+    return [
+      { kind: "equality", left, right, polarity: test.operator === "===" ? polarity : !polarity },
+    ];
+  }
+
+  if (isNodeOfType(test, "Identifier")) {
+    const atom = resolveValue(test);
+    return atom ? [{ kind: "truthy", atom, polarity }] : [];
+  }
+
+  return [];
+};
+
+// The conjunction of branch guards along a concrete block path: for each
+// edge, the outcome the path took at the source block's branching terminal,
+// lowered into facts over SSA values. Non-branching edges contribute
+// nothing. Feeding the result to `isPathFeasible` decides whether the path
+// can actually execute.
+export const pathConditionFacts = (
+  path: ReadonlyArray<BasicBlock>,
+  resolveValue: ResolveValueAtom,
+): PathFact[] => {
+  const facts: PathFact[] = [];
+  for (let index = 0; index + 1 < path.length; index++) {
+    const from = path[index]!;
+    const to = path[index + 1]!;
+    const terminal = from.terminal;
+    if (terminal.kind === "if") {
+      if (to === terminal.consequent) facts.push(...lowerGuard(terminal.test, true, resolveValue));
+      else if (to === terminal.alternate) {
+        facts.push(...lowerGuard(terminal.test, false, resolveValue));
+      }
+      continue;
+    }
+    if ((terminal.kind === "while" || terminal.kind === "do-while") && terminal.test) {
+      if (to === terminal.body) facts.push(...lowerGuard(terminal.test, true, resolveValue));
+      else if (to === terminal.fallthrough) {
+        facts.push(...lowerGuard(terminal.test, false, resolveValue));
+      }
+    }
+  }
+  return facts;
+};
diff --git a/packages/cfg/src/path/prune-infeasible.ts b/packages/cfg/src/path/prune-infeasible.ts
new file mode 100644
index 000000000..ec46a60cf
--- /dev/null
+++ b/packages/cfg/src/path/prune-infeasible.ts
@@ -0,0 +1,27 @@
+import type { BasicBlock } from "../ir/basic-block.js";
+import type { SimplePathResult } from "./enumerate-paths.js";
+import { isPathFeasible } from "./feasibility.js";
+import type { ResolveValueAtom } from "./path-condition.js";
+import { pathConditionFacts } from "./path-condition.js";
+
+// Decide whether a diagnostic witnessed by `result.paths` can be safely
+// suppressed. This is the one place Layer D removes a false positive, and it
+// is deliberately conservative: suppress ONLY when (a) the path search was
+// complete (no cap tripped), (b) at least one path is a genuine
+// counterexample, and (c) EVERY such counterexample is provably infeasible.
+// Any `feasible`/`unknown` counterexample, or an incomplete search, leaves the
+// diagnostic standing — so Layer D never hides a real bug.
+export const everyCounterexampleInfeasible = (
+  result: SimplePathResult,
+  resolveValue: ResolveValueAtom,
+  isCounterexample: (path: ReadonlyArray<BasicBlock>) => boolean = () => true,
+): boolean => {
+  if (!result.complete) return false;
+  let foundCounterexample = false;
+  for (const path of result.paths) {
+    if (!isCounterexample(path)) continue;
+    foundCounterexample = true;
+    if (isPathFeasible(pathConditionFacts(path, resolveValue)) !== "infeasible") return false;
+  }
+  return foundCounterexample;
+};
diff --git a/packages/cfg/src/path/ssa-value-atom.ts b/packages/cfg/src/path/ssa-value-atom.ts
new file mode 100644
index 000000000..e5c7095ca
--- /dev/null
+++ b/packages/cfg/src/path/ssa-value-atom.ts
@@ -0,0 +1,15 @@
+import type { EsTreeNode } from "../ast/es-tree-node.js";
+import type { SsaAnalysis } from "../ssa.js";
+import { valueAtom } from "./literal-facts.js";
+import type { ResolveValueAtom } from "./path-condition.js";
+
+// Bridge SSA versions onto the path-feasibility atom domain: the SAME value
+// read at two branches resolves to one atom, which is what lets the
+// feasibility checker refute correlated-branch counterexamples. The seam every
+// Layer D caller (the plugin context + the analyses' test harnesses) shares.
+export const ssaValueResolver = (ssa: Pick<SsaAnalysis, "versionAt">): ResolveValueAtom => {
+  return (identifier: EsTreeNode) => {
+    const ssaIdentifier = ssa.versionAt(identifier);
+    return ssaIdentifier ? valueAtom(`${ssaIdentifier.binding}#${ssaIdentifier.version}`) : null;
+  };
+};
diff --git a/packages/cfg/src/ssa.ts b/packages/cfg/src/ssa.ts
new file mode 100644
index 000000000..bbe657650
--- /dev/null
+++ b/packages/cfg/src/ssa.ts
@@ -0,0 +1,135 @@
+import type { EsTreeNode } from "./ast/es-tree-node.js";
+import { eliminateRedundantPhis } from "./analysis/eliminate-redundant-phi.js";
+import { enterSsa } from "./analysis/enter-ssa.js";
+import { enumerateFunctions } from "./analysis/enumerate-functions.js";
+import { createLexicalBindingResolver } from "./analysis/lexical-binding-resolver.js";
+import { collectPlacesByBlock } from "./analysis/places-by-block.js";
+import { analyzeControlFlow } from "./control-flow-graph.js";
+import type { ControlFlowAnalysis } from "./control-flow-graph.js";
+import type { BasicBlock, FunctionCfg } from "./ir/basic-block.js";
+import type { BindingId, Phi, ResolveBinding, SsaIdentifier } from "./ir/place.js";
+
+// SSA for a single function-like (or the program) CFG.
+export interface FunctionSsa {
+  readonly cfg: FunctionCfg;
+  // φ-functions at a block's head (empty for non-join blocks).
+  readonly phisOf: (block: BasicBlock) => ReadonlyArray<Phi>;
+  // Reachable blocks that contain a write of `binding` — the input to the
+  // dominance-frontier φ-placement oracle.
+  readonly defBlocksOf: (binding: BindingId) => ReadonlySet<BasicBlock>;
+  // Every binding written at least once in this function.
+  readonly definedBindings: ReadonlySet<BindingId>;
+}
+
+// Variable-level SSA over a whole program, one `FunctionSsa` per function.
+// Built on the oxc-native CFG via the Braun on-the-fly construction; query
+// methods are identifier-node-keyed so rules never touch blocks directly.
+export interface SsaAnalysis {
+  readonly controlFlow: ControlFlowAnalysis;
+  readonly ssaFor: (functionLike: EsTreeNode) => FunctionSsa | null;
+  // The binding an identifier references (null for globals/unresolved).
+  readonly bindingOf: (node: EsTreeNode) => BindingId | null;
+  // The SSA value read or written at an identifier node (read wins for a
+  // compound-assignment / update target, which is both).
+  readonly versionAt: (node: EsTreeNode) => SsaIdentifier | null;
+  // The SSA value flowing into a use — its reaching definition.
+  readonly reachingDefinition: (useNode: EsTreeNode) => SsaIdentifier | null;
+  // The SSA value is read somewhere — directly, or transitively as a φ
+  // operand of a live value. A write whose value is NOT live is a dead
+  // store (overwritten before any read).
+  readonly isLiveValue: (identifier: SsaIdentifier) => boolean;
+  // `binding` is written somewhere strictly on a control-flow path from
+  // `fromNode` to `toNode` (its value at `toNode` may differ from
+  // `fromNode`). Same enclosing function only.
+  readonly isRedefinedBetween: (
+    fromNode: EsTreeNode,
+    toNode: EsTreeNode,
+    binding: BindingId,
+  ) => boolean;
+}
+
+export const analyzeSsa = (
+  program: EsTreeNode,
+  resolveBinding: ResolveBinding = createLexicalBindingResolver(program),
+): SsaAnalysis => {
+  const controlFlow = analyzeControlFlow(program);
+  const functionSsa = new Map<EsTreeNode, FunctionSsa>();
+  const readIdentifierAt = new Map<EsTreeNode, SsaIdentifier>();
+  const writeIdentifierAt = new Map<EsTreeNode, SsaIdentifier>();
+  const emptyDefBlocks: ReadonlySet<BasicBlock> = new Set();
+
+  for (const owner of enumerateFunctions(program)) {
+    const cfg = controlFlow.cfgFor(owner);
+    if (!cfg) continue;
+    const placesByBlock = collectPlacesByBlock(cfg, owner, resolveBinding);
+
+    const construction = enterSsa(cfg, placesByBlock);
+    eliminateRedundantPhis(cfg, construction);
+
+    for (const [node, identifier] of construction.readIdentifierAt) {
+      readIdentifierAt.set(node, identifier);
+    }
+    for (const [node, identifier] of construction.writeIdentifierAt) {
+      writeIdentifierAt.set(node, identifier);
+    }
+
+    const defBlocks = construction.defBlocks;
+    functionSsa.set(owner, {
+      cfg,
+      phisOf: (block) => block.phis,
+      defBlocksOf: (binding) => defBlocks.get(binding) ?? emptyDefBlocks,
+      definedBindings: new Set(defBlocks.keys()),
+    });
+  }
+
+  // A value is live if a read resolves to it, or it feeds a φ whose result
+  // is itself live. Seed from every read's reaching def, then propagate
+  // backward through φ operands to a fixpoint.
+  const liveValues = new Set<SsaIdentifier>(readIdentifierAt.values());
+  const phisByIdentifier = new Map<SsaIdentifier, Phi>();
+  for (const { cfg } of functionSsa.values()) {
+    for (const block of cfg.blocks) {
+      for (const phi of block.phis) phisByIdentifier.set(phi.identifier, phi);
+    }
+  }
+  const liveWorklist = [...liveValues];
+  while (liveWorklist.length > 0) {
+    const value = liveWorklist.pop()!;
+    const phi = phisByIdentifier.get(value);
+    if (!phi) continue;
+    for (const operand of phi.operands.values()) {
+      if (!liveValues.has(operand)) {
+        liveValues.add(operand);
+        liveWorklist.push(operand);
+      }
+    }
+  }
+
+  const versionAt = (node: EsTreeNode): SsaIdentifier | null =>
+    readIdentifierAt.get(node) ?? writeIdentifierAt.get(node) ?? null;
+
+  const isRedefinedBetween = (
+    fromNode: EsTreeNode,
+    toNode: EsTreeNode,
+    binding: BindingId,
+  ): boolean => {
+    for (const [node, identifier] of writeIdentifierAt) {
+      if (identifier.binding !== binding) continue;
+      if (node === fromNode || node === toNode) continue;
+      if (controlFlow.isReachable(fromNode, node) && controlFlow.isReachable(node, toNode)) {
+        return true;
+      }
+    }
+    return false;
+  };
+
+  return {
+    controlFlow,
+    ssaFor: (functionLike) => functionSsa.get(functionLike) ?? null,
+    bindingOf: (node) => resolveBinding(node),
+    versionAt,
+    reachingDefinition: (useNode) => readIdentifierAt.get(useNode) ?? null,
+    isLiveValue: (identifier) => liveValues.has(identifier),
+    isRedefinedBetween,
+  };
+};
diff --git a/packages/cfg/src/typestate/automaton.ts b/packages/cfg/src/typestate/automaton.ts
new file mode 100644
index 000000000..3791a2bb9
--- /dev/null
+++ b/packages/cfg/src/typestate/automaton.ts
@@ -0,0 +1,18 @@
+// A finite-state protocol a resource must obey (opened→closed, locked→
+// unlocked, …), verified over the CFG by `verifyTypestate`. States and
+// events are opaque strings the driving rule defines; the engine only
+// transitions between them and checks the two failure modes:
+//   - reaching an `errorState` (an illegal event for the current state —
+//     double-close, use-after-free);
+//   - a resource resting in a non-`acceptingState` at normal completion (a
+//     leak — opened but never closed).
+export interface TypestateAutomaton {
+  readonly initial: string;
+  // The state after `event` fires in `state`. Return an error state for an
+  // illegal transition; return `state` unchanged to ignore an event.
+  readonly transition: (state: string, event: string) => string;
+  readonly errorStates: ReadonlySet<string>;
+  // States it is safe to end in on a normal-completion path (typically the
+  // initial state — resource never acquired — plus the released state).
+  readonly acceptingStates: ReadonlySet<string>;
+}
diff --git a/packages/cfg/src/typestate/feasibility-refiner.ts b/packages/cfg/src/typestate/feasibility-refiner.ts
new file mode 100644
index 000000000..019fd48f2
--- /dev/null
+++ b/packages/cfg/src/typestate/feasibility-refiner.ts
@@ -0,0 +1,108 @@
+import type { EsTreeNode } from "../ast/es-tree-node.js";
+import type { BasicBlock, FunctionCfg } from "../ir/basic-block.js";
+import { enumerateSimplePaths } from "../path/enumerate-paths.js";
+import type { SimplePathResult } from "../path/enumerate-paths.js";
+import type { ResolveValueAtom } from "../path/path-condition.js";
+import { everyCounterexampleInfeasible } from "../path/prune-infeasible.js";
+import type { TypestateAutomaton } from "./automaton.js";
+import type { EventsByBlock, ResourceEvent } from "./verify.js";
+
+// Layer D refinement for the typestate engine: decide whether a candidate
+// violation is a proven false positive because every path that would witness
+// it is infeasible. Both queries only ever return `true` on a complete search
+// where the whole counterexample set is provably infeasible, so they can only
+// remove false positives — never hide a real bug.
+export interface TypestateFeasibilityRefiner {
+  // The error transition at `event` is unreachable on every feasible path.
+  readonly errorProvablyInfeasible: (event: ResourceEvent) => boolean;
+  // The leak of `resource` (first mentioned at `openNode`) can't happen on any
+  // feasible normal-completion path.
+  readonly leakProvablyInfeasible: (resource: string, openNode: EsTreeNode | undefined) => boolean;
+}
+
+export interface FeasibilityRefinerContext {
+  readonly cfg: FunctionCfg;
+  readonly automaton: TypestateAutomaton;
+  readonly eventsByBlock: EventsByBlock;
+  readonly initialState: string;
+  // The Layer D seam. Absent → the refiner is a no-op and nothing is ever
+  // suppressed (the engine stays purely path-insensitive).
+  readonly resolveValue: ResolveValueAtom | undefined;
+}
+
+const NEVER_SUPPRESS: TypestateFeasibilityRefiner = {
+  errorProvablyInfeasible: () => false,
+  leakProvablyInfeasible: () => false,
+};
+
+export const createTypestateFeasibilityRefiner = (
+  context: FeasibilityRefinerContext,
+): TypestateFeasibilityRefiner => {
+  const { cfg, automaton, eventsByBlock, initialState, resolveValue } = context;
+  if (!resolveValue) return NEVER_SUPPRESS;
+
+  // Memoize entry→block simple-path sets: the leak check always targets the
+  // exit, and many error events share a block, so each block's path set is
+  // enumerated at most once per verification rather than per diagnostic.
+  const pathsToBlockCache = new Map<BasicBlock, SimplePathResult>();
+  const pathsToBlock = (block: BasicBlock): SimplePathResult => {
+    let cached = pathsToBlockCache.get(block);
+    if (!cached) {
+      cached = enumerateSimplePaths({
+        start: cfg.entry,
+        isGoal: (candidate) => candidate === block,
+      });
+      pathsToBlockCache.set(block, cached);
+    }
+    return cached;
+  };
+
+  // Replay `resource`'s possible states along one concrete block path — the
+  // path-sensitive analogue of the joined fixpoint. With `stopBeforeNode`, it
+  // returns the states immediately BEFORE that event executes (what the
+  // offending transition is applied to); otherwise it replays the whole path.
+  const replayResourceStates = (
+    resource: string,
+    path: ReadonlyArray<BasicBlock>,
+    stopBeforeNode?: EsTreeNode,
+  ): Set<string> => {
+    let states = new Set<string>([initialState]);
+    for (const block of path) {
+      for (const resourceEvent of eventsByBlock.get(block) ?? []) {
+        if (resourceEvent.resource !== resource) continue;
+        if (stopBeforeNode && resourceEvent.node === stopBeforeNode) return states;
+        const next = new Set<string>();
+        for (const state of states) {
+          next.add(automaton.transition(state, resourceEvent.event));
+        }
+        states = next;
+      }
+    }
+    return states;
+  };
+
+  const errorProvablyInfeasible = (event: ResourceEvent): boolean => {
+    const block = cfg.blockOf(event.node);
+    if (!block) return false;
+    return everyCounterexampleInfeasible(pathsToBlock(block), resolveValue, (path) =>
+      [...replayResourceStates(event.resource, path, event.node)].some(
+        (state) =>
+          !automaton.errorStates.has(state) &&
+          automaton.errorStates.has(automaton.transition(state, event.event)),
+      ),
+    );
+  };
+
+  const leakProvablyInfeasible = (resource: string, openNode: EsTreeNode | undefined): boolean => {
+    const openBlock = openNode ? cfg.blockOf(openNode) : null;
+    if (!openBlock) return false;
+    return everyCounterexampleInfeasible(pathsToBlock(cfg.exit), resolveValue, (path) => {
+      if (!path.includes(openBlock)) return false;
+      return [...replayResourceStates(resource, path)].some(
+        (state) => !automaton.acceptingStates.has(state) && !automaton.errorStates.has(state),
+      );
+    });
+  };
+
+  return { errorProvablyInfeasible, leakProvablyInfeasible };
+};
diff --git a/packages/cfg/src/typestate/verify.ts b/packages/cfg/src/typestate/verify.ts
new file mode 100644
index 000000000..717ebb30c
--- /dev/null
+++ b/packages/cfg/src/typestate/verify.ts
@@ -0,0 +1,250 @@
+import type { EsTreeNode } from "../ast/es-tree-node.js";
+import type { BasicBlock, FunctionCfg } from "../ir/basic-block.js";
+import type { Lattice } from "../dataflow/lattice.js";
+import { solveDataflow } from "../dataflow/solve.js";
+import type { ResolveValueAtom } from "../path/path-condition.js";
+import type { TypestateAutomaton } from "./automaton.js";
+import { createTypestateFeasibilityRefiner } from "./feasibility-refiner.js";
+
+// One protocol event observed at a concrete AST node: resource `resource`
+// (an opaque identity the classifier mints — e.g. a variable name or a
+// call-site key) sees `event` at `node`.
+export interface ResourceEvent {
+  readonly resource: string;
+  readonly event: string;
+  readonly node: EsTreeNode;
+}
+
+// Maps a block instruction's AST node to the protocol events its execution
+// produces, in evaluation order (empty for irrelevant instructions). The
+// rule walks the subtree; the engine stays protocol-agnostic.
+export interface TypestateClassifier {
+  (instructionNode: EsTreeNode): ReadonlyArray<ResourceEvent>;
+}
+
+export interface TypestateViolation {
+  // `error-transition`: an illegal event drove the resource into an error
+  // state (reported at the offending event node).
+  // `leaked-resource`: the resource can rest in a non-accepting state at
+  // normal completion (reported at its open site).
+  readonly kind: "error-transition" | "leaked-resource";
+  readonly resource: string;
+  readonly node: EsTreeNode;
+  readonly state: string;
+}
+
+export interface VerifyTypestateOptions {
+  readonly automaton: TypestateAutomaton;
+  readonly classifier: TypestateClassifier;
+  // Layer D refinement (opt-in): when supplied, a leak is reported only if at
+  // least one of its leaking paths is not provably infeasible. Maps a test
+  // identifier to its abstract atom (keyed by `ssa.versionAt` so correlated
+  // open/close guards collapse to one atom).
+  readonly resolveValue?: ResolveValueAtom;
+}
+
+// The set of states each resource may be in. A total map over every
+// resource the program mentions: an empty set means "no fact yet"
+// (unreachable), so it is the join (union) identity, while the entry
+// boundary seeds every resource to {initial}.
+type StateFact = ReadonlyMap<string, ReadonlySet<string>>;
+
+const unionInto = (target: Set<string>, source: ReadonlySet<string>): void => {
+  for (const value of source) target.add(value);
+};
+
+const setsEqual = (left: ReadonlySet<string>, right: ReadonlySet<string>): boolean => {
+  if (left.size !== right.size) return false;
+  for (const value of left) {
+    if (!right.has(value)) return false;
+  }
+  return true;
+};
+
+export type EventsByBlock = ReadonlyMap<BasicBlock, ReadonlyArray<ResourceEvent>>;
+
+const nodeStart = (node: EsTreeNode): number => node.range?.[0] ?? 0;
+
+// Every protocol event, attributed to the block it actually executes in via
+// `cfg.blockOf` and deduplicated by node. A single call node can surface
+// under more than one instruction's subtree — most importantly the
+// `implicit-return` instruction's node spans the whole body — so without
+// canonical attribution a call would be (mis)counted in a later block whose
+// state has already advanced. Events are ordered by source position, which
+// matches evaluation order for the straight-line code inside one block.
+const collectEventsByBlock = (cfg: FunctionCfg, options: VerifyTypestateOptions): EventsByBlock => {
+  const seen = new Set<EsTreeNode>();
+  const byBlock = new Map<BasicBlock, ResourceEvent[]>();
+  for (const block of cfg.blocks) {
+    for (const instruction of block.instructions) {
+      for (const resourceEvent of options.classifier(instruction.node)) {
+        if (seen.has(resourceEvent.node)) continue;
+        seen.add(resourceEvent.node);
+        const canonical = cfg.blockOf(resourceEvent.node) ?? block;
+        const list = byBlock.get(canonical);
+        if (list) list.push(resourceEvent);
+        else byBlock.set(canonical, [resourceEvent]);
+      }
+    }
+  }
+  for (const list of byBlock.values()) {
+    list.sort((left, right) => nodeStart(left.node) - nodeStart(right.node));
+  }
+  return byBlock;
+};
+
+// Run a block's events over the incoming per-resource state sets, returning
+// the outgoing sets. `onErrorTransition` (detection pass only) fires when an
+// event drives a resource from a legal state into an error state.
+const stepBlock = (
+  block: BasicBlock,
+  incoming: StateFact,
+  eventsByBlock: EventsByBlock,
+  automaton: TypestateAutomaton,
+  onErrorTransition?: (event: ResourceEvent, state: string) => void,
+): Map<string, Set<string>> => {
+  const out = new Map<string, Set<string>>();
+  for (const [resource, states] of incoming) out.set(resource, new Set(states));
+
+  for (const resourceEvent of eventsByBlock.get(block) ?? []) {
+    const states = out.get(resourceEvent.resource);
+    if (!states || states.size === 0) continue;
+    const next = new Set<string>();
+    for (const state of states) {
+      const target = automaton.transition(state, resourceEvent.event);
+      next.add(target);
+      if (
+        onErrorTransition &&
+        automaton.errorStates.has(target) &&
+        !automaton.errorStates.has(state)
+      ) {
+        onErrorTransition(resourceEvent, target);
+      }
+    }
+    out.set(resourceEvent.resource, next);
+  }
+  return out;
+};
+
+// The first node (in source order) at which each resource is mentioned — its
+// open site, where a leak is reported.
+const collectOpenSites = (
+  cfg: FunctionCfg,
+  eventsByBlock: EventsByBlock,
+): Map<string, EsTreeNode> => {
+  const openSites = new Map<string, EsTreeNode>();
+  for (const block of cfg.blocks) {
+    for (const resourceEvent of eventsByBlock.get(block) ?? []) {
+      const existing = openSites.get(resourceEvent.resource);
+      if (!existing || nodeStart(resourceEvent.node) < nodeStart(existing)) {
+        openSites.set(resourceEvent.resource, resourceEvent.node);
+      }
+    }
+  }
+  return openSites;
+};
+
+// Verify a typestate protocol over a function's CFG. Built on the generic
+// `solveDataflow` worklist: the fact is each resource's set of possible
+// states, joined by union at merges. After the fixpoint, a deterministic
+// pass reports error transitions, and the normal-completion exit fact
+// (predecessors minus `throw` edges) reports leaks. The reusable
+// generalization of the hand-rolled effect-cleanup leak check.
+export const verifyTypestate = (
+  cfg: FunctionCfg,
+  options: VerifyTypestateOptions,
+): TypestateViolation[] => {
+  const eventsByBlock = collectEventsByBlock(cfg, options);
+  const openSites = collectOpenSites(cfg, eventsByBlock);
+  const resources = [...openSites.keys()];
+  if (resources.length === 0) return [];
+
+  const initialState = options.automaton.initial;
+  const lattice: Lattice<StateFact> = {
+    bottom: new Map(resources.map((resource) => [resource, new Set<string>()])),
+    join: (left, right) => {
+      const merged = new Map<string, Set<string>>();
+      for (const resource of resources) {
+        const states = new Set<string>();
+        unionInto(states, left.get(resource) ?? new Set());
+        unionInto(states, right.get(resource) ?? new Set());
+        merged.set(resource, states);
+      }
+      return merged;
+    },
+    equals: (left, right) =>
+      resources.every((resource) =>
+        setsEqual(left.get(resource) ?? new Set(), right.get(resource) ?? new Set()),
+      ),
+  };
+
+  const result = solveDataflow<StateFact>({
+    cfg,
+    lattice,
+    direction: "forward",
+    boundary: new Map(resources.map((resource) => [resource, new Set([initialState])])),
+    transfer: (block, incoming) => stepBlock(block, incoming, eventsByBlock, options.automaton),
+  });
+
+  const violations: TypestateViolation[] = [];
+
+  // Layer D: refines both detection passes by suppressing a violation only
+  // when every path that would witness it is provably infeasible. A no-op
+  // unless `resolveValue` is supplied; memoizes its path enumeration so the
+  // refinement is computed at most once per block, not once per diagnostic.
+  const refiner = createTypestateFeasibilityRefiner({
+    cfg,
+    automaton: options.automaton,
+    eventsByBlock,
+    initialState,
+    resolveValue: options.resolveValue,
+  });
+
+  // Error transitions: replay each reachable block from its stable entry
+  // fact, reporting at most once per offending node.
+  const reportedErrorNodes = new Set<EsTreeNode>();
+  for (const block of cfg.blocks) {
+    stepBlock(
+      block,
+      result.entryFactOf(block),
+      eventsByBlock,
+      options.automaton,
+      (resourceEvent, state) => {
+        if (reportedErrorNodes.has(resourceEvent.node)) return;
+        reportedErrorNodes.add(resourceEvent.node);
+        if (refiner.errorProvablyInfeasible(resourceEvent)) return;
+        violations.push({
+          kind: "error-transition",
+          resource: resourceEvent.resource,
+          node: resourceEvent.node,
+          state,
+        });
+      },
+    );
+  }
+
+  // Leaks: a resource resting in a non-accepting (non-error) state on a
+  // normal-completion path — the exit joined over its non-`throw`
+  // predecessors.
+  let normalExit: StateFact = lattice.bottom;
+  for (const edge of cfg.exit.predecessors) {
+    if (edge.kind === "throw") continue;
+    normalExit = lattice.join(normalExit, result.exitFactOf(edge.from));
+  }
+  for (const resource of resources) {
+    for (const state of normalExit.get(resource) ?? new Set<string>()) {
+      if (options.automaton.acceptingStates.has(state)) continue;
+      if (options.automaton.errorStates.has(state)) continue;
+      if (refiner.leakProvablyInfeasible(resource, openSites.get(resource))) break;
+      violations.push({
+        kind: "leaked-resource",
+        resource,
+        node: openSites.get(resource)!,
+        state,
+      });
+      break;
+    }
+  }
+
+  return violations;
+};
diff --git a/packages/cfg/tests/attach-parent-references.ts b/packages/cfg/tests/attach-parent-references.ts
new file mode 100644
index 000000000..b5f8103a6
--- /dev/null
+++ b/packages/cfg/tests/attach-parent-references.ts
@@ -0,0 +1,26 @@
+import type { EsTreeNode } from "../src/ast/es-tree-node.js";
+import { isAstNode } from "../src/ast/is-ast-node.js";
+
+// Walks the AST setting each child's `.parent` to its owning parent node.
+// `oxc-parser` emits an unparented AST, but the CFG's `enclosingFunction`
+// walk relies on `node.parent`, so we re-attach here before analyzing a
+// freshly parsed fixture.
+export const attachParentReferences = (root: EsTreeNode): void => {
+  const visit = (node: EsTreeNode, parent: EsTreeNode | null): void => {
+    const writableNode = node as unknown as { parent?: EsTreeNode | null };
+    writableNode.parent = parent;
+    const nodeRecord = node as unknown as Record<string, unknown>;
+    for (const key of Object.keys(nodeRecord)) {
+      if (key === "parent") continue;
+      const child = nodeRecord[key];
+      if (Array.isArray(child)) {
+        for (const item of child) {
+          if (isAstNode(item)) visit(item, node);
+        }
+      } else if (isAstNode(child)) {
+        visit(child, node);
+      }
+    }
+  };
+  visit(root, null);
+};
diff --git a/packages/cfg/tests/control-flow-graph.eslint-code-path.test.ts b/packages/cfg/tests/control-flow-graph.eslint-code-path.test.ts
new file mode 100644
index 000000000..11de88693
--- /dev/null
+++ b/packages/cfg/tests/control-flow-graph.eslint-code-path.test.ts
@@ -0,0 +1,56 @@
+import { runCfgCases } from "./run-cfg.js";
+
+// Representative port of ESLint's code-path analysis behavior, as exercised
+// by `no-unreachable` and `consistent-return`
+// (eslint/lib/linter/code-path-analysis + eslint/tests/lib/rules/
+// no-unreachable.js). ESLint walks `CodePathSegment`s marked reachable /
+// unreachable; we assert the same segment-reachability facts through
+// `isReachable` / `isUnreachable`.
+
+runCfgCases("cfg-eslint-code-path / unreachable segments (no-unreachable)", [
+  {
+    name: "statement after return is an unreachable segment",
+    code: `function foo() { doStuff(); return; deadCode(); }`,
+    unreachable: { deadCode: true, doStuff: false },
+  },
+  {
+    name: "statement after an infinite loop is unreachable",
+    code: `function foo() { while (true) { work(); } afterLoop(); }`,
+    unreachable: { afterLoop: true, work: false },
+  },
+  {
+    name: "both arms terminate → the merge segment is unreachable",
+    code: `function foo() { if (a) { throw e; } else { return r(); } merge(); }`,
+    unreachable: { merge: true },
+  },
+  {
+    name: "a loop with a reachable break keeps the following segment live",
+    code: `function foo() { for (;;) { if (done()) break; } afterLoop(); }`,
+    unreachable: { afterLoop: false },
+    reachable: [["done", "afterLoop", true]],
+  },
+]);
+
+runCfgCases("cfg-eslint-code-path / forking & merging (consistent-return)", [
+  {
+    name: "if-without-else: the post-if segment is reachable from both arms",
+    code: `function foo() { if (cond()) { thenWork(); } tail(); }`,
+    reachable: [
+      ["thenWork", "tail", true],
+      ["cond", "tail", true],
+    ],
+    unreachable: { tail: false },
+  },
+  {
+    name: "early return forks: tail reachable only on the non-returning path",
+    code: `function foo() { if (a) { return early(); } tail(); }`,
+    reachable: [["early", "tail", false]],
+    unreachable: { tail: false },
+  },
+  {
+    name: "try/finally: the finally segment is reached on every path",
+    code: `function foo() { try { return body(); } finally { cleanup(); } }`,
+    reachable: [["body", "cleanup", true]],
+    unreachable: { cleanup: false },
+  },
+]);
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/semantic/control-flow-graph.expression-flow.test.ts b/packages/cfg/tests/control-flow-graph.expression-flow.test.ts
similarity index 99%
rename from packages/oxlint-plugin-react-doctor/src/plugin/semantic/control-flow-graph.expression-flow.test.ts
rename to packages/cfg/tests/control-flow-graph.expression-flow.test.ts
index 9d1253751..6bcd35077 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/semantic/control-flow-graph.expression-flow.test.ts
+++ b/packages/cfg/tests/control-flow-graph.expression-flow.test.ts
@@ -1,4 +1,4 @@
-import { runCfgCases } from "../../test-utils/run-cfg.js";
+import { runCfgCases } from "./run-cfg.js";
 
 // Expression-level control flow — the CFG lowers a ternary's arms, a
 // `&&`/`||`/`??` right operand, and a logical assignment's RHS into their own
diff --git a/packages/cfg/tests/control-flow-graph.labeled-loop-and-test.test.ts b/packages/cfg/tests/control-flow-graph.labeled-loop-and-test.test.ts
new file mode 100644
index 000000000..c94f87ba7
--- /dev/null
+++ b/packages/cfg/tests/control-flow-graph.labeled-loop-and-test.test.ts
@@ -0,0 +1,146 @@
+import { describe, expect, it } from "vite-plus/test";
+import { analyzeControlFlow } from "../src/control-flow-graph.js";
+import { attachParentReferences } from "./attach-parent-references.js";
+import { parseFixture } from "./parse-fixture.js";
+import type { EsTreeNode } from "../src/ast/es-tree-node.js";
+
+const analyze = (code: string) => {
+  const parsed = parseFixture(code);
+  attachParentReferences(parsed.program);
+  return { ...analyzeControlFlow(parsed.program), program: parsed.program };
+};
+
+const findNode = (root: EsTreeNode, predicate: (node: EsTreeNode) => boolean): EsTreeNode => {
+  let result: EsTreeNode | null = null;
+  const visit = (node: EsTreeNode): void => {
+    if (result) return;
+    if (predicate(node)) {
+      result = node;
+      return;
+    }
+    const record = node as unknown as Record<string, unknown>;
+    for (const key of Object.keys(record)) {
+      if (key === "parent") continue;
+      const child = record[key];
+      if (Array.isArray(child)) {
+        for (const item of child) {
+          if (item && typeof item === "object" && "type" in item) visit(item as EsTreeNode);
+          if (result) return;
+        }
+      } else if (child && typeof child === "object" && "type" in (child as object)) {
+        visit(child as EsTreeNode);
+      }
+    }
+  };
+  visit(root);
+  if (!result) throw new Error("fixture has no node matching predicate");
+  return result;
+};
+
+const isCallTo =
+  (name: string) =>
+  (node: EsTreeNode): boolean =>
+    node.type === "CallExpression" &&
+    ((node.callee.type === "Identifier" && node.callee.name === name) ||
+      (node.callee.type === "MemberExpression" &&
+        node.callee.property.type === "Identifier" &&
+        node.callee.property.name === name));
+
+// Regression: a loop test is re-evaluated on the header every iteration, so
+// its side-effecting nodes belong INSIDE the loop, not the pre-header block.
+describe("loop test belongs to the loop body", () => {
+  it("treats a while-condition call as inside the loop", () => {
+    const analysis = analyze("function f(q) { while (q.pop()) { work(); } }");
+    const testCall = findNode(analysis.program, isCallTo("pop"));
+    expect(analysis.isInsideLoop(testCall)).toBe(true);
+  });
+
+  it("treats a do-while condition call as inside the loop", () => {
+    const analysis = analyze("function f(q) { do { work(); } while (q.pop()); }");
+    const testCall = findNode(analysis.program, isCallTo("pop"));
+    expect(analysis.isInsideLoop(testCall)).toBe(true);
+  });
+
+  it("treats a for-condition call as inside the loop but the init as outside", () => {
+    const analysis = analyze("function f() { for (let i = seed(); more(i); i++) { work(); } }");
+    const initCall = findNode(analysis.program, isCallTo("seed"));
+    const testCall = findNode(analysis.program, isCallTo("more"));
+    expect(analysis.isInsideLoop(initCall)).toBe(false);
+    expect(analysis.isInsideLoop(testCall)).toBe(true);
+  });
+});
+
+// Regression: the for-loop `update` runs after the body on the back-edge, not
+// in the header. If it lived on the header it would dominate the body (model
+// the first iteration as running `update` before the body), skewing SSA.
+describe("for-loop update runs after the body", () => {
+  it("does not let the update dominate the body, but keeps it inside the loop", () => {
+    const analysis = analyze("function f(n) { for (let i = 0; i < n; step()) { work(i); } }");
+    const updateCall = findNode(analysis.program, isCallTo("step"));
+    const bodyCall = findNode(analysis.program, isCallTo("work"));
+    expect(analysis.dominates(updateCall, bodyCall)).toBe(false);
+    expect(analysis.isInsideLoop(updateCall)).toBe(true);
+  });
+
+  it("still runs the update on an explicit continue", () => {
+    const analysis = analyze(`
+      function f(n) {
+        for (let i = 0; i < n; step()) {
+          if (skip(i)) continue;
+          work(i);
+        }
+      }
+    `);
+    const continueStatement = findNode(
+      analysis.program,
+      (node) => node.type === "ContinueStatement",
+    );
+    const updateCall = findNode(analysis.program, isCallTo("step"));
+    expect(analysis.isReachable(continueStatement, updateCall)).toBe(true);
+  });
+});
+
+// Regression: `continue <label>` must add a back-edge to the labeled loop's
+// header. Without it the continue block is an orphan and the body becomes
+// unreachable from the continue, diverging from real control flow.
+describe("labeled continue re-enters the loop", () => {
+  it("adds a back-edge for `continue label` on an outer for-of", () => {
+    const analysis = analyze(`
+      function f(rows) {
+        outer: for (const row of rows) {
+          for (const cell of row) {
+            if (cell) continue outer;
+            visit(cell);
+          }
+        }
+      }
+    `);
+    const continueStatement = findNode(
+      analysis.program,
+      (node) => node.type === "ContinueStatement",
+    );
+    const visitCall = findNode(analysis.program, isCallTo("visit"));
+    expect(analysis.isReachable(continueStatement, visitCall)).toBe(true);
+  });
+
+  it("adds a back-edge for `continue label` on a labeled while", () => {
+    const analysis = analyze(`
+      function f(n) {
+        loop: while (n > 0) {
+          if (skip(n)) {
+            n--;
+            continue loop;
+          }
+          handle(n);
+          n--;
+        }
+      }
+    `);
+    const continueStatement = findNode(
+      analysis.program,
+      (node) => node.type === "ContinueStatement",
+    );
+    const handleCall = findNode(analysis.program, isCallTo("handle"));
+    expect(analysis.isReachable(continueStatement, handleCall)).toBe(true);
+  });
+});
diff --git a/packages/cfg/tests/control-flow-graph.loops-dot.test.ts b/packages/cfg/tests/control-flow-graph.loops-dot.test.ts
new file mode 100644
index 000000000..efaa83c13
--- /dev/null
+++ b/packages/cfg/tests/control-flow-graph.loops-dot.test.ts
@@ -0,0 +1,110 @@
+import { describe, expect, it } from "vite-plus/test";
+import { analyzeControlFlow } from "../src/control-flow-graph.js";
+import { attachParentReferences } from "./attach-parent-references.js";
+import { parseFixture } from "./parse-fixture.js";
+import type { EsTreeNode } from "../src/ast/es-tree-node.js";
+
+const analyze = (code: string) => {
+  const parsed = parseFixture(code);
+  attachParentReferences(parsed.program);
+  return { ...analyzeControlFlow(parsed.program), program: parsed.program };
+};
+
+const findNodeOfType = (root: EsTreeNode, type: string): EsTreeNode | null => {
+  let result: EsTreeNode | null = null;
+  const visit = (node: EsTreeNode): void => {
+    if (result) return;
+    if (node.type === type) {
+      result = node;
+      return;
+    }
+    const record = node as unknown as Record<string, unknown>;
+    for (const key of Object.keys(record)) {
+      if (key === "parent") continue;
+      const child = record[key];
+      if (Array.isArray(child)) {
+        for (const item of child) {
+          if (item && typeof item === "object" && "type" in item) visit(item as EsTreeNode);
+          if (result) return;
+        }
+      } else if (child && typeof child === "object" && "type" in (child as object)) {
+        visit(child as EsTreeNode);
+      }
+    }
+  };
+  visit(root);
+  return result;
+};
+
+describe("isInfiniteLoopStart", () => {
+  const loopOf = (code: string, type: string) => {
+    const analysis = analyze(code);
+    const loop = findNodeOfType(analysis.program, type);
+    if (!loop) throw new Error(`fixture has no ${type}`);
+    return analysis.isInfiniteLoopStart(loop);
+  };
+
+  it("flags literal-true loops", () => {
+    expect(loopOf("while (true) {}", "WhileStatement")).toBe(true);
+    expect(loopOf("while (1) {}", "WhileStatement")).toBe(true);
+    expect(loopOf("do {} while (true);", "DoWhileStatement")).toBe(true);
+    expect(loopOf("for (;;) {}", "ForStatement")).toBe(true);
+  });
+
+  it("folds constant-truthy conditions like oxc", () => {
+    expect(loopOf("while (!0) {}", "WhileStatement")).toBe(true);
+    expect(loopOf("while (!false) {}", "WhileStatement")).toBe(true);
+    expect(loopOf("while (Infinity) {}", "WhileStatement")).toBe(true);
+    expect(loopOf("while (`x`) {}", "WhileStatement")).toBe(true);
+  });
+
+  it("does not flag loops with a real or falsy exit", () => {
+    expect(loopOf("while (x) {}", "WhileStatement")).toBe(false);
+    expect(loopOf("while (false) {}", "WhileStatement")).toBe(false);
+    expect(loopOf("while (0) {}", "WhileStatement")).toBe(false);
+    expect(loopOf("while (!1) {}", "WhileStatement")).toBe(false);
+    expect(loopOf("while (``) {}", "WhileStatement")).toBe(false);
+    expect(loopOf("for (let i = 0; i < n; i++) {}", "ForStatement")).toBe(false);
+  });
+
+  it("is false for non-loop nodes", () => {
+    const analysis = analyze("function f() { return 1; }");
+    const fn = findNodeOfType(analysis.program, "FunctionDeclaration")!;
+    expect(analysis.isInfiniteLoopStart(fn)).toBe(false);
+  });
+
+  it("agrees with reachability: code after an infinite loop is dead", () => {
+    const analysis = analyze("function f() { while (true) {} after(); }");
+    const after = findNodeOfType(analysis.program, "CallExpression")!;
+    expect(analysis.isUnreachable(after)).toBe(true);
+  });
+});
+
+describe("toDot", () => {
+  it("renders a function CFG as Graphviz with typed terminals + edge kinds", () => {
+    const analysis = analyze("function f(x) { if (x) { a(); } else { b(); } c(); }");
+    const fn = findNodeOfType(analysis.program, "FunctionDeclaration")!;
+    const dot = analysis.toDot(fn);
+    expect(dot).toMatchInlineSnapshot(`
+    	"digraph "cfg" {
+    	  node [shape=box fontname=monospace];
+    	  b0 [label="#0\\lcondition: Identifier\\l» if → b2 / b4\\l"];
+    	  b1 [label="#1\\l» unreachable\\l"];
+    	  b2 [label="#2\\lstatement: ExpressionStatement\\l» goto b3 (normal)\\l"];
+    	  b3 [label="#3\\lstatement: ExpressionStatement\\limplicit-return: BlockStatement\\l» return\\l"];
+    	  b4 [label="#4\\lstatement: ExpressionStatement\\l» goto b3 (normal)\\l"];
+    	  b0 -> b2 [label="cond"];
+    	  b0 -> b4 [label="cond"];
+    	  b2 -> b3 [label="uncond"];
+    	  b3 -> b1 [label="uncond"];
+    	  b4 -> b3 [label="uncond"];
+    	}"
+    `);
+  });
+
+  it("returns null for a node with no CFG", () => {
+    const analysis = analyze("const x = 1;");
+    const literal = findNodeOfType(analysis.program, "Literal")!;
+    expect(analysis.toDot(literal)).toBeNull();
+  });
+});
diff --git a/packages/cfg/tests/control-flow-graph.oxc-no-fallthrough.test.ts b/packages/cfg/tests/control-flow-graph.oxc-no-fallthrough.test.ts
new file mode 100644
index 000000000..7a8e4835f
--- /dev/null
+++ b/packages/cfg/tests/control-flow-graph.oxc-no-fallthrough.test.ts
@@ -0,0 +1,46 @@
+import { runCfgCases } from "./run-cfg.js";
+
+// Curated port of oxc's `eslint/no-fallthrough` corpus
+// (`crates/oxc_linter/src/rules/eslint/no_fallthrough.rs`). oxc flags a
+// switch case that falls through into the next; the underlying CFG fact is
+// "is the next case's body reachable from this one without an intervening
+// break / return / throw / continue?" We assert it directly with
+// `isReachable(prevCaseMarker, nextCaseMarker)`:
+//   - FAIL upstream (fallthrough)  → reachable === true
+//   - PASS upstream (terminated)   → reachable === false
+
+runCfgCases("cfg-oxc-no-fallthrough / fallthrough reachable (oxc FAIL)", [
+  {
+    name: "case with no break falls into the next case",
+    code: `switch (x) { case 1: first(); case 2: second(); }`,
+    reachable: [["first", "second", true]],
+  },
+  {
+    name: "fallthrough across an empty middle case",
+    code: `switch (x) { case 1: first(); case 2: case 3: third(); }`,
+    reachable: [["first", "third", true]],
+  },
+  {
+    name: "default falls through to a later... is order-dependent, so guard the common direction",
+    code: `switch (x) { case 1: first(); default: fallback(); }`,
+    reachable: [["first", "fallback", true]],
+  },
+]);
+
+runCfgCases("cfg-oxc-no-fallthrough / terminated, no fallthrough (oxc PASS)", [
+  {
+    name: "break terminates the case",
+    code: `switch (x) { case 1: first(); break; case 2: second(); }`,
+    reachable: [["first", "second", false]],
+  },
+  {
+    name: "return terminates the case",
+    code: `function f() { switch (x) { case 1: first(); return; case 2: second(); } }`,
+    reachable: [["first", "second", false]],
+  },
+  {
+    name: "throw terminates the case",
+    code: `switch (x) { case 1: first(); throw e; case 2: second(); }`,
+    reachable: [["first", "second", false]],
+  },
+]);
diff --git a/packages/cfg/tests/control-flow-graph.oxc-no-unreachable.test.ts b/packages/cfg/tests/control-flow-graph.oxc-no-unreachable.test.ts
new file mode 100644
index 000000000..ecd4ad116
--- /dev/null
+++ b/packages/cfg/tests/control-flow-graph.oxc-no-unreachable.test.ts
@@ -0,0 +1,207 @@
+import { runCfgCases } from "./run-cfg.js";
+
+// Full port of oxc's `eslint/no-unreachable` corpus
+// (`crates/oxc_linter/src/rules/eslint/no_unreachable.rs`, the `pass` /
+// `fail` vecs). oxc asserts these through its rule; here we assert the
+// underlying CFG fact directly via `isUnreachable`. Each upstream case is
+// rewritten so the statement oxc cares about becomes a marker call:
+//   - `dead()`  — oxc FAIL: the statement is unreachable.
+//   - `live()`  — oxc PASS: the statement is reachable.
+// The surrounding control flow is preserved verbatim.
+//
+// Deliberately omitted: cases whose only point is `var` / function-
+// declaration HOISTING (e.g. `function foo() { return x; var x; }` passes
+// in oxc because the *declaration* hoists). Hoisting is a rule policy, not
+// a CFG reachability fact, and is a documented divergence — see the header
+// of control-flow-graph.ts.
+
+runCfgCases("cfg-oxc-no-unreachable / fail (statement is unreachable)", [
+  {
+    name: "code after return",
+    code: `function foo() { return x; dead(); }`,
+    unreachable: { dead: true },
+  },
+  {
+    name: "code after throw",
+    code: `function foo() { throw error; dead(); }`,
+    unreachable: { dead: true },
+  },
+  {
+    name: "code after break in loop",
+    code: `while (true) { break; dead(); }`,
+    unreachable: { dead: true },
+  },
+  {
+    name: "code after continue in loop",
+    code: `while (true) { continue; dead(); }`,
+    unreachable: { dead: true },
+  },
+  {
+    name: "code after return in a switch case",
+    code: `function foo() { switch (foo) { case 1: return; dead(); } }`,
+    unreachable: { dead: true },
+  },
+  {
+    name: "code after throw in a switch case",
+    code: `function foo() { switch (foo) { case 1: throw e; dead(); } }`,
+    unreachable: { dead: true },
+  },
+  {
+    name: "code after break in a switch case inside a loop",
+    code: `while (true) { switch (foo) { case 1: break; dead(); } }`,
+    unreachable: { dead: true },
+  },
+  {
+    name: "code after continue in a switch case inside a loop",
+    code: `while (true) { switch (foo) { case 1: continue; dead(); } }`,
+    unreachable: { dead: true },
+  },
+  {
+    name: "code after a top-level throw",
+    code: `var x = 1; throw "uh oh"; dead();`,
+    unreachable: { dead: true },
+  },
+  {
+    name: "both if branches terminate (return / throw)",
+    code: `function foo() { var x = 1; if (x) { return; } else { throw e; } dead(); }`,
+    unreachable: { dead: true },
+  },
+  {
+    name: "both if branches terminate, unbraced",
+    code: `function foo() { var x = 1; if (x) return; else throw -1; dead(); }`,
+    unreachable: { dead: true },
+  },
+  {
+    name: "try returns, empty finally — code after is unreachable",
+    code: `function foo() { var x = 1; try { return; } finally {} dead(); }`,
+    unreachable: { dead: true },
+  },
+  {
+    name: "finally returns — code after the try is unreachable",
+    code: `function foo() { var x = 1; try {} finally { return; } dead(); }`,
+    unreachable: { dead: true },
+  },
+  {
+    name: "do-while body returns on first iteration",
+    code: `function foo() { var x = 1; do { return; } while (x); dead(); }`,
+    unreachable: { dead: true },
+  },
+  {
+    name: "loop body both breaks and continues — trailing code unreachable",
+    code: `function foo() { var x = 1; while (x) { if (x) break; else continue; dead(); } }`,
+    unreachable: { dead: true },
+  },
+  {
+    name: "infinite for with a continue and no break",
+    code: `function foo() { var x = 1; for (;;) { if (x) continue; } dead(); }`,
+    unreachable: { dead: true },
+  },
+  {
+    name: "while (true) with empty body",
+    code: `function foo() { var x = 1; while (true) {} dead(); }`,
+    unreachable: { dead: true },
+  },
+  {
+    name: "do {} while (true)",
+    code: `function foo() { var x = 1; do {} while (true); dead(); }`,
+    unreachable: { dead: true },
+  },
+  {
+    name: "branches under an early return are unreachable",
+    code: `function foo() { return; if (Math.random() > 0.5) { dead(); } }`,
+    unreachable: { dead: true },
+  },
+  {
+    name: "code after return inside a nested function (own CFG)",
+    code: `function foo() { if (a) { function bar() { return; dead(); } } }`,
+    unreachable: { dead: true },
+  },
+  {
+    name: "return after an infinite loop that returns",
+    code: `function foo() { while (true) { return ""; } dead(); }`,
+    unreachable: { dead: true },
+  },
+]);
+
+runCfgCases("cfg-oxc-no-unreachable / pass (statement is reachable)", [
+  {
+    name: "code after an if that only conditionally returns",
+    code: `function foo() { var x = 1; if (x) { return; } live(); }`,
+    unreachable: { live: false },
+  },
+  {
+    name: "code after an if whose else returns",
+    code: `function foo() { var x = 1; if (x) {} else { return; } live(); }`,
+    unreachable: { live: false },
+  },
+  {
+    name: "switch with a break path reaches trailing code",
+    code: `function foo() { var x = 1; switch (x) { case 0: break; default: return; } live(); }`,
+    unreachable: { live: false },
+  },
+  {
+    name: "while loop may not run, trailing code reachable",
+    code: `function foo() { var x = 1; while (x) { return; } live(); }`,
+    unreachable: { live: false },
+  },
+  {
+    name: "for-in may not iterate, trailing code reachable",
+    code: `function foo() { var x = 1; for (x in {}) { return; } live(); }`,
+    unreachable: { live: false },
+  },
+  {
+    name: "finally always runs even when try returns",
+    code: `function foo() { var x = 1; try { return; } finally { live(); } }`,
+    unreachable: { live: false },
+  },
+  {
+    name: "infinite for with a break reaches trailing code",
+    code: `function foo() { var x = 1; for (;;) { if (x) break; } live(); }`,
+    unreachable: { live: false },
+  },
+  {
+    name: "labeled block break reaches code after the block",
+    code: `A: { break A; } live();`,
+    unreachable: { live: false },
+  },
+  {
+    name: "switch without default falls through to trailing code",
+    code: `function foo() { switch (authType) { case 1: return a(); case 2: return b(); case 3: return c(); } live(); }`,
+    unreachable: { live: false },
+  },
+  {
+    name: "code after try/catch/finally is reachable",
+    code: `try { a(); } catch (e) { b(); } finally { c(); } live();`,
+    unreachable: { live: false },
+  },
+  {
+    name: "code after try/finally is reachable",
+    code: `try { a(); } finally { b(); } live();`,
+    unreachable: { live: false },
+  },
+  {
+    name: "catch body is reachable when try has an infinite loop",
+    code: `try { while (true) { a(); } } catch { live(); }`,
+    unreachable: { live: false },
+  },
+  {
+    name: "finally body is reachable when try has an infinite loop",
+    code: `try { while (true) { a(); } } finally { live(); }`,
+    unreachable: { live: false },
+  },
+  {
+    name: "return after a conditionally-infinite loop is reachable",
+    code: `function foo() { if (Math.random() === 0.5) { while (true) { return "hi"; } } live(); }`,
+    unreachable: { live: false },
+  },
+  {
+    name: "sequential for loops in an else branch are reachable",
+    code: `if (a) { a(); } else { for (let i = 1; i <= 10; i++) { b(); } for (let i = 1; i <= 10; i++) { live(); } }`,
+    unreachable: { live: false },
+  },
+  {
+    name: "code after a try whose body throws into a catch",
+    code: `try { throw "error"; } catch (err) { b(); } live();`,
+    unreachable: { live: false },
+  },
+]);
diff --git a/packages/cfg/tests/control-flow-graph.oxc-no-unsafe-finally.test.ts b/packages/cfg/tests/control-flow-graph.oxc-no-unsafe-finally.test.ts
new file mode 100644
index 000000000..5191ca2b4
--- /dev/null
+++ b/packages/cfg/tests/control-flow-graph.oxc-no-unsafe-finally.test.ts
@@ -0,0 +1,41 @@
+import { runCfgCases } from "./run-cfg.js";
+
+// Curated port of oxc's `eslint/no-unsafe-finally` corpus
+// (`crates/oxc_linter/src/rules/eslint/no_unsafe_finally.rs`). oxc flags a
+// `return` / `throw` / `break` / `continue` in a `finally` because it
+// overrides the abrupt completion of the protected region. The
+// CFG-observable consequence is that an abrupt `finally` swallows the
+// normal continuation: code after the `try` becomes unreachable (the join
+// after `finally` is fed only by the now-orphaned post-abrupt block). We
+// assert that directly with `isUnreachable`, paired with the safe twin.
+
+runCfgCases("cfg-oxc-no-unsafe-finally / abrupt finally swallows completion (oxc FAIL)", [
+  {
+    name: "return in finally makes code after the try unreachable",
+    code: `function f() { try { a(); } finally { return; } after(); }`,
+    unreachable: { after: true },
+  },
+  {
+    name: "throw in finally makes code after the try unreachable",
+    code: `function f() { try { a(); } finally { throw e; } after(); }`,
+    unreachable: { after: true },
+  },
+  {
+    name: "break in a finally inside a loop swallows the loop continuation",
+    code: `while (cond) { try { a(); } finally { break; } afterTry(); }`,
+    unreachable: { afterTry: true },
+  },
+]);
+
+runCfgCases("cfg-oxc-no-unsafe-finally / safe finally (oxc PASS)", [
+  {
+    name: "plain finally lets code after the try run",
+    code: `function f() { try { a(); } finally { cleanup(); } after(); }`,
+    unreachable: { after: false },
+  },
+  {
+    name: "return in try (not finally) still lets a sibling path continue",
+    code: `function f() { try { risky(); } catch (e) { recover(); } after(); }`,
+    unreachable: { after: false },
+  },
+]);
diff --git a/packages/cfg/tests/control-flow-graph.react-compiler.test.ts b/packages/cfg/tests/control-flow-graph.react-compiler.test.ts
new file mode 100644
index 000000000..464c3fe5b
--- /dev/null
+++ b/packages/cfg/tests/control-flow-graph.react-compiler.test.ts
@@ -0,0 +1,73 @@
+import { runCfgCases } from "./run-cfg.js";
+
+// Curated port of the React Compiler's `BuildHIR` control-flow shapes
+// (facebook/react → compiler/packages/babel-plugin-react-compiler/src/HIR/
+// BuildHIR.ts + its `__tests__/fixtures/compiler` control-flow fixtures).
+// The compiler lowers `if` / `switch` / loops / `try` and the value-block
+// terminals (`logical` / `ternary` / `optional`) so that a call nested in a
+// short-circuit is on a conditional path. We assert the same facts our
+// rules consume — `isUnconditionalFromEntry`, `isInsideLoop`, `isReachable`
+// — each paired with the unconditional "quiet twin".
+
+runCfgCases("cfg-react-compiler / value-block terminals are conditional", [
+  {
+    name: "logical && right operand is conditional (lowerLogicalExpression)",
+    code: `function C() { cond && useThing(); useAlways(); }`,
+    unconditional: { useThing: false, useAlways: true },
+  },
+  {
+    name: "logical || right operand is conditional",
+    code: `function C() { cond || useFallback(); }`,
+    unconditional: { useFallback: false },
+  },
+  {
+    name: "nullish ?? right operand is conditional",
+    code: `function C() { value ?? useDefault(); }`,
+    unconditional: { useDefault: false },
+  },
+  {
+    name: "ternary arms are both conditional (lowerConditionalExpression)",
+    code: `function C() { const v = cond ? useA() : useB(); }`,
+    unconditional: { useA: false, useB: false },
+  },
+  {
+    name: "optional-chain continuation is conditional (lowerOptionalMemberExpression)",
+    code: `function C() { obj?.method(track()); track2(); }`,
+    unconditional: { track: false, track2: true },
+  },
+]);
+
+runCfgCases("cfg-react-compiler / statement terminals", [
+  {
+    name: "if consequent is conditional, post-if value is unconditional",
+    code: `function C() { if (cond()) { useThen(); } done(); }`,
+    unconditional: { useThen: false, done: true },
+    reachable: [["cond", "done", true]],
+  },
+  {
+    name: "switch case body is conditional",
+    code: `function C() { switch (x) { case 1: useOne(); break; default: useDefault(); } }`,
+    unconditional: { useOne: false, useDefault: false },
+  },
+  {
+    name: "while body executes once per iteration (isInsideLoop) and is conditional",
+    code: `function C() { while (cond) { useLoop(); } }`,
+    unconditional: { useLoop: false },
+    insideLoop: { useLoop: true },
+  },
+  {
+    name: "for-of body is inside the loop",
+    code: `function C() { for (const item of items) { useEach(item); } }`,
+    insideLoop: { useEach: true },
+  },
+  {
+    name: "try body entry is unconditional, the catch handler is conditional",
+    code: `function C() { try { useTry(); } catch (e) { useCatch(); } }`,
+    unconditional: { useTry: true, useCatch: false },
+  },
+  {
+    name: "guard that throws makes the tail unconditional (maybe-throw bypass)",
+    code: `function C() { if (bad) throw err; useHook(); }`,
+    unconditional: { useHook: true },
+  },
+]);
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/semantic/control-flow-graph.regression.test.ts b/packages/cfg/tests/control-flow-graph.regression.test.ts
similarity index 99%
rename from packages/oxlint-plugin-react-doctor/src/plugin/semantic/control-flow-graph.regression.test.ts
rename to packages/cfg/tests/control-flow-graph.regression.test.ts
index 2945639e6..7ef4178ee 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/semantic/control-flow-graph.regression.test.ts
+++ b/packages/cfg/tests/control-flow-graph.regression.test.ts
@@ -1,4 +1,4 @@
-import { runCfgCases } from "../../test-utils/run-cfg.js";
+import { runCfgCases } from "./run-cfg.js";
 
 // CFG-only regression catalog mined from the Faire monorepo: control-flow
 // bug classes where AST matching is insufficient and the same shape is a bug
diff --git a/packages/cfg/tests/control-flow-graph.returns-every-path.test.ts b/packages/cfg/tests/control-flow-graph.returns-every-path.test.ts
new file mode 100644
index 000000000..732786e67
--- /dev/null
+++ b/packages/cfg/tests/control-flow-graph.returns-every-path.test.ts
@@ -0,0 +1,44 @@
+import { runCfgCases } from "./run-cfg.js";
+
+// "Returns on every path" post-dominance corpus, modeled on oxc's
+// `eslint/getter-return` (`crates/oxc_linter/src/rules/eslint/getter_return.rs`)
+// and `consistent-return`: a getter must return a value on every path,
+// i.e. the implicit fall-through to the function exit must be unreachable.
+// The CFG facts:
+//   - when every branch returns, a trailing marker is unreachable, and a
+//     branch's `return` post-dominates the work before it;
+//   - when one branch falls through, the trailing marker is reachable.
+
+runCfgCases("cfg-getter-return / every path returns (oxc PASS for getters)", [
+  {
+    name: "if/else both return → fall-through is dead",
+    code: `function get() { if (x) { return a(); } else { return b(); } end(); }`,
+    unreachable: { end: true },
+  },
+  {
+    name: "switch with default all-return → fall-through is dead",
+    code: `function get() { switch (x) { case 1: return a(); default: return b(); } end(); }`,
+    unreachable: { end: true },
+  },
+  {
+    name: "guard then return: the return post-dominates the guard, the guard dominates the return",
+    code: `function get() { guard(); return result(); }`,
+    postDominates: [["result", "guard", true]],
+    dominates: [["guard", "result", true]],
+  },
+]);
+
+runCfgCases("cfg-getter-return / a path falls through (oxc FAIL for getters)", [
+  {
+    name: "if without else falls through",
+    code: `function get() { if (cond()) { return a(); } end(); }`,
+    unreachable: { end: false },
+    // The conditional return does NOT post-dominate the entry work.
+    postDominates: [["a", "cond", false]],
+  },
+  {
+    name: "switch missing default falls through",
+    code: `function get() { switch (x) { case 1: return a(); } end(); }`,
+    unreachable: { end: false },
+  },
+]);
diff --git a/packages/cfg/tests/control-flow-graph.terminal-shape.test.ts b/packages/cfg/tests/control-flow-graph.terminal-shape.test.ts
new file mode 100644
index 000000000..19eff8a26
--- /dev/null
+++ b/packages/cfg/tests/control-flow-graph.terminal-shape.test.ts
@@ -0,0 +1,60 @@
+import { describe, expect, it } from "vite-plus/test";
+import { analyzeControlFlow } from "../src/control-flow-graph.js";
+import { attachParentReferences } from "./attach-parent-references.js";
+import { parseFixture } from "./parse-fixture.js";
+import type { EsTreeNode } from "../src/ast/es-tree-node.js";
+
+// Terminal-structure parity with the React Compiler HIR taxonomy
+// (`BabelPluginReactCompiler` → `HIR/BuildHIR.ts`, `HIR/HIR.ts` terminal
+// union). Each construct must lower to its corresponding typed `Terminal`,
+// the fidelity claim of this package: we model the same terminal shapes the
+// compiler does (plus `finalize`/`join` for try/finally, which RC omits).
+const terminalKindsOf = (body: string): string[] => {
+  const parsed = parseFixture(`function host() { ${body} }`);
+  attachParentReferences(parsed.program);
+  const analysis = analyzeControlFlow(parsed.program);
+  const host = (parsed.program as { body: EsTreeNode[] }).body[0]!;
+  const cfg = analysis.cfgFor(host);
+  if (!cfg) throw new Error("fixture produced no CFG for host()");
+  return cfg.blocks.map((block) => block.terminal.kind);
+};
+
+describe("terminal-shape parity (React Compiler HIR taxonomy)", () => {
+  const cases: ReadonlyArray<{ name: string; body: string; kind: string }> = [
+    // Statement terminals.
+    { name: "if", body: "if (x) { a(); }", kind: "if" },
+    { name: "switch", body: "switch (x) { case 1: a(); break; }", kind: "switch" },
+    { name: "while", body: "while (x) { a(); }", kind: "while" },
+    { name: "do-while", body: "do { a(); } while (x);", kind: "do-while" },
+    { name: "for", body: "for (let i = 0; i < n; i++) { a(); }", kind: "for" },
+    { name: "for-in", body: "for (const k in obj) { a(); }", kind: "for-in" },
+    { name: "for-of", body: "for (const v of arr) { a(); }", kind: "for-of" },
+    { name: "try", body: "try { a(); } catch (e) { b(); }", kind: "try" },
+    { name: "return", body: "return 1;", kind: "return" },
+    { name: "throw", body: "throw e;", kind: "throw" },
+    { name: "break → goto", body: "while (x) { break; }", kind: "goto" },
+    { name: "continue → goto", body: "while (x) { continue; }", kind: "goto" },
+    // Expression (value-block) terminals — the React Compiler's
+    // `ternary` / `logical` / `optional`.
+    { name: "ternary", body: "const v = cond ? a() : b();", kind: "ternary" },
+    { name: "logical &&", body: "const v = a() && b();", kind: "logical" },
+    { name: "logical ??", body: "const v = a() ?? b();", kind: "logical" },
+    { name: "logical assignment", body: "let v = a(); v ||= b();", kind: "logical" },
+    { name: "optional chain", body: "const v = obj?.a;", kind: "optional" },
+    { name: "optional call", body: "const v = obj.fn?.();", kind: "optional" },
+  ];
+
+  for (const testCase of cases) {
+    it(`lowers ${testCase.name} to a "${testCase.kind}" terminal`, () => {
+      expect(terminalKindsOf(testCase.body)).toContain(testCase.kind);
+    });
+  }
+
+  it("every reachable block carries a typed terminal (no leftover sentinel)", () => {
+    // The only blocks that may keep the `unreachable` sentinel are genuine
+    // orphans / the function exit. A straight-line function should have its
+    // implicit return modeled as a `return` terminal, not a sentinel.
+    const kinds = terminalKindsOf("a(); b(); c();");
+    expect(kinds).toContain("return");
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/semantic/control-flow-graph.test.ts b/packages/cfg/tests/control-flow-graph.test.ts
similarity index 97%
rename from packages/oxlint-plugin-react-doctor/src/plugin/semantic/control-flow-graph.test.ts
rename to packages/cfg/tests/control-flow-graph.test.ts
index b46b1ce8c..5c53ed995 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/semantic/control-flow-graph.test.ts
+++ b/packages/cfg/tests/control-flow-graph.test.ts
@@ -1,8 +1,8 @@
 import { describe, expect, it } from "@voidzero-dev/vite-plus-test";
-import { analyzeControlFlow } from "./control-flow-graph.js";
-import { attachParentReferences } from "../../test-utils/attach-parent-references.js";
-import { parseFixture } from "../../test-utils/parse-fixture.js";
-import type { EsTreeNode } from "../utils/es-tree-node.js";
+import { analyzeControlFlow } from "../src/control-flow-graph.js";
+import { attachParentReferences } from "./attach-parent-references.js";
+import { parseFixture } from "./parse-fixture.js";
+import type { EsTreeNode } from "../src/ast/es-tree-node.js";
 
 const analyze = (code: string) => {
   const parsed = parseFixture(code);
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/semantic/control-flow-graph.try-finally.test.ts b/packages/cfg/tests/control-flow-graph.try-finally.test.ts
similarity index 94%
rename from packages/oxlint-plugin-react-doctor/src/plugin/semantic/control-flow-graph.try-finally.test.ts
rename to packages/cfg/tests/control-flow-graph.try-finally.test.ts
index c3aad8bf6..357e02eac 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/semantic/control-flow-graph.try-finally.test.ts
+++ b/packages/cfg/tests/control-flow-graph.try-finally.test.ts
@@ -1,8 +1,8 @@
 import { describe, expect, it } from "vite-plus/test";
-import { analyzeControlFlow } from "./control-flow-graph.js";
-import { attachParentReferences } from "../../test-utils/attach-parent-references.js";
-import { parseFixture } from "../../test-utils/parse-fixture.js";
-import type { EsTreeNode } from "../utils/es-tree-node.js";
+import { analyzeControlFlow } from "../src/control-flow-graph.js";
+import { attachParentReferences } from "./attach-parent-references.js";
+import { parseFixture } from "./parse-fixture.js";
+import type { EsTreeNode } from "../src/ast/es-tree-node.js";
 
 // try / catch / finally control-flow, ported from oxc's `no-unreachable`,
 // `no-unsafe-finally`, and `getter-return` suites. These exercise the
diff --git a/packages/cfg/tests/dataflow.test.ts b/packages/cfg/tests/dataflow.test.ts
new file mode 100644
index 000000000..9ae39703c
--- /dev/null
+++ b/packages/cfg/tests/dataflow.test.ts
@@ -0,0 +1,210 @@
+import { describe, expect, it } from "vite-plus/test";
+import { analyzeControlFlow } from "../src/control-flow-graph.js";
+import { solveDataflow } from "../src/dataflow/solve.js";
+import type { Lattice } from "../src/dataflow/lattice.js";
+import { attachParentReferences } from "./attach-parent-references.js";
+import { parseFixture } from "./parse-fixture.js";
+import { analyzeDataflowFixture } from "./run-dataflow.js";
+
+// Layer A — the generic monotone dataflow solver and the definite-assignment
+// analysis built on it.
+
+const cfgOfProgram = (code: string) => {
+  const parsed = parseFixture(code);
+  attachParentReferences(parsed.program);
+  const cfg = analyzeControlFlow(parsed.program).cfgFor(parsed.program);
+  if (!cfg) throw new Error("program has no CFG");
+  return cfg;
+};
+
+describe("solveDataflow / generic worklist", () => {
+  // A toy reachability lattice: fact = "is this block reachable from entry".
+  // join = OR, bottom = false (unreached), boundary = true at the entry.
+  const reachableLattice: Lattice<boolean> = {
+    bottom: false,
+    join: (left, right) => left || right,
+    equals: (left, right) => left === right,
+  };
+
+  it("propagates the boundary fact to every reachable block", () => {
+    const cfg = cfgOfProgram(`
+      const a = 1;
+      const b = 2;
+      const c = a + b;
+    `);
+    const result = solveDataflow<boolean>({
+      cfg,
+      lattice: reachableLattice,
+      direction: "forward",
+      boundary: true,
+      transfer: (_block, incoming) => incoming,
+    });
+    for (const block of cfg.blocks) {
+      if (block === cfg.entry) continue;
+      // Every block on a straight-line program is reachable.
+      const reachableFromEntry = cfg.entry === block || result.entryFactOf(block);
+      expect(reachableFromEntry).toBe(true);
+    }
+  });
+
+  it("reaches a fixpoint over a loop (back-edge does not diverge)", () => {
+    const cfg = cfgOfProgram(`
+      let total = 0;
+      for (let index = 0; index < 10; index++) {
+        total += index;
+      }
+      use(total);
+    `);
+    const result = solveDataflow<boolean>({
+      cfg,
+      lattice: reachableLattice,
+      direction: "forward",
+      boundary: true,
+      transfer: (_block, incoming) => incoming,
+    });
+    // Termination is the property under test; the exit must be reachable.
+    expect(result.entryFactOf(cfg.exit)).toBe(true);
+  });
+
+  it("supports backward flow (liveness-shaped)", () => {
+    const cfg = cfgOfProgram(`
+      const a = 1;
+      use(a);
+    `);
+    // A trivial backward analysis: "can this block reach the exit". join = OR,
+    // boundary = true at the exit; every block in straight-line code can.
+    const result = solveDataflow<boolean>({
+      cfg,
+      lattice: reachableLattice,
+      direction: "backward",
+      boundary: true,
+      transfer: (_block, incoming) => incoming,
+    });
+    expect(result.exitFactOf(cfg.entry)).toBe(true);
+  });
+});
+
+describe("analyzeDefiniteAssignment", () => {
+  it("a let read after an unconditional write is definitely assigned", () => {
+    const fixture = analyzeDataflowFixture(`
+      function f() {
+        let x = 1;
+        return x;
+      }
+    `);
+    // The read of x in `return x` (second occurrence).
+    expect(fixture.definiteAssignment.isMaybeUnassignedAt(fixture.identifier("x#2"))).toBe(false);
+  });
+
+  it("a let written on only one branch is maybe-unassigned at the join read", () => {
+    const fixture = analyzeDataflowFixture(`
+      function f(c) {
+        let x;
+        if (c) {
+          x = 1;
+        }
+        return x;
+      }
+    `);
+    // x#1 declaration, x#2 the conditional write, x#3 the read.
+    expect(fixture.definiteAssignment.isMaybeUnassignedAt(fixture.identifier("x#3"))).toBe(true);
+  });
+
+  it("a let written on both branches is definitely assigned at the join", () => {
+    const fixture = analyzeDataflowFixture(`
+      function f(c) {
+        let x;
+        if (c) {
+          x = 1;
+        } else {
+          x = 2;
+        }
+        return x;
+      }
+    `);
+    expect(fixture.definiteAssignment.isMaybeUnassignedAt(fixture.identifier("x#4"))).toBe(false);
+  });
+
+  it("a write earlier in the same block satisfies a later read", () => {
+    const fixture = analyzeDataflowFixture(`
+      function f() {
+        let x;
+        x = 1;
+        return x;
+      }
+    `);
+    expect(fixture.definiteAssignment.isMaybeUnassignedAt(fixture.identifier("x#3"))).toBe(false);
+  });
+
+  it("a read before any write is maybe-unassigned", () => {
+    const fixture = analyzeDataflowFixture(`
+      function f() {
+        let x;
+        const y = x;
+        x = 1;
+        return y;
+      }
+    `);
+    // x#2 is the read in `const y = x` before x is ever written.
+    expect(fixture.definiteAssignment.isMaybeUnassignedAt(fixture.identifier("x#2"))).toBe(true);
+  });
+});
+
+// Layer D — path feasibility refines definite-assignment: a read whose only
+// unassigned path can't execute is not reported.
+describe("analyzeDefiniteAssignment / path-feasibility refinement", () => {
+  const correlated = `
+    function f(c) {
+      let x;
+      if (c) {
+        x = 1;
+      }
+      if (c) {
+        return x;
+      }
+    }
+  `;
+
+  it("flags the correlated read WITHOUT feasibility (path-insensitive)", () => {
+    const fixture = analyzeDataflowFixture(correlated);
+    expect(fixture.definiteAssignment.isMaybeUnassignedAt(fixture.identifier("x#3"))).toBe(true);
+  });
+
+  it("suppresses the correlated read WITH feasibility", () => {
+    const fixture = analyzeDataflowFixture(correlated);
+    // Reaching `return x` (guard `c`) without the write (also guard `c`) needs
+    // `c` falsy then truthy — provably infeasible.
+    expect(
+      fixture.definiteAssignmentWithFeasibility.isMaybeUnassignedAt(fixture.identifier("x#3")),
+    ).toBe(false);
+  });
+
+  it("keeps the read flagged when the guards are independent", () => {
+    const fixture = analyzeDataflowFixture(`
+      function f(c, d) {
+        let x;
+        if (c) {
+          x = 1;
+        }
+        if (d) {
+          return x;
+        }
+      }
+    `);
+    expect(
+      fixture.definiteAssignmentWithFeasibility.isMaybeUnassignedAt(fixture.identifier("x#3")),
+    ).toBe(true);
+  });
+
+  it("never suppresses a genuinely-unconditional unassigned read", () => {
+    const fixture = analyzeDataflowFixture(`
+      function f() {
+        let x;
+        return x;
+      }
+    `);
+    expect(
+      fixture.definiteAssignmentWithFeasibility.isMaybeUnassignedAt(fixture.identifier("x#2")),
+    ).toBe(true);
+  });
+});
diff --git a/packages/cfg/tests/parse-fixture.ts b/packages/cfg/tests/parse-fixture.ts
new file mode 100644
index 000000000..bdce709e6
--- /dev/null
+++ b/packages/cfg/tests/parse-fixture.ts
@@ -0,0 +1,36 @@
+import * as path from "node:path";
+import { parseSync } from "oxc-parser";
+import type { EsTreeNode } from "../src/ast/es-tree-node.js";
+
+interface ParseFixtureResult {
+  program: EsTreeNode;
+  errors: ReadonlyArray<{ message: string }>;
+}
+
+const FILENAME_TO_LANG: Record<string, "ts" | "tsx" | "js" | "jsx"> = {
+  ".ts": "ts",
+  ".tsx": "tsx",
+  ".js": "js",
+  ".jsx": "jsx",
+  ".mjs": "js",
+  ".cjs": "js",
+  ".mts": "ts",
+  ".cts": "ts",
+};
+
+const resolveLang = (filename: string): "ts" | "tsx" | "js" | "jsx" => {
+  const extension = path.extname(filename).toLowerCase();
+  return FILENAME_TO_LANG[extension] ?? "tsx";
+};
+
+// Parses a code fixture using oxc-parser (the same engine oxlint uses at
+// runtime) with `astType: "ts"` so the returned AST is TSESTree-shaped —
+// matching the type universe `EsTreeNode` describes. The default filename
+// ends in `.tsx` so JSX always parses.
+export const parseFixture = (code: string, filename = "fixture.tsx"): ParseFixtureResult => {
+  const result = parseSync(filename, code, { astType: "ts", lang: resolveLang(filename) });
+  return {
+    program: result.program as unknown as EsTreeNode,
+    errors: result.errors.map((parseError) => ({ message: parseError.message })),
+  };
+};
diff --git a/packages/cfg/tests/path-feasibility.test.ts b/packages/cfg/tests/path-feasibility.test.ts
new file mode 100644
index 000000000..8a51310f0
--- /dev/null
+++ b/packages/cfg/tests/path-feasibility.test.ts
@@ -0,0 +1,186 @@
+import { describe, expect, it } from "vite-plus/test";
+import { isPathFeasible } from "../src/path/feasibility.js";
+import { constAtomOf, valueAtom } from "../src/path/literal-facts.js";
+import type { Atom, PathFact } from "../src/path/literal-facts.js";
+import { lowerGuard, pathConditionFacts } from "../src/path/path-condition.js";
+import { MAX_PATH_CLAUSES } from "../src/constants.js";
+import { isFunctionLike } from "../src/ast/is-function-like.js";
+import { isNodeOfType } from "../src/ast/is-node-of-type.js";
+import type { BasicBlock } from "../src/ir/basic-block.js";
+import type { EsTreeNode } from "../src/ast/es-tree-node.js";
+import { successorBlocks } from "../src/analysis/block-edges.js";
+import { analyzeSsaFixture } from "./run-ssa.js";
+
+// Layer D — the bounded path-feasibility checker, its abstract domain, and
+// the lowering of CFG branch guards into facts.
+
+const x = valueAtom("x");
+const y = valueAtom("y");
+
+describe("isPathFeasible / contradiction detection", () => {
+  it("a value required both truthy and falsy is infeasible", () => {
+    const facts: PathFact[] = [
+      { kind: "truthy", atom: x, polarity: true },
+      { kind: "truthy", atom: x, polarity: false },
+    ];
+    expect(isPathFeasible(facts)).toBe("infeasible");
+  });
+
+  it("a value equated to two distinct constants is infeasible", () => {
+    const one = constAtomOf(1)!;
+    const two = constAtomOf(2)!;
+    const facts: PathFact[] = [
+      { kind: "equality", left: x, right: one, polarity: true },
+      { kind: "equality", left: x, right: two, polarity: true },
+    ];
+    expect(isPathFeasible(facts)).toBe("infeasible");
+  });
+
+  it("equal and not-equal between the same atoms is infeasible", () => {
+    const facts: PathFact[] = [
+      { kind: "equality", left: x, right: y, polarity: true },
+      { kind: "equality", left: x, right: y, polarity: false },
+    ];
+    expect(isPathFeasible(facts)).toBe("infeasible");
+  });
+
+  it("truthy x while x === 0 is infeasible (constant truthiness)", () => {
+    const zero = constAtomOf(0)!;
+    const facts: PathFact[] = [
+      { kind: "truthy", atom: x, polarity: true },
+      { kind: "equality", left: x, right: zero, polarity: true },
+    ];
+    expect(isPathFeasible(facts)).toBe("infeasible");
+  });
+
+  it("independent constraints are feasible", () => {
+    const facts: PathFact[] = [
+      { kind: "truthy", atom: x, polarity: true },
+      { kind: "truthy", atom: y, polarity: false },
+    ];
+    expect(isPathFeasible(facts)).toBe("feasible");
+  });
+
+  it("returns unknown past the clause cap", () => {
+    const facts: PathFact[] = Array.from({ length: MAX_PATH_CLAUSES + 1 }, (_unused, index) => ({
+      kind: "truthy" as const,
+      atom: valueAtom(`distinct${index}`),
+      polarity: true,
+    }));
+    expect(isPathFeasible(facts)).toBe("unknown");
+  });
+});
+
+const resolveValueFrom =
+  (fixture: ReturnType<typeof analyzeSsaFixture>) =>
+  (node: EsTreeNode): Atom | null => {
+    const identifier = fixture.ssa.versionAt(node);
+    return identifier ? valueAtom(`${identifier.binding}#${identifier.version}`) : null;
+  };
+
+describe("lowerGuard over SSA values (correlated branches)", () => {
+  it("the same unreassigned value at two branches lowers to one atom", () => {
+    const fixture = analyzeSsaFixture(`
+      function f(x) {
+        if (x) {
+          first();
+        }
+        if (x) {
+          second();
+        }
+      }
+    `);
+    const resolveValue = resolveValueFrom(fixture);
+    // The two `if (x)` tests, in source order.
+    const firstTest = fixture.identifier("x#2");
+    const secondTest = fixture.identifier("x#3");
+    // Taking the first branch true and the second false is impossible.
+    const facts = [
+      ...lowerGuard(firstTest, true, resolveValue),
+      ...lowerGuard(secondTest, false, resolveValue),
+    ];
+    expect(isPathFeasible(facts)).toBe("infeasible");
+    // Taking both branches the same way is fine.
+    expect(
+      isPathFeasible([
+        ...lowerGuard(firstTest, true, resolveValue),
+        ...lowerGuard(secondTest, true, resolveValue),
+      ]),
+    ).toBe("feasible");
+  });
+
+  it("equality guards refute mismatched constants across branches", () => {
+    const fixture = analyzeSsaFixture(`
+      function f(x) {
+        if (x === 1) {
+          first();
+        }
+        if (x === 2) {
+          second();
+        }
+      }
+    `);
+    const resolveValue = resolveValueFrom(fixture);
+    const firstTest = fixture.identifier("x#2").parent as EsTreeNode;
+    const secondTest = fixture.identifier("x#3").parent as EsTreeNode;
+    const facts = [
+      ...lowerGuard(firstTest, true, resolveValue),
+      ...lowerGuard(secondTest, true, resolveValue),
+    ];
+    expect(isPathFeasible(facts)).toBe("infeasible");
+  });
+
+  it("does NOT lower loose `==` to an identity fact (it would be unsound)", () => {
+    // `x == 0 && x` is satisfiable (e.g. `x = []`), so the guard must not let
+    // the checker prove it infeasible. `==` yields no fact at all.
+    const fixture = analyzeSsaFixture(`
+      function f(x) {
+        if (x == 0) {
+          first();
+        }
+      }
+    `);
+    const resolveValue = resolveValueFrom(fixture);
+    const looseTest = fixture.identifier("x#2").parent as EsTreeNode;
+    expect(lowerGuard(looseTest, true, resolveValue)).toEqual([]);
+  });
+});
+
+const findPath = (entry: BasicBlock, target: BasicBlock): BasicBlock[] | null => {
+  const stack: BasicBlock[][] = [[entry]];
+  const visited = new Set<BasicBlock>();
+  while (stack.length > 0) {
+    const path = stack.pop()!;
+    const tail = path[path.length - 1]!;
+    if (tail === target) return path;
+    if (visited.has(tail)) continue;
+    visited.add(tail);
+    for (const next of successorBlocks(tail)) stack.push([...path, next]);
+  }
+  return null;
+};
+
+describe("pathConditionFacts over a real CFG path", () => {
+  it("extracts the branch guard taken along a path to a block", () => {
+    const fixture = analyzeSsaFixture(`
+      function f(x) {
+        if (x) {
+          guarded();
+        }
+      }
+    `);
+    const owner = fixture.functions.find(({ owner }) => isFunctionLike(owner))!.owner;
+    const cfg = fixture.ssa.controlFlow.cfgFor(owner)!;
+    const guardedCall = fixture.identifier("guarded");
+    const targetBlock = cfg.blockOf(
+      isNodeOfType(guardedCall.parent as EsTreeNode, "CallExpression")
+        ? (guardedCall.parent as EsTreeNode)
+        : guardedCall,
+    )!;
+    const path = findPath(cfg.entry, targetBlock)!;
+    const facts = pathConditionFacts(path, resolveValueFrom(fixture));
+    expect(facts.length).toBe(1);
+    expect(facts[0]).toMatchObject({ kind: "truthy", polarity: true });
+    expect(isPathFeasible(facts)).toBe("feasible");
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/test-utils/run-cfg.ts b/packages/cfg/tests/run-cfg.ts
similarity index 95%
rename from packages/oxlint-plugin-react-doctor/src/test-utils/run-cfg.ts
rename to packages/cfg/tests/run-cfg.ts
index e1bc71e53..8fae3815e 100644
--- a/packages/oxlint-plugin-react-doctor/src/test-utils/run-cfg.ts
+++ b/packages/cfg/tests/run-cfg.ts
@@ -1,10 +1,10 @@
 import { describe, expect, it } from "vite-plus/test";
-import { analyzeControlFlow } from "../plugin/semantic/control-flow-graph.js";
-import type { ControlFlowAnalysis } from "../plugin/semantic/control-flow-graph.js";
+import { analyzeControlFlow } from "../src/control-flow-graph.js";
+import type { ControlFlowAnalysis } from "../src/control-flow-graph.js";
 import { attachParentReferences } from "./attach-parent-references.js";
 import { parseFixture } from "./parse-fixture.js";
-import { isAstNode } from "../plugin/utils/is-ast-node.js";
-import type { EsTreeNode } from "../plugin/utils/es-tree-node.js";
+import { isAstNode } from "../src/ast/is-ast-node.js";
+import type { EsTreeNode } from "../src/ast/es-tree-node.js";
 
 // A control-flow node addressed by the name of a marker call in the
 // fixture, e.g. `acquire()` is `"acquire"`. When a fixture calls the same
diff --git a/packages/cfg/tests/run-dataflow.ts b/packages/cfg/tests/run-dataflow.ts
new file mode 100644
index 000000000..1a82daad3
--- /dev/null
+++ b/packages/cfg/tests/run-dataflow.ts
@@ -0,0 +1,76 @@
+import { analyzeControlFlow } from "../src/control-flow-graph.js";
+import type { ControlFlowAnalysis } from "../src/control-flow-graph.js";
+import { analyzeDefiniteAssignment } from "../src/dataflow/definite-assignment.js";
+import type { DefiniteAssignmentAnalysis } from "../src/dataflow/definite-assignment.js";
+import { isAstNode } from "../src/ast/is-ast-node.js";
+import { isNodeOfType } from "../src/ast/is-node-of-type.js";
+import type { EsTreeNode } from "../src/ast/es-tree-node.js";
+import { analyzeSsa } from "../src/ssa.js";
+import { ssaValueResolver } from "../src/path/ssa-value-atom.js";
+import { attachParentReferences } from "./attach-parent-references.js";
+import { parseFixture } from "./parse-fixture.js";
+
+export interface DataflowFixture {
+  readonly program: EsTreeNode;
+  readonly controlFlow: ControlFlowAnalysis;
+  readonly definiteAssignment: DefiniteAssignmentAnalysis;
+  // Same analysis, with the Layer D path-feasibility refinement wired in.
+  readonly definiteAssignmentWithFeasibility: DefiniteAssignmentAnalysis;
+  // The nth (`"x#2"`) source-order identifier named `x`; `"x"` is the first.
+  readonly identifier: (spec: string) => EsTreeNode;
+}
+
+const collectIdentifiers = (root: EsTreeNode, name: string): EsTreeNode[] => {
+  const matches: EsTreeNode[] = [];
+  const visit = (node: EsTreeNode): void => {
+    if (isNodeOfType(node, "Identifier") && node.name === name) matches.push(node);
+    const record = node as unknown as Record<string, unknown>;
+    for (const key of Object.keys(record)) {
+      if (key === "parent") continue;
+      const child = record[key];
+      if (Array.isArray(child)) {
+        for (const item of child) if (isAstNode(item)) visit(item);
+      } else if (isAstNode(child)) {
+        visit(child);
+      }
+    }
+  };
+  visit(root);
+  return matches;
+};
+
+export const analyzeDataflowFixture = (code: string): DataflowFixture => {
+  const parsed = parseFixture(code);
+  if (parsed.errors.length > 0) {
+    throw new Error(
+      `dataflow fixture failed to parse: ${parsed.errors.map((error) => error.message).join("; ")}`,
+    );
+  }
+  attachParentReferences(parsed.program);
+
+  const identifier = (spec: string): EsTreeNode => {
+    const hashIndex = spec.lastIndexOf("#");
+    const name = hashIndex === -1 ? spec : spec.slice(0, hashIndex);
+    const occurrence = hashIndex === -1 ? 1 : Number(spec.slice(hashIndex + 1));
+    const matches = collectIdentifiers(parsed.program, name);
+    const node = matches[occurrence - 1];
+    if (!node) {
+      throw new Error(
+        `dataflow identifier "${spec}" not found — fixture has ${matches.length} "${name}" identifier(s)`,
+      );
+    }
+    return node;
+  };
+
+  const resolveValue = ssaValueResolver(analyzeSsa(parsed.program));
+
+  return {
+    program: parsed.program,
+    controlFlow: analyzeControlFlow(parsed.program),
+    definiteAssignment: analyzeDefiniteAssignment(parsed.program),
+    definiteAssignmentWithFeasibility: analyzeDefiniteAssignment(parsed.program, undefined, {
+      resolveValue,
+    }),
+    identifier,
+  };
+};
diff --git a/packages/cfg/tests/run-ssa.ts b/packages/cfg/tests/run-ssa.ts
new file mode 100644
index 000000000..108c2925f
--- /dev/null
+++ b/packages/cfg/tests/run-ssa.ts
@@ -0,0 +1,170 @@
+import { expect } from "vite-plus/test";
+import { analyzeSsa } from "../src/ssa.js";
+import type { FunctionSsa, SsaAnalysis } from "../src/ssa.js";
+import { computeDominatorTree } from "../src/analysis/dominators.js";
+import { isAstNode } from "../src/ast/is-ast-node.js";
+import { isFunctionLike } from "../src/ast/is-function-like.js";
+import { isNodeOfType } from "../src/ast/is-node-of-type.js";
+import type { BasicBlock } from "../src/ir/basic-block.js";
+import type { BindingId } from "../src/ir/place.js";
+import type { EsTreeNode } from "../src/ast/es-tree-node.js";
+import { attachParentReferences } from "./attach-parent-references.js";
+import { parseFixture } from "./parse-fixture.js";
+
+export interface SsaFixture {
+  readonly ssa: SsaAnalysis;
+  readonly program: EsTreeNode;
+  // Every function-like node (plus the Program) that has an SSA result.
+  readonly functions: ReadonlyArray<{ owner: EsTreeNode; functionSsa: FunctionSsa }>;
+  // Resolves an identifier marker to its node. `"x"` is the first `x`
+  // identifier in source order; `"x#2"` the second.
+  readonly identifier: (spec: string) => EsTreeNode;
+}
+
+const collectIdentifiers = (root: EsTreeNode, name: string): EsTreeNode[] => {
+  const matches: EsTreeNode[] = [];
+  const visit = (node: EsTreeNode): void => {
+    if (isNodeOfType(node, "Identifier") && node.name === name) matches.push(node);
+    const record = node as unknown as Record<string, unknown>;
+    for (const key of Object.keys(record)) {
+      if (key === "parent") continue;
+      const child = record[key];
+      if (Array.isArray(child)) {
+        for (const item of child) if (isAstNode(item)) visit(item);
+      } else if (isAstNode(child)) {
+        visit(child);
+      }
+    }
+  };
+  visit(root);
+  return matches;
+};
+
+export const analyzeSsaFixture = (code: string): SsaFixture => {
+  const parsed = parseFixture(code);
+  if (parsed.errors.length > 0) {
+    throw new Error(
+      `SSA fixture failed to parse: ${parsed.errors.map((error) => error.message).join("; ")}`,
+    );
+  }
+  attachParentReferences(parsed.program);
+  const ssa = analyzeSsa(parsed.program);
+
+  const functions: Array<{ owner: EsTreeNode; functionSsa: FunctionSsa }> = [];
+  const pushFunction = (owner: EsTreeNode): void => {
+    const functionSsa = ssa.ssaFor(owner);
+    if (functionSsa) functions.push({ owner, functionSsa });
+  };
+  // The program, then every nested function-like node.
+  pushFunction(parsed.program);
+  const walk = (node: EsTreeNode): void => {
+    if (isFunctionLike(node)) pushFunction(node);
+    const record = node as unknown as Record<string, unknown>;
+    for (const key of Object.keys(record)) {
+      if (key === "parent") continue;
+      const child = record[key];
+      if (Array.isArray(child)) {
+        for (const candidate of child) if (isAstNode(candidate)) walk(candidate);
+      } else if (isAstNode(child)) {
+        walk(child);
+      }
+    }
+  };
+  walk(parsed.program);
+
+  const identifier = (spec: string): EsTreeNode => {
+    const hashIndex = spec.lastIndexOf("#");
+    const name = hashIndex === -1 ? spec : spec.slice(0, hashIndex);
+    const occurrence = hashIndex === -1 ? 1 : Number(spec.slice(hashIndex + 1));
+    const matches = collectIdentifiers(parsed.program, name);
+    const node = matches[occurrence - 1];
+    if (!node) {
+      throw new Error(
+        `SSA identifier "${spec}" not found — fixture has ${matches.length} "${name}" identifier(s)`,
+      );
+    }
+    return node;
+  };
+
+  return { ssa, program: parsed.program, functions, identifier };
+};
+
+// The classical iterated dominance frontier of a set of definition blocks
+// (Cytron et al.). For a binding live across every relevant join, this is
+// exactly where minimal SSA must place φ-functions — the strong oracle the
+// Braun construction is checked against.
+const iteratedDominanceFrontier = (
+  definitionBlocks: ReadonlySet<BasicBlock>,
+  dominanceFrontierOf: (block: BasicBlock) => ReadonlySet<BasicBlock>,
+): Set<BasicBlock> => {
+  const result = new Set<BasicBlock>();
+  const worklist = [...definitionBlocks];
+  while (worklist.length > 0) {
+    const block = worklist.pop()!;
+    for (const frontierBlock of dominanceFrontierOf(block)) {
+      if (!result.has(frontierBlock)) {
+        result.add(frontierBlock);
+        worklist.push(frontierBlock);
+      }
+    }
+  }
+  return result;
+};
+
+interface PhiPlacement {
+  // Blocks carrying a φ for the binding, by block id (sorted).
+  readonly phiBlockIds: number[];
+  // The iterated dominance frontier of the binding's def blocks, by id.
+  readonly frontierBlockIds: number[];
+}
+
+const placementFor = (functionSsa: FunctionSsa, binding: BindingId): PhiPlacement => {
+  const dominatorTree = computeDominatorTree(functionSsa.cfg.entry);
+  const phiBlockIds: number[] = [];
+  for (const block of functionSsa.cfg.blocks) {
+    if (functionSsa.phisOf(block).some((phi) => phi.identifier.binding === binding)) {
+      phiBlockIds.push(block.id);
+    }
+  }
+  const frontier = iteratedDominanceFrontier(functionSsa.defBlocksOf(binding), (block) =>
+    dominatorTree.dominanceFrontierOf(block),
+  );
+  return {
+    phiBlockIds: phiBlockIds.sort((a, b) => a - b),
+    frontierBlockIds: [...frontier].map((block) => block.id).sort((a, b) => a - b),
+  };
+};
+
+// Soundness invariant, asserted on EVERY fixture: a φ can only sit at a
+// block in the iterated dominance frontier of its binding's definitions.
+// Braun must never place a φ outside it.
+export const assertPhisWithinDominanceFrontier = (fixture: SsaFixture): void => {
+  for (const { functionSsa } of fixture.functions) {
+    for (const binding of functionSsa.definedBindings) {
+      const { phiBlockIds, frontierBlockIds } = placementFor(functionSsa, binding);
+      const frontierSet = new Set(frontierBlockIds);
+      const stray = phiBlockIds.filter((id) => !frontierSet.has(id));
+      expect(`binding ${binding} φ outside frontier: [${stray}]`).toBe(
+        `binding ${binding} φ outside frontier: []`,
+      );
+    }
+  }
+};
+
+// Completeness, asserted on fixtures where the tested binding is live at
+// every join: the φ placement equals the iterated dominance frontier
+// exactly (the classic minimal-SSA equivalence).
+export const assertPhiPlacementEqualsFrontier = (
+  fixture: SsaFixture,
+  bindingNode: EsTreeNode,
+): void => {
+  const binding = fixture.ssa.bindingOf(bindingNode);
+  expect(binding).not.toBeNull();
+  for (const { functionSsa } of fixture.functions) {
+    if (!functionSsa.definedBindings.has(binding!)) continue;
+    const { phiBlockIds, frontierBlockIds } = placementFor(functionSsa, binding!);
+    expect(`φ blocks [${phiBlockIds}]`).toBe(`φ blocks [${frontierBlockIds}]`);
+    return;
+  }
+  throw new Error("binding has no defining function in this fixture");
+};
diff --git a/packages/cfg/tests/run-typestate.ts b/packages/cfg/tests/run-typestate.ts
new file mode 100644
index 000000000..d181ac630
--- /dev/null
+++ b/packages/cfg/tests/run-typestate.ts
@@ -0,0 +1,114 @@
+import { analyzeControlFlow } from "../src/control-flow-graph.js";
+import type { FunctionCfg } from "../src/ir/basic-block.js";
+import { isAstNode } from "../src/ast/is-ast-node.js";
+import { isFunctionLike } from "../src/ast/is-function-like.js";
+import { isNodeOfType } from "../src/ast/is-node-of-type.js";
+import type { EsTreeNode } from "../src/ast/es-tree-node.js";
+import type {
+  ResourceEvent,
+  TypestateClassifier,
+  TypestateViolation,
+} from "../src/typestate/verify.js";
+import { verifyTypestate } from "../src/typestate/verify.js";
+import type { TypestateAutomaton } from "../src/typestate/automaton.js";
+import { analyzeSsa } from "../src/ssa.js";
+import { ssaValueResolver } from "../src/path/ssa-value-atom.js";
+import type { ResolveValueAtom } from "../src/path/path-condition.js";
+import { attachParentReferences } from "./attach-parent-references.js";
+import { parseFixture } from "./parse-fixture.js";
+
+// An open→closed protocol: `open(r)` acquires, `close(r)` releases. Illegal
+// events (close-before-open, double-open, double-close) reach the error
+// state; a resource left `opened` at exit leaks.
+export const openCloseAutomaton: TypestateAutomaton = {
+  initial: "initial",
+  transition: (state, event) => {
+    if (event === "open") return state === "opened" ? "error" : "opened";
+    if (event === "close") return state === "opened" ? "closed" : "error";
+    return state;
+  },
+  errorStates: new Set(["error"]),
+  acceptingStates: new Set(["initial", "closed"]),
+};
+
+// Classifies `open(x)` / `close(x)` calls anywhere in an instruction's
+// subtree, keyed by the argument identifier.
+export const openCloseClassifier: TypestateClassifier = (instructionNode) => {
+  const events: ResourceEvent[] = [];
+  const visit = (node: EsTreeNode): void => {
+    if (
+      isNodeOfType(node, "CallExpression") &&
+      isNodeOfType(node.callee, "Identifier") &&
+      (node.callee.name === "open" || node.callee.name === "close")
+    ) {
+      const argument = node.arguments[0];
+      if (argument && isNodeOfType(argument as EsTreeNode, "Identifier")) {
+        events.push({
+          resource: (argument as { name: string }).name,
+          event: node.callee.name,
+          node,
+        });
+      }
+    }
+    const record = node as unknown as Record<string, unknown>;
+    for (const key of Object.keys(record)) {
+      if (key === "parent") continue;
+      const child = record[key];
+      if (Array.isArray(child)) {
+        for (const item of child) if (isAstNode(item)) visit(item);
+      } else if (isAstNode(child)) {
+        visit(child);
+      }
+    }
+  };
+  visit(instructionNode);
+  return events;
+};
+
+const firstFunctionCfg = (program: EsTreeNode): FunctionCfg => {
+  const controlFlow = analyzeControlFlow(program);
+  let found: FunctionCfg | null = null;
+  const visit = (node: EsTreeNode): void => {
+    if (found) return;
+    if (isFunctionLike(node)) {
+      found = controlFlow.cfgFor(node);
+      return;
+    }
+    const record = node as unknown as Record<string, unknown>;
+    for (const key of Object.keys(record)) {
+      if (key === "parent") continue;
+      const child = record[key];
+      if (Array.isArray(child)) {
+        for (const item of child) if (isAstNode(item)) visit(item);
+      } else if (isAstNode(child)) {
+        visit(child);
+      }
+    }
+  };
+  visit(program);
+  const cfg = found ?? controlFlow.cfgFor(program);
+  if (!cfg) throw new Error("fixture has no CFG");
+  return cfg;
+};
+
+// Verifies the open/close protocol over the first function in `code` (or the
+// Program if there is none). When `withFeasibility` is set, the Layer D
+// path-feasibility refinement is wired in (resolving SSA values to atoms), so
+// leaks whose only leaking path is provably infeasible are suppressed.
+export const verifyOpenClose = (code: string, withFeasibility = false): TypestateViolation[] => {
+  const parsed = parseFixture(code);
+  if (parsed.errors.length > 0) {
+    throw new Error(`typestate fixture failed to parse: ${parsed.errors[0]?.message}`);
+  }
+  attachParentReferences(parsed.program);
+  const cfg = firstFunctionCfg(parsed.program);
+  let resolveValue: ResolveValueAtom | undefined;
+  if (withFeasibility) {
+    resolveValue = ssaValueResolver(analyzeSsa(parsed.program));
+  }
+  return verifyTypestate(cfg, {
+    automaton: openCloseAutomaton,
+    classifier: openCloseClassifier,
+    resolveValue,
+  });
+};
diff --git a/packages/cfg/tests/ssa.test.ts b/packages/cfg/tests/ssa.test.ts
new file mode 100644
index 000000000..df8d7a85c
--- /dev/null
+++ b/packages/cfg/tests/ssa.test.ts
@@ -0,0 +1,190 @@
+import { describe, expect, it } from "vite-plus/test";
+import {
+  analyzeSsaFixture,
+  assertPhiPlacementEqualsFrontier,
+  assertPhisWithinDominanceFrontier,
+} from "./run-ssa.js";
+
+// SSA construction parity. The φ placement the Braun on-the-fly builder
+// produces is checked against the classical iterated dominance frontier of
+// each binding's definitions (Cytron et al.) — the strong, implementation-
+// independent oracle for minimal SSA. Soundness (φ ⊆ frontier) holds on
+// every fixture; completeness (φ == frontier) holds where the binding is
+// live at every join, which these fixtures are built to guarantee.
+
+describe("ssa / φ placement parity", () => {
+  it("straight-line code needs no φ", () => {
+    const fixture = analyzeSsaFixture(`
+      function f() {
+        let x = first();
+        x = second();
+        return x;
+      }
+    `);
+    assertPhisWithinDominanceFrontier(fixture);
+    assertPhiPlacementEqualsFrontier(fixture, fixture.identifier("x"));
+  });
+
+  it("if/else join: one φ at the merge", () => {
+    const fixture = analyzeSsaFixture(`
+      function f(p) {
+        let x = 1;
+        if (p) {
+          x = 2;
+        } else {
+          x = 3;
+        }
+        return x;
+      }
+    `);
+    assertPhisWithinDominanceFrontier(fixture);
+    assertPhiPlacementEqualsFrontier(fixture, fixture.identifier("x"));
+  });
+
+  it("if without else: φ at the merge", () => {
+    const fixture = analyzeSsaFixture(`
+      function f(p) {
+        let x = 1;
+        if (p) {
+          x = 2;
+        }
+        return x;
+      }
+    `);
+    assertPhisWithinDominanceFrontier(fixture);
+    assertPhiPlacementEqualsFrontier(fixture, fixture.identifier("x"));
+  });
+
+  it("while loop: φ at the header", () => {
+    const fixture = analyzeSsaFixture(`
+      function f() {
+        let x = 0;
+        while (cond(x)) {
+          x = next(x);
+        }
+        return x;
+      }
+    `);
+    assertPhisWithinDominanceFrontier(fixture);
+    assertPhiPlacementEqualsFrontier(fixture, fixture.identifier("x"));
+  });
+
+  it("nested loops: φ at each header", () => {
+    const fixture = analyzeSsaFixture(`
+      function f() {
+        let x = 0;
+        while (outer(x)) {
+          while (inner(x)) {
+            x = step(x);
+          }
+        }
+        return x;
+      }
+    `);
+    assertPhisWithinDominanceFrontier(fixture);
+    assertPhiPlacementEqualsFrontier(fixture, fixture.identifier("x"));
+  });
+
+  it("reassignment across branches then read", () => {
+    const fixture = analyzeSsaFixture(`
+      function f(p, q) {
+        let x = init();
+        if (p) {
+          x = a();
+        }
+        if (q) {
+          x = b();
+        }
+        return use(x);
+      }
+    `);
+    assertPhisWithinDominanceFrontier(fixture);
+    assertPhiPlacementEqualsFrontier(fixture, fixture.identifier("x"));
+  });
+
+  it("shadowing: inner and outer bindings are kept distinct", () => {
+    const fixture = analyzeSsaFixture(`
+      function f(p) {
+        let x = 1;
+        {
+          let x = 2;
+          if (p) {
+            x = 3;
+          }
+          inner(x);
+        }
+        return x;
+      }
+    `);
+    assertPhisWithinDominanceFrontier(fixture);
+    // The OUTER x is never reassigned after its single definition, so it
+    // gets no φ; the INNER x (written in a branch, read after) does.
+    const outerX = fixture.identifier("x");
+    expect(fixture.ssa.bindingOf(outerX)).not.toBe(
+      fixture.ssa.bindingOf(fixture.identifier("x#2")),
+    );
+  });
+});
+
+describe("ssa / value queries", () => {
+  it("versions distinguish writes and the merged read", () => {
+    const fixture = analyzeSsaFixture(`
+      function f(p) {
+        let x = 1;
+        if (p) {
+          x = 2;
+        }
+        return x;
+      }
+    `);
+    const firstWrite = fixture.ssa.versionAt(fixture.identifier("x")); // let x = 1
+    const branchWrite = fixture.ssa.versionAt(fixture.identifier("x#2")); // x = 2
+    const mergedRead = fixture.ssa.reachingDefinition(fixture.identifier("x#3")); // return x
+    expect(firstWrite).not.toBeNull();
+    expect(branchWrite).not.toBeNull();
+    expect(mergedRead).not.toBeNull();
+    expect(firstWrite!.version).not.toBe(branchWrite!.version);
+    // The returned value is the φ result — neither of the two source writes.
+    expect(mergedRead!.version).not.toBe(firstWrite!.version);
+    expect(mergedRead!.version).not.toBe(branchWrite!.version);
+  });
+
+  it("isRedefinedBetween tracks a write on the path", () => {
+    const fixture = analyzeSsaFixture(`
+      function f(p) {
+        let x = read();
+        capture(x);
+        if (p) {
+          x = mutate();
+        }
+        return finalUse(x);
+      }
+    `);
+    const binding = fixture.ssa.bindingOf(fixture.identifier("x"));
+    expect(binding).not.toBeNull();
+    const captureUse = fixture.identifier("x#2"); // capture(x)
+    const finalUse = fixture.identifier("x#4"); // finalUse(x)
+    const declaration = fixture.identifier("x"); // let x = read()
+    expect(fixture.ssa.isRedefinedBetween(captureUse, finalUse, binding!)).toBe(true);
+    // No write between the declaration and the capture immediately after it.
+    expect(fixture.ssa.isRedefinedBetween(declaration, captureUse, binding!)).toBe(false);
+  });
+});
+
+describe("ssa / DOT rendering", () => {
+  it("renders φ-functions in the block label", () => {
+    const fixture = analyzeSsaFixture(`
+      function f(p) {
+        let x = 1;
+        if (p) {
+          x = 2;
+        }
+        return x;
+      }
+    `);
+    const dot = fixture.ssa.controlFlow.toDot(fixture.functions[1]!.owner);
+    expect(dot).not.toBeNull();
+    expect(dot!).toContain("φ(");
+    expect(dot!).toContain("x#");
+  });
+});
diff --git a/packages/cfg/tests/typestate.test.ts b/packages/cfg/tests/typestate.test.ts
new file mode 100644
index 000000000..1ddb4fa87
--- /dev/null
+++ b/packages/cfg/tests/typestate.test.ts
@@ -0,0 +1,176 @@
+import { describe, expect, it } from "vite-plus/test";
+import { verifyOpenClose } from "./run-typestate.js";
+
+// Layer C — the typestate protocol engine, exercised through an open/close
+// automaton. Leaks (opened-at-exit) and error transitions (illegal events)
+// are the two failure modes.
+
+const kinds = (code: string): string[] =>
+  verifyOpenClose(code)
+    .map((violation) => `${violation.kind}:${violation.resource}`)
+    .sort();
+
+describe("verifyTypestate / open-close protocol", () => {
+  it("open then close on the only path is clean", () => {
+    expect(
+      kinds(`
+        function f() {
+          open(r);
+          close(r);
+        }
+      `),
+    ).toEqual([]);
+  });
+
+  it("open with no close leaks", () => {
+    expect(
+      kinds(`
+        function f() {
+          open(r);
+        }
+      `),
+    ).toEqual(["leaked-resource:r"]);
+  });
+
+  it("open on only one branch leaks", () => {
+    expect(
+      kinds(`
+        function f(c) {
+          if (c) {
+            open(r);
+          }
+        }
+      `),
+    ).toEqual(["leaked-resource:r"]);
+  });
+
+  it("open and close on both arms of a branch is clean", () => {
+    expect(
+      kinds(`
+        function f(c) {
+          if (c) {
+            open(r);
+            close(r);
+          }
+        }
+      `),
+    ).toEqual([]);
+  });
+
+  it("an early return that skips close leaks", () => {
+    expect(
+      kinds(`
+        function f(c) {
+          open(r);
+          if (c) {
+            return;
+          }
+          close(r);
+        }
+      `),
+    ).toEqual(["leaked-resource:r"]);
+  });
+
+  it("try/finally close is clean (finalize edge runs on every path)", () => {
+    expect(
+      kinds(`
+        function f() {
+          try {
+            open(r);
+          } finally {
+            close(r);
+          }
+        }
+      `),
+    ).toEqual([]);
+  });
+
+  it("close before open is an error transition", () => {
+    expect(
+      kinds(`
+        function f() {
+          close(r);
+        }
+      `),
+    ).toEqual(["error-transition:r"]);
+  });
+
+  it("double open is an error transition", () => {
+    const violations = verifyOpenClose(`
+      function f() {
+        open(r);
+        open(r);
+        close(r);
+      }
+    `);
+    expect(violations.some((violation) => violation.kind === "error-transition")).toBe(true);
+  });
+
+  it("two independent resources are tracked separately", () => {
+    expect(
+      kinds(`
+        function f() {
+          open(a);
+          close(a);
+          open(b);
+        }
+      `),
+    ).toEqual(["leaked-resource:b"]);
+  });
+});
+
+// Layer D — path feasibility refines the leak check by proving that the only
+// open-without-close path can't execute. `withFeasibility` toggles the wiring.
+const feasibilityKinds = (code: string): string[] =>
+  verifyOpenClose(code, true)
+    .map((violation) => `${violation.kind}:${violation.resource}`)
+    .sort();
+
+describe("verifyTypestate / path-feasibility refinement", () => {
+  const correlated = `
+    function f(x) {
+      if (x) {
+        open(r);
+      }
+      if (x) {
+        close(r);
+      }
+    }
+  `;
+
+  it("flags both the leak and the spurious close-before-open WITHOUT feasibility", () => {
+    // Path-insensitively, the second `if (x)` closes a maybe-`initial` `r`
+    // (close-before-open) AND a maybe-`opened` `r` is left open at exit.
+    expect(kinds(correlated)).toEqual(["error-transition:r", "leaked-resource:r"]);
+  });
+
+  it("suppresses BOTH false positives WITH feasibility (correlated guards)", () => {
+    // The leak needs `if (x)` true-then-false and the close-before-open needs
+    // false-then-true — each requires `x` truthy and falsy at once, so both
+    // counterexamples are provably infeasible.
+    expect(feasibilityKinds(correlated)).toEqual([]);
+  });
+
+  it("never suppresses a genuine leak (open with no close)", () => {
+    expect(
+      feasibilityKinds(`
+        function f() {
+          open(r);
+        }
+      `),
+    ).toEqual(["leaked-resource:r"]);
+  });
+
+  it("keeps the leak when a feasible leak path exists (independent close guard)", () => {
+    expect(
+      feasibilityKinds(`
+        function f(y) {
+          open(r);
+          if (y) {
+            close(r);
+          }
+        }
+      `),
+    ).toEqual(["leaked-resource:r"]);
+  });
+});
diff --git a/packages/cfg/tsconfig.json b/packages/cfg/tsconfig.json
new file mode 100644
index 000000000..8de23db81
--- /dev/null
+++ b/packages/cfg/tsconfig.json
@@ -0,0 +1,8 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "noEmit": true,
+    "types": ["node"]
+  },
+  "include": ["src"]
+}
diff --git a/packages/cfg/vite.config.ts b/packages/cfg/vite.config.ts
new file mode 100644
index 000000000..4da0800cd
--- /dev/null
+++ b/packages/cfg/vite.config.ts
@@ -0,0 +1,16 @@
+import { defineConfig } from "vite-plus";
+
+export default defineConfig({
+  pack: [
+    {
+      entry: { index: "./src/index.ts" },
+      deps: {
+        neverBundle: ["@typescript-eslint/types"],
+      },
+      dts: true,
+      target: "node20",
+      platform: "node",
+      fixedExtension: false,
+    },
+  ],
+});
diff --git a/packages/oxlint-plugin-react-doctor/package.json b/packages/oxlint-plugin-react-doctor/package.json
index b0ebc04d4..7757831ba 100644
--- a/packages/oxlint-plugin-react-doctor/package.json
+++ b/packages/oxlint-plugin-react-doctor/package.json
@@ -58,6 +58,7 @@
     "oxc-parser": "^0.135.0"
   },
   "devDependencies": {
+    "@react-doctor/cfg": "workspace:*",
     "@types/node": "^25.6.0"
   },
   "engines": {
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rule-registry.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rule-registry.ts
index ae3e834ba..825fd2af4 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rule-registry.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rule-registry.ts
@@ -162,6 +162,7 @@ import { noCreateStoreInRender } from "./rules/state-and-effects/no-create-store
 import { noDanger } from "./rules/react-builtins/no-danger.js";
 import { noDangerWithChildren } from "./rules/react-builtins/no-danger-with-children.js";
 import { noDarkModeGlow } from "./rules/design/no-dark-mode-glow.js";
+import { noDeadAssignment } from "./rules/correctness/no-dead-assignment.js";
 import { noDefaultProps } from "./rules/architecture/no-default-props.js";
 import { noDerivedState } from "./rules/state-and-effects/no-derived-state.js";
 import { noDerivedStateEffect } from "./rules/state-and-effects/no-derived-state-effect.js";
@@ -242,7 +243,9 @@ import { noSecretsInClientCode } from "./rules/security/no-secrets-in-client-cod
 import { noSelfUpdatingEffect } from "./rules/state-and-effects/no-self-updating-effect.js";
 import { noSetState } from "./rules/react-builtins/no-set-state.js";
 import { noSetStateInRender } from "./rules/state-and-effects/no-set-state-in-render.js";
+import { noSetStateInRenderLoop } from "./rules/state-and-effects/no-set-state-in-render-loop.js";
 import { noSideTabBorder } from "./rules/design/no-side-tab-border.js";
+import { noStaleClosureCapture } from "./rules/state-and-effects/no-stale-closure-capture.js";
 import { noStaticElementInteractions } from "./rules/a11y/no-static-element-interactions.js";
 import { noStringFalseOnBooleanAttribute } from "./rules/react-builtins/no-string-false-on-boolean-attribute.js";
 import { noStringRefs } from "./rules/react-builtins/no-string-refs.js";
@@ -254,8 +257,11 @@ import { noUncontrolledInput } from "./rules/correctness/no-uncontrolled-input.j
 import { noUndeferredThirdParty } from "./rules/bundle-size/no-undeferred-third-party.js";
 import { noUnescapedEntities } from "./rules/react-builtins/no-unescaped-entities.js";
 import { noUnknownProperty } from "./rules/react-builtins/no-unknown-property.js";
+import { noUnreachableCode } from "./rules/correctness/no-unreachable-code.js";
+import { noUnreleasedResource } from "./rules/state-and-effects/no-unreleased-resource.js";
 import { noUnsafe } from "./rules/react-builtins/no-unsafe.js";
 import { noUnstableNestedComponents } from "./rules/react-builtins/no-unstable-nested-components.js";
+import { noUseBeforeDefine } from "./rules/correctness/no-use-before-define.js";
 import { noUsememoSimpleExpression } from "./rules/performance/no-usememo-simple-expression.js";
 import { noWideLetterSpacing } from "./rules/design/no-wide-letter-spacing.js";
 import { noWillUpdateSetState } from "./rules/react-builtins/no-will-update-set-state.js";
@@ -2202,6 +2208,17 @@ export const reactDoctorRules = [
       category: "Maintainability",
     },
   },
+  {
+    key: "react-doctor/no-dead-assignment",
+    id: "no-dead-assignment",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...noDeadAssignment,
+      framework: "global",
+      category: "Bugs",
+    },
+  },
   {
     key: "react-doctor/no-default-props",
     id: "no-default-props",
@@ -3133,6 +3150,18 @@ export const reactDoctorRules = [
       requires: [...new Set(["react", ...(noSetStateInRender.requires ?? [])])],
     },
   },
+  {
+    key: "react-doctor/no-set-state-in-render-loop",
+    id: "no-set-state-in-render-loop",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...noSetStateInRenderLoop,
+      framework: "global",
+      category: "Bugs",
+      requires: [...new Set(["react", ...(noSetStateInRenderLoop.requires ?? [])])],
+    },
+  },
   {
     key: "react-doctor/no-side-tab-border",
     id: "no-side-tab-border",
@@ -3144,6 +3173,18 @@ export const reactDoctorRules = [
       category: "Maintainability",
     },
   },
+  {
+    key: "react-doctor/no-stale-closure-capture",
+    id: "no-stale-closure-capture",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...noStaleClosureCapture,
+      framework: "global",
+      category: "Bugs",
+      requires: [...new Set(["react", ...(noStaleClosureCapture.requires ?? [])])],
+    },
+  },
   {
     key: "react-doctor/no-static-element-interactions",
     id: "no-static-element-interactions",
@@ -3272,6 +3313,29 @@ export const reactDoctorRules = [
       requires: [...new Set(["react", ...(noUnknownProperty.requires ?? [])])],
     },
   },
+  {
+    key: "react-doctor/no-unreachable-code",
+    id: "no-unreachable-code",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...noUnreachableCode,
+      framework: "global",
+      category: "Bugs",
+    },
+  },
+  {
+    key: "react-doctor/no-unreleased-resource",
+    id: "no-unreleased-resource",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...noUnreleasedResource,
+      framework: "global",
+      category: "Bugs",
+      requires: [...new Set(["react", ...(noUnreleasedResource.requires ?? [])])],
+    },
+  },
   {
     key: "react-doctor/no-unsafe",
     id: "no-unsafe",
@@ -3296,6 +3360,17 @@ export const reactDoctorRules = [
       requires: [...new Set(["react", ...(noUnstableNestedComponents.requires ?? [])])],
     },
   },
+  {
+    key: "react-doctor/no-use-before-define",
+    id: "no-use-before-define",
+    source: "react-doctor",
+    originallyExternal: false,
+    rule: {
+      ...noUseBeforeDefine,
+      framework: "global",
+      category: "Bugs",
+    },
+  },
   {
     key: "react-doctor/no-usememo-simple-expression",
     id: "no-usememo-simple-expression",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-dead-assignment.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-dead-assignment.test.ts
new file mode 100644
index 000000000..35a3f6dd9
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-dead-assignment.test.ts
@@ -0,0 +1,137 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runRule } from "../../../test-utils/run-rule.js";
+import { noDeadAssignment } from "./no-dead-assignment.js";
+
+const run = (code: string) => runRule(noDeadAssignment, code, { filename: "fixture.tsx" });
+
+describe("no-dead-assignment", () => {
+  it("flags a value overwritten before any read", () => {
+    const result = run(`
+      function compute() {
+        let total = expensive();
+        total = cheap();
+        return total;
+      }
+    `);
+    expect(result.parseErrors).toEqual([]);
+    expect(result.diagnostics).toHaveLength(1);
+    expect(result.diagnostics[0].nodeType).toBe("Identifier");
+  });
+
+  it("flags a dead store on every branch before a later use", () => {
+    const result = run(`
+      function compute(flag) {
+        let value = 1;
+        value = 2;
+        if (flag) {
+          value = 3;
+        } else {
+          value = 4;
+        }
+        return value;
+      }
+    `);
+    // The `value = 1` AND `value = 2` initial writes are both dead — each is
+    // overwritten before any read. Two diagnostics.
+    expect(result.diagnostics).toHaveLength(2);
+  });
+
+  it("does NOT flag a write that is read on some path", () => {
+    const result = run(`
+      function compute(flag) {
+        let value = 1;
+        if (flag) {
+          value = 2;
+        }
+        return value;
+      }
+    `);
+    // `value = 1` reaches the return on the !flag path → live.
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a loop-carried value read each iteration", () => {
+    const result = run(`
+      function sum(items) {
+        let acc = 0;
+        for (const item of items) {
+          acc = acc + item;
+        }
+        return acc;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a binding captured by a closure", () => {
+    const result = run(`
+      function make() {
+        let count = 0;
+        const read = () => count;
+        count = 1;
+        return read;
+      }
+    `);
+    // SSA can't see the closure's read of count, so the rule stays silent.
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a const (cannot be reassigned)", () => {
+    const result = run(`
+      function compute() {
+        const value = 1;
+        return value;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a wholly-unused variable (no-unused-vars owns that)", () => {
+    const result = run(`
+      function compute() {
+        let value = 1;
+        value = 2;
+      }
+    `);
+    // `value` is never read at all → not our concern; no read references.
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a compound assignment (read-modify-write)", () => {
+    const result = run(`
+      function compute(start) {
+        let total = start;
+        total += 1;
+        return total;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a write whose value is read before the next write", () => {
+    const result = run(`
+      function compute() {
+        let value = 1;
+        log(value);
+        value = 2;
+        return value;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("flags a dead store inside a loop body overwritten before use", () => {
+    const result = run(`
+      function compute(items) {
+        let result;
+        for (const item of items) {
+          result = stale(item);
+          result = fresh(item);
+          use(result);
+        }
+        return result;
+      }
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-dead-assignment.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-dead-assignment.ts
new file mode 100644
index 000000000..4c3b70ad7
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-dead-assignment.ts
@@ -0,0 +1,63 @@
+import { defineRule } from "../../utils/define-rule.js";
+import { isCapturedByClosure } from "../../utils/is-captured-by-closure.js";
+import { isNodeOfType } from "../../utils/is-node-of-type.js";
+import type { EsTreeNode } from "../../utils/es-tree-node.js";
+import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
+import type { RuleContext } from "../../utils/rule-context.js";
+import type { SymbolDescriptor } from "../../semantic/scope-analysis.js";
+
+// A reassignable local whose value is read somewhere is the only binding a
+// dead store can apply to: `const` can't be reassigned, and a binding with
+// no reads at all is `no-unused-vars`'s job, not ours.
+const isDeadStoreCandidate = (symbol: SymbolDescriptor | null): symbol is SymbolDescriptor => {
+  if (!symbol) return false;
+  if (symbol.kind !== "let" && symbol.kind !== "var") return false;
+  if (isCapturedByClosure(symbol)) return false;
+  return symbol.references.some(
+    (reference) => reference.flag === "read" || reference.flag === "read-write",
+  );
+};
+
+const reportIfDeadStore = (context: RuleContext, writeIdentifier: EsTreeNode): void => {
+  const symbol = context.scopes.symbolFor(writeIdentifier);
+  if (!isDeadStoreCandidate(symbol)) return;
+  const value = context.ssa.versionAt(writeIdentifier);
+  if (!value || context.ssa.isLiveValue(value)) return;
+  context.report({
+    node: writeIdentifier,
+    message: `The value assigned to "${value.name}" here is never read — every path overwrites it before use. Remove this assignment or use the value.`,
+  });
+};
+
+export const noDeadAssignment = defineRule({
+  id: "no-dead-assignment",
+  title: "Dead assignment",
+  severity: "warn",
+  recommendation:
+    "Remove the assignment whose value is never read, or use the value before reassigning. A write that every path overwrites before reading is dead code that hides the real data flow.",
+  create: (context: RuleContext) => ({
+    // `x = …;` as its own statement — the clearest dead-store shape, and the
+    // one our straight-line SSA buckets unambiguously.
+    AssignmentExpression(node: EsTreeNodeOfType<"AssignmentExpression">) {
+      if (node.operator !== "=") return;
+      if (!isNodeOfType(node.left, "Identifier")) return;
+      if (!node.parent || !isNodeOfType(node.parent, "ExpressionStatement")) return;
+      reportIfDeadStore(context, node.left);
+    },
+    // `let x = …;` / `var x = …;` declared at statement level (not a
+    // for-header or export) — a dead initializer.
+    VariableDeclarator(node: EsTreeNodeOfType<"VariableDeclarator">) {
+      if (!node.init || !isNodeOfType(node.id, "Identifier")) return;
+      const declaration = node.parent;
+      if (!declaration || !isNodeOfType(declaration, "VariableDeclaration")) return;
+      const container = declaration.parent;
+      if (
+        !container ||
+        (!isNodeOfType(container, "BlockStatement") && !isNodeOfType(container, "Program"))
+      ) {
+        return;
+      }
+      reportIfDeadStore(context, node.id);
+    },
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-unreachable-code.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-unreachable-code.test.ts
new file mode 100644
index 000000000..9bea64759
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-unreachable-code.test.ts
@@ -0,0 +1,234 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runRule } from "../../../test-utils/run-rule.js";
+import { noUnreachableCode } from "./no-unreachable-code.js";
+
+const run = (code: string) => runRule(noUnreachableCode, code, { filename: "fixture.tsx" });
+
+describe("no-unreachable-code", () => {
+  it("flags a statement after an unconditional return", () => {
+    const result = run(`
+      function compute() {
+        return 1;
+        doWork();
+      }
+    `);
+    expect(result.parseErrors).toEqual([]);
+    expect(result.diagnostics).toHaveLength(1);
+    expect(result.diagnostics[0].nodeType).toBe("ExpressionStatement");
+  });
+
+  it("flags a statement after a throw", () => {
+    const result = run(`
+      function compute() {
+        throw new Error("boom");
+        cleanup();
+      }
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+  });
+
+  it("flags code after break inside a loop", () => {
+    const result = run(`
+      function compute(items) {
+        for (const item of items) {
+          break;
+          process(item);
+        }
+      }
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+  });
+
+  it("flags code after continue", () => {
+    const result = run(`
+      function compute(items) {
+        for (const item of items) {
+          continue;
+          process(item);
+        }
+      }
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+  });
+
+  it("flags code after an infinite loop (const-truthy test)", () => {
+    const result = run(`
+      function compute() {
+        while (true) {
+          tick();
+        }
+        afterLoop();
+      }
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+  });
+
+  it("flags an unreachable statement inside a switch case", () => {
+    const result = run(`
+      function compute(kind) {
+        switch (kind) {
+          case "a":
+            return 1;
+            log("a");
+          default:
+            return 0;
+        }
+      }
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+  });
+
+  it("reports a contiguous dead run only once", () => {
+    const result = run(`
+      function compute() {
+        return 1;
+        first();
+        second();
+        third();
+      }
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+  });
+
+  it("reports a dead nested block once (not its inner statements too)", () => {
+    const result = run(`
+      function compute() {
+        return 1;
+        {
+          inner();
+        }
+      }
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+    expect(result.diagnostics[0].nodeType).toBe("BlockStatement");
+  });
+
+  it("skips a forward to the first runtime statement past a hoisted function", () => {
+    const result = run(`
+      function compute() {
+        return 1;
+        function helper() {}
+        runHelper();
+      }
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+    expect(result.diagnostics[0].nodeType).toBe("ExpressionStatement");
+  });
+
+  it("flags code after both branches of an if/else return", () => {
+    const result = run(`
+      function compute(flag) {
+        if (flag) {
+          return 1;
+        } else {
+          return 2;
+        }
+        after();
+      }
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+  });
+
+  it("flags code after a finally that returns", () => {
+    const result = run(`
+      function compute() {
+        try {
+          go();
+        } finally {
+          return 1;
+        }
+        after();
+      }
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+  });
+
+  it("flags code after a labeled break", () => {
+    const result = run(`
+      function compute(items) {
+        outer: for (const item of items) {
+          break outer;
+          process(item);
+        }
+      }
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+  });
+
+  it("flags a dead class declaration (classes do not hoist like functions)", () => {
+    const result = run(`
+      function compute() {
+        return 1;
+        class Helper {}
+      }
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+  });
+
+  it("stays quiet when an early return is conditional", () => {
+    const result = run(`
+      function compute(flag) {
+        if (flag) return 1;
+        doWork();
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does not fold an `if (true)` test, so the following code is reachable", () => {
+    const result = run(`
+      function compute() {
+        if (true) return 1;
+        after();
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does not flag the next case of a switch fallthrough", () => {
+    const result = run(`
+      function compute(kind) {
+        switch (kind) {
+          case 1:
+            doA();
+          case 2:
+            doB();
+        }
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("stays quiet for a hoisted function declaration after return", () => {
+    const result = run(`
+      function compute() {
+        return 1;
+        function helper() {}
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("stays quiet for an infinite loop with a reachable break", () => {
+    const result = run(`
+      function compute(stop) {
+        while (true) {
+          if (stop()) break;
+        }
+        afterLoop();
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("stays quiet for straight-line code with no jumps", () => {
+    const result = run(`
+      function compute() {
+        const a = 1;
+        const b = 2;
+        return a + b;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-unreachable-code.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-unreachable-code.ts
new file mode 100644
index 000000000..fa33fcf15
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-unreachable-code.ts
@@ -0,0 +1,92 @@
+import { defineRule } from "../../utils/define-rule.js";
+import type { EsTreeNode } from "../../utils/es-tree-node.js";
+import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
+import { isNodeOfType } from "../../utils/is-node-of-type.js";
+import type { RuleContext } from "../../utils/rule-context.js";
+
+// Statement kinds that hoist (function declarations) or carry no runtime
+// effect (type-only TS declarations, import/export decls, the empty `;`),
+// so sitting after a `return` / `throw` is harmless. ESLint's
+// `no-unreachable` makes the same carve-out for hoisting.
+const NON_REPORTABLE_STATEMENT_TYPES: ReadonlySet<string> = new Set([
+  "FunctionDeclaration",
+  "ImportDeclaration",
+  "ExportNamedDeclaration",
+  "ExportDefaultDeclaration",
+  "ExportAllDeclaration",
+  "TSInterfaceDeclaration",
+  "TSTypeAliasDeclaration",
+  "TSModuleDeclaration",
+  "TSDeclareFunction",
+  "TSEnumDeclaration",
+  "TSImportEqualsDeclaration",
+  "EmptyStatement",
+]);
+
+// A bare `var x;` hoists with no runtime effect (the binding is created at
+// the top of the scope), so it is harmless after a jump; only flag a `var`
+// declaration that actually runs an initializer.
+const isReportableStatement = (statement: EsTreeNode): boolean => {
+  if (NON_REPORTABLE_STATEMENT_TYPES.has(statement.type)) return false;
+  if (
+    isNodeOfType(statement, "VariableDeclaration") &&
+    statement.kind === "var" &&
+    (statement.declarations ?? []).every((declarator) => !declarator.init)
+  ) {
+    return false;
+  }
+  return true;
+};
+
+// Report the first runtime statement of the dead tail of a straight-line
+// statement list. A list whose FIRST statement is already unreachable is
+// inherited-dead from an outer construct (e.g. a dead nested block), whose
+// own statement is reported at the outer transition; skipping it keeps each
+// dead region to a single diagnostic.
+const reportFirstUnreachable = (
+  context: RuleContext,
+  statements: ReadonlyArray<EsTreeNode>,
+): void => {
+  if (statements.length === 0) return;
+  if (context.cfg.isUnreachable(statements[0]!)) return;
+
+  let deadIndex = -1;
+  for (let index = 1; index < statements.length; index++) {
+    if (context.cfg.isUnreachable(statements[index]!)) {
+      deadIndex = index;
+      break;
+    }
+  }
+  if (deadIndex < 0) return;
+
+  for (let index = deadIndex; index < statements.length; index++) {
+    const statement = statements[index]!;
+    if (isReportableStatement(statement)) {
+      context.report({
+        node: statement,
+        message:
+          "This code never runs: every path above it returns, throws, breaks, continues, or loops forever. Remove it or fix the control flow above.",
+      });
+      return;
+    }
+  }
+};
+
+export const noUnreachableCode = defineRule({
+  id: "no-unreachable-code",
+  title: "Unreachable code",
+  severity: "warn",
+  recommendation:
+    "Remove the dead code or fix the control flow above it so the path can run. Code after a return, throw, break, continue, or infinite loop never executes.",
+  create: (context: RuleContext) => ({
+    Program(node: EsTreeNodeOfType<"Program">) {
+      reportFirstUnreachable(context, node.body ?? []);
+    },
+    BlockStatement(node: EsTreeNodeOfType<"BlockStatement">) {
+      reportFirstUnreachable(context, node.body ?? []);
+    },
+    SwitchCase(node: EsTreeNodeOfType<"SwitchCase">) {
+      reportFirstUnreachable(context, node.consequent ?? []);
+    },
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-use-before-define.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-use-before-define.test.ts
new file mode 100644
index 000000000..13ae32618
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-use-before-define.test.ts
@@ -0,0 +1,237 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runRule } from "../../../test-utils/run-rule.js";
+import { noUseBeforeDefine } from "./no-use-before-define.js";
+
+const run = (code: string) => runRule(noUseBeforeDefine, code, { filename: "fixture.tsx" });
+
+describe("no-use-before-define", () => {
+  it("flags a read before its let declaration", () => {
+    const result = run(`
+      function compute() {
+        const copy = value;
+        let value = 1;
+        return copy + value;
+      }
+    `);
+    expect(result.parseErrors).toEqual([]);
+    expect(result.diagnostics).toHaveLength(1);
+    expect(result.diagnostics[0].nodeType).toBe("Identifier");
+  });
+
+  it("flags a read before its const declaration", () => {
+    const result = run(`
+      function compute() {
+        console.log(answer);
+        const answer = 42;
+      }
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+  });
+
+  it("flags a class used before its declaration", () => {
+    const result = run(`
+      function build() {
+        const instance = new Widget();
+        class Widget {}
+        return instance;
+      }
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+  });
+
+  it("flags a write before its let declaration", () => {
+    const result = run(`
+      function compute() {
+        value = 1;
+        let value = 2;
+        return value;
+      }
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+  });
+
+  it("flags an access from a nested block before the outer declaration", () => {
+    const result = run(`
+      function compute(flag) {
+        if (flag) {
+          return total;
+        }
+        let total = 1;
+        return total;
+      }
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+  });
+
+  it("does NOT flag a declared-but-unassigned let read (initialized to undefined)", () => {
+    const result = run(`
+      function compute(flag) {
+        let value;
+        if (flag) {
+          value = 1;
+        }
+        return value;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a read after the declaration", () => {
+    const result = run(`
+      function compute() {
+        let value = 1;
+        const copy = value;
+        return copy;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a const read after its declaration", () => {
+    const result = run(`
+      function compute() {
+        const value = 1;
+        return value;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a parameter", () => {
+    const result = run(`
+      function compute(value) {
+        return value;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a hoisted var read before its declaration", () => {
+    const result = run(`
+      function compute() {
+        const copy = value;
+        var value = 1;
+        return copy;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a hoisted function called before its declaration", () => {
+    const result = run(`
+      function compute() {
+        greet();
+        function greet() {}
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a forward reference deferred inside a nested closure", () => {
+    const result = run(`
+      function compute() {
+        const read = () => value;
+        let value = 1;
+        return read();
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a global / unresolved reference", () => {
+    const result = run(`
+      function compute() {
+        return window.location.href;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag an interface member name matching a later value binding", () => {
+    const result = run(`
+      interface Options {
+        onRender?: () => void;
+      }
+      const onRender = () => {};
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a class field initializer referencing a later-declared class", () => {
+    const result = run(`
+      class Manager {
+        private readonly pending = new Pending();
+      }
+      class Pending {}
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag interface heritage extending a later-declared type (type space)", () => {
+    const result = run(`
+      interface WithLength extends LengthMethods {}
+      declare class LengthMethods {
+        get length(): number;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag an interface index-signature parameter name", () => {
+    const result = run(`
+      interface TabData {
+        [tabId: string]: string;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a computed interface key referencing a later const (erased type space)", () => {
+    const result = run(`
+      interface EditableCell {
+        [ORIGINAL_INDEX_KEY]: number;
+      }
+      const ORIGINAL_INDEX_KEY = "__originalIndex__";
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a type-only re-export of a later-declared class", () => {
+    const result = run(`
+      export type { IconPickerService as IIconPickerService } from "@shared/services";
+      export class IconPickerService {}
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a value export specifier preceding the declaration", () => {
+    const result = run(`
+      export { Widget };
+      class Widget {}
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag anything in a .d.ts declaration file", () => {
+    const result = runRule(
+      noUseBeforeDefine,
+      `
+        export interface WithGet extends GetItemMethods {}
+        export declare class GetItemMethods {}
+      `,
+      { filename: "types.d.ts" },
+    );
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("flags a const read before its declaration inside a component body (real TDZ)", () => {
+    const result = run(`
+      const TreeSelect = ({ properties }) => {
+        const [checked, setChecked] = useState(checkedData);
+        const checkedData = isArray(properties.checkedData);
+        return checked;
+      };
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-use-before-define.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-use-before-define.ts
new file mode 100644
index 000000000..c30ba8354
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/correctness/no-use-before-define.ts
@@ -0,0 +1,94 @@
+import { defineRule } from "../../utils/define-rule.js";
+import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
+import { isDeclarationFile } from "../../utils/is-declaration-file.js";
+import { isNodeOfType } from "../../utils/is-node-of-type.js";
+import { nodeStart } from "../../utils/node-start.js";
+import type { RuleContext } from "../../utils/rule-context.js";
+import type { RuleVisitors } from "../../utils/rule-visitors.js";
+import type { ScopeDescriptor, SymbolKind } from "../../semantic/scope-analysis.js";
+
+// Block-scoped bindings (`let` / `const` / `class` / `using`) sit in a
+// Temporal Dead Zone from the top of their scope until their declaration
+// executes. An access that is lexically BEFORE the declaration and runs in
+// the SAME synchronous execution always throws a `ReferenceError`. We flag
+// only that provable case, so the rule has no false positives:
+//   - the binding is block-scoped (TDZ applies; `var` / `function` are
+//     hoisted-and-initialized and params / imports are always bound);
+//   - the access's byte offset precedes the declaration's;
+//   - no function / class boundary sits between the access and the binding's
+//     scope — a nested closure may run AFTER the declaration, so it is not a
+//     guaranteed crash.
+// Reading a declared-but-unassigned `let` (e.g. `let x; if (c) x = 1; use(x)`)
+// is NOT a TDZ error — the binding is initialized to `undefined` — so it is
+// deliberately not reported.
+const TDZ_BINDING_KINDS: ReadonlySet<SymbolKind> = new Set<SymbolKind>([
+  "let",
+  "const",
+  "class",
+  "using",
+]);
+
+// Scopes whose bodies run later than the statement that introduces them: a
+// function/arrow/method when it is called, and a class body's field
+// initializers and methods when the class is instantiated. An access nested
+// inside one may execute AFTER a later declaration, so it is not a guaranteed
+// TDZ crash.
+const isDeferredScope = (scope: ScopeDescriptor): boolean =>
+  scope.kind === "function" ||
+  scope.kind === "arrow-function" ||
+  scope.kind === "method" ||
+  scope.kind === "class";
+
+// True when reaching `bindingScope` from `accessScope` crosses a deferred
+// boundary, so the access is not a guaranteed TDZ crash.
+const crossesDeferredBoundary = (
+  accessScope: ScopeDescriptor,
+  bindingScope: ScopeDescriptor,
+): boolean => {
+  let current: ScopeDescriptor | null = accessScope;
+  while (current && current !== bindingScope) {
+    if (isDeferredScope(current)) return true;
+    current = current.parent;
+  }
+  return false;
+};
+
+export const noUseBeforeDefine = defineRule({
+  id: "no-use-before-define",
+  title: "Variable used before its declaration (Temporal Dead Zone)",
+  severity: "warn",
+  recommendation:
+    "Move the access below the `let` / `const` / `class` declaration. A block-scoped binding accessed before its declaration runs throws a ReferenceError from the Temporal Dead Zone.",
+  create: (context: RuleContext): RuleVisitors => {
+    // Ambient declaration files are pure type space — nothing executes, so a
+    // TDZ ReferenceError is impossible. Skip them entirely.
+    if (isDeclarationFile(context.filename)) return {};
+    return {
+      Identifier(node: EsTreeNodeOfType<"Identifier">) {
+        // An export specifier (`export { Foo }` / `export type { Foo as Bar }`)
+        // is a hoisted binding re-export resolved at module-link time, never an
+        // expression-position read, so it can't trigger a TDZ ReferenceError.
+        if (node.parent && isNodeOfType(node.parent, "ExportSpecifier")) return;
+
+        const reference = context.scopes.referenceFor(node);
+        if (!reference) return;
+
+        const symbol = reference.resolvedSymbol;
+        if (!symbol) return;
+        if (!TDZ_BINDING_KINDS.has(symbol.kind)) return;
+
+        const accessStart = nodeStart(node);
+        const declarationStart = nodeStart(symbol.declarationNode);
+        if (accessStart < 0 || declarationStart < 0) return;
+        if (accessStart >= declarationStart) return;
+
+        if (crossesDeferredBoundary(reference.scope, symbol.scope)) return;
+
+        context.report({
+          node,
+          message: `"${symbol.name}" is used here before its declaration runs, which throws a ReferenceError from the Temporal Dead Zone. Move this access below the declaration.`,
+        });
+      },
+    };
+  },
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/postmessage-origin-risk.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/postmessage-origin-risk.ts
index 2eaa93d79..f2fea9083 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/postmessage-origin-risk.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/security-scan/postmessage-origin-risk.ts
@@ -2,6 +2,7 @@ import { defineRule } from "../../utils/define-rule.js";
 import type { EsTreeNode } from "../../utils/es-tree-node.js";
 import type { ScanFinding } from "../../utils/file-scan.js";
 import { isAstNode } from "../../utils/is-ast-node.js";
+import { nodeStart } from "../../utils/node-start.js";
 import { parseSourceText } from "../../utils/parse-source-file.js";
 import { walkAst } from "../../utils/walk-ast.js";
 import { getLocationAtIndex } from "./utils/get-location-at-index.js";
@@ -26,14 +27,8 @@ const SAME_APPLICATION_CHANNEL_TARGET_PATTERN =
 
 const WORKER_FILE_PATH_PATTERN = /worker/i;
 
-// oxc's parseSync emits ESTree byte offsets as `start`/`end` (it never
-// populates `range`), which TSESTree's types don't declare — so read
-// them structurally.
-const getNodeStartIndex = (node: EsTreeNode): number =>
-  "start" in node && typeof node.start === "number" ? node.start : -1;
-
 const getNodeText = (content: string, node: EsTreeNode): string => {
-  const startIndex = getNodeStartIndex(node);
+  const startIndex = nodeStart(node);
   const endIndex = "end" in node && typeof node.end === "number" ? node.end : -1;
   if (startIndex < 0 || endIndex < 0) return "";
   return content.slice(startIndex, endIndex);
@@ -84,7 +79,7 @@ export const postmessageOriginRisk = defineRule({
       const originCheckIndex = nodeText.search(POSTMESSAGE_ORIGIN_CHECK_PATTERN);
       if (originCheckIndex >= 0 && originCheckIndex < messageDataIndex) return;
 
-      const location = getLocationAtIndex(file.content, getNodeStartIndex(node));
+      const location = getLocationAtIndex(file.content, nodeStart(node));
       findings.push({
         message:
           "A message event handler reads cross-window messages without an obvious origin check.",
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-set-state-in-render-loop.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-set-state-in-render-loop.test.ts
new file mode 100644
index 000000000..8cf4e7661
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-set-state-in-render-loop.test.ts
@@ -0,0 +1,150 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runRule } from "../../../test-utils/run-rule.js";
+import { noSetStateInRenderLoop } from "./no-set-state-in-render-loop.js";
+
+const run = (code: string) => runRule(noSetStateInRenderLoop, code, { filename: "fixture.tsx" });
+
+describe("no-set-state-in-render-loop", () => {
+  it("flags a setter called inside a for-of loop in render", () => {
+    const result = run(`
+      import { useState } from "react";
+      function List({ items }) {
+        const [selected, setSelected] = useState(null);
+        for (const item of items) {
+          setSelected(item);
+        }
+        return null;
+      }
+    `);
+    expect(result.parseErrors).toEqual([]);
+    expect(result.diagnostics).toHaveLength(1);
+    expect(result.diagnostics[0].message).toContain("setSelected");
+  });
+
+  it("flags a setter inside a classic for loop in render", () => {
+    const result = run(`
+      import { useState } from "react";
+      function Counter({ n }) {
+        const [count, setCount] = useState(0);
+        for (let i = 0; i < n; i++) {
+          setCount(i);
+        }
+        return null;
+      }
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+  });
+
+  it("flags a setter inside a while loop in render", () => {
+    const result = run(`
+      import { useState } from "react";
+      function Component({ shouldRun }) {
+        const [value, setValue] = useState(0);
+        while (shouldRun()) {
+          setValue(1);
+        }
+        return null;
+      }
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+  });
+
+  it("stays quiet for a setter inside an array map callback (separate function)", () => {
+    const result = run(`
+      import { useState } from "react";
+      function List({ items }) {
+        const [selected, setSelected] = useState(null);
+        const rows = items.map((item) => {
+          setSelected(item);
+          return item;
+        });
+        return rows;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("stays quiet for a setter inside an event handler with a loop", () => {
+    const result = run(`
+      import { useState } from "react";
+      function Component({ items }) {
+        const [selected, setSelected] = useState(null);
+        const onClick = () => {
+          for (const item of items) {
+            setSelected(item);
+          }
+        };
+        return null;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("stays quiet for a setter called once outside any loop", () => {
+    const result = run(`
+      import { useState } from "react";
+      function Component({ flag }) {
+        const [value, setValue] = useState(0);
+        if (flag) {
+          setValue(1);
+        }
+        return null;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("stays quiet when there are no useState setters", () => {
+    const result = run(`
+      function List({ items, onPick }) {
+        for (const item of items) {
+          onPick(item);
+        }
+        return null;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("defers an unconditional `for (;;)` setter to no-set-state-in-render", () => {
+    const result = run(`
+      import { useState } from "react";
+      function Component() {
+        const [value, setValue] = useState(0);
+        for (;;) {
+          setValue(1);
+        }
+        return null;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("defers an unconditional `while (true)` setter to no-set-state-in-render", () => {
+    const result = run(`
+      import { useState } from "react";
+      function Component() {
+        const [value, setValue] = useState(0);
+        while (true) {
+          setValue(1);
+        }
+        return null;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("ignores setters in a non-component function", () => {
+    const result = run(`
+      import { useState } from "react";
+      function helper({ items }) {
+        const [selected, setSelected] = useState(null);
+        for (const item of items) {
+          setSelected(item);
+        }
+        return null;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-set-state-in-render-loop.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-set-state-in-render-loop.ts
new file mode 100644
index 000000000..aa0ddd910
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-set-state-in-render-loop.ts
@@ -0,0 +1,80 @@
+import { defineRule } from "../../utils/define-rule.js";
+import { isComponentAssignment } from "../../utils/is-component-assignment.js";
+import { isNodeOfType } from "../../utils/is-node-of-type.js";
+import { isUppercaseName } from "../../utils/is-uppercase-name.js";
+import { walkInsideStatementBlocks } from "../../utils/walk-inside-statement-blocks.js";
+import type { EsTreeNode } from "../../utils/es-tree-node.js";
+import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
+import type { RuleContext } from "../../utils/rule-context.js";
+import { collectUseStateBindings } from "./utils/collect-use-state-bindings.js";
+
+// A state setter called inside a render-phase loop fires once per iteration,
+// and each call schedules another render that re-runs the loop, looping
+// forever ("Too many re-renders"). `no-set-state-in-render` only catches
+// setters that run UNCONDITIONALLY on every path; a setter inside a
+// `for (const item of items)` is conditional on the loop running, so it
+// slips past that rule. The CFG's `isInsideLoop` closes that gap precisely:
+// it is true only for a node in a real cycle of the component's OWN CFG, so
+// a setter inside a `.map()` / event-handler callback (a separate function)
+// is never mistaken for a render-phase loop write.
+const findRenderLoopSetterCalls = (
+  context: RuleContext,
+  componentBody: EsTreeNode,
+  setterNames: ReadonlySet<string>,
+): EsTreeNodeOfType<"CallExpression">[] => {
+  const calls: EsTreeNodeOfType<"CallExpression">[] = [];
+  walkInsideStatementBlocks(componentBody, (child) => {
+    if (!isNodeOfType(child, "CallExpression")) return;
+    if (!isNodeOfType(child.callee, "Identifier")) return;
+    if (!setterNames.has(child.callee.name)) return;
+    if (!context.cfg.isInsideLoop(child)) return;
+    // A setter that ALSO runs on every path (`for (;;) setX()`) is the
+    // unconditional render write `no-set-state-in-render` owns; leave it to
+    // that rule so the two never double-report the same call.
+    if (context.cfg.isUnconditionalFromEntry(child)) return;
+    calls.push(child);
+  });
+  return calls;
+};
+
+export const noSetStateInRenderLoop = defineRule({
+  id: "no-set-state-in-render-loop",
+  title: "setState called in a render loop",
+  severity: "warn",
+  recommendation:
+    "Move the setter into an event handler or effect, or compute the value while rendering. A setter called inside a loop during render fires every iteration and starts another render.",
+  create: (context: RuleContext) => {
+    const checkComponent = (componentBody: EsTreeNode | null | undefined): void => {
+      if (!componentBody || !isNodeOfType(componentBody, "BlockStatement")) return;
+      const setterNames = new Set(
+        collectUseStateBindings(componentBody).map((binding) => binding.setterName),
+      );
+      if (setterNames.size === 0) return;
+
+      for (const setterCall of findRenderLoopSetterCalls(context, componentBody, setterNames)) {
+        const setterIdentifierName = (setterCall.callee as EsTreeNodeOfType<"Identifier">).name;
+        context.report({
+          node: setterCall,
+          message: `${setterIdentifierName}() runs inside a render-phase loop, so it fires every iteration and starts another render. Move it into an event handler or effect, or compute the value while rendering.`,
+        });
+      }
+    };
+
+    return {
+      FunctionDeclaration(node: EsTreeNodeOfType<"FunctionDeclaration">) {
+        if (!node.id?.name || !isUppercaseName(node.id.name)) return;
+        checkComponent(node.body);
+      },
+      VariableDeclarator(node: EsTreeNodeOfType<"VariableDeclarator">) {
+        if (!isComponentAssignment(node)) return;
+        if (
+          !isNodeOfType(node.init, "ArrowFunctionExpression") &&
+          !isNodeOfType(node.init, "FunctionExpression")
+        ) {
+          return;
+        }
+        checkComponent(node.init.body);
+      },
+    };
+  },
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-stale-closure-capture.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-stale-closure-capture.test.ts
new file mode 100644
index 000000000..c81dbec11
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-stale-closure-capture.test.ts
@@ -0,0 +1,107 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runRule } from "../../../test-utils/run-rule.js";
+import { noStaleClosureCapture } from "./no-stale-closure-capture.js";
+
+const run = (code: string) => runRule(noStaleClosureCapture, code, { filename: "fixture.tsx" });
+
+describe("no-stale-closure-capture", () => {
+  it("flags a useCallback capturing a let reassigned later in render", () => {
+    const result = run(`
+      function Component() {
+        let count = 0;
+        const handler = useCallback(() => console.log(count), []);
+        count = 1;
+        return handler;
+      }
+    `);
+    expect(result.parseErrors).toEqual([]);
+    expect(result.diagnostics).toHaveLength(1);
+    expect(result.diagnostics[0].nodeType).toBe("Identifier");
+  });
+
+  it("flags a useMemo whose memoised callback captures a let reassigned later", () => {
+    const result = run(`
+      function Component() {
+        let value = props.value;
+        const events = useMemo(() => ({ onSave: () => save(value) }), []);
+        value = transform(value);
+        return events;
+      }
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+  });
+
+  it("does NOT flag a useEffect capture (effects run after render, final value is intended)", () => {
+    const result = run(`
+      function Component() {
+        let bounds;
+        useEffect(() => {
+          report(bounds);
+        }, []);
+        bounds = compute();
+        return null;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a const capture (cannot be reassigned)", () => {
+    const result = run(`
+      function Component() {
+        const count = 0;
+        const handler = useCallback(() => console.log(count), []);
+        return handler;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a let that is never reassigned after capture", () => {
+    const result = run(`
+      function Component() {
+        let count = 0;
+        const handler = useCallback(() => console.log(count), []);
+        return handler;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a reassignment that happens BEFORE the capture", () => {
+    const result = run(`
+      function Component() {
+        let count = 0;
+        count = 1;
+        const handler = useCallback(() => console.log(count), []);
+        return handler;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a non-hook call", () => {
+    const result = run(`
+      function Component() {
+        let count = 0;
+        const handler = wrap(() => console.log(count));
+        count = 1;
+        return handler;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a variable local to the closure", () => {
+    const result = run(`
+      function Component() {
+        const handler = useCallback(() => {
+          let local = 0;
+          local = 1;
+          return local;
+        }, []);
+        return handler;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-stale-closure-capture.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-stale-closure-capture.ts
new file mode 100644
index 000000000..0d0bbb93f
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-stale-closure-capture.ts
@@ -0,0 +1,69 @@
+import { MEMOIZING_HOOK_NAMES } from "../../constants/react.js";
+import { defineRule } from "../../utils/define-rule.js";
+import type { EsTreeNode } from "../../utils/es-tree-node.js";
+import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
+import { isFunctionLike } from "../../utils/is-function-like.js";
+import { isHookCall } from "../../utils/is-hook-call.js";
+import { isNodeOfType } from "../../utils/is-node-of-type.js";
+import type { RuleContext } from "../../utils/rule-context.js";
+import { closureCaptures } from "../../semantic/closure-captures.js";
+
+// The closure passed to `useMemo`/`useCallback` captures a reassignable
+// binding from the surrounding render that is REASSIGNED after the hook is
+// created. Because a JS closure closes over the variable, not the value, the
+// memoised value/function observes the post-render mutation — a stale-value
+// bug, since the deps array signals the author intended the binding's value
+// at creation time. Verified with SSA: a write of the captured binding must
+// be reachable from the hook call and reach the render's exit
+// (`ssa.isRedefinedBetween`). Defers for `const` and for bindings that are
+// never reassigned (no write in range → no report).
+//
+// Deliberately excludes the deferred effect hooks (`useEffect` /
+// `useLayoutEffect`): their callbacks run AFTER the synchronous render
+// completes, so reading the FINAL value of a render `let` assigned later in
+// the body is the intended pattern (`let bounds; useEffect(() => use(bounds));
+// bounds = compute()`), not a stale capture.
+const lastStatementOf = (functionNode: EsTreeNode): EsTreeNode | null => {
+  if (!isFunctionLike(functionNode)) return null;
+  const body = functionNode.body as EsTreeNode;
+  if (!isNodeOfType(body, "BlockStatement")) return null;
+  const statements = body.body;
+  return (statements[statements.length - 1] as EsTreeNode | undefined) ?? null;
+};
+
+export const noStaleClosureCapture = defineRule({
+  id: "no-stale-closure-capture",
+  title: "Closure captures a value reassigned later in render",
+  severity: "warn",
+  recommendation:
+    "Don't reassign a variable after a hook closure captures it, because the closure runs later and sees the mutated value, not the one at creation. Compute the value before the hook, or pass it through the dependency array or a ref.",
+  create: (context: RuleContext) => ({
+    CallExpression(node: EsTreeNodeOfType<"CallExpression">) {
+      if (!isHookCall(node, MEMOIZING_HOOK_NAMES)) return;
+      const closure = node.arguments[0] as EsTreeNode | undefined;
+      if (!closure || !isFunctionLike(closure)) return;
+
+      const renderFunction = context.cfg.enclosingFunction(node);
+      if (!renderFunction) return;
+      const renderExit = lastStatementOf(renderFunction);
+      if (!renderExit) return;
+
+      const reportedBindings = new Set<number>();
+      for (const reference of closureCaptures(closure, context.scopes)) {
+        const symbol = reference.resolvedSymbol;
+        if (!symbol || (symbol.kind !== "let" && symbol.kind !== "var")) continue;
+        if (reportedBindings.has(symbol.id)) continue;
+
+        const binding = context.ssa.bindingOf(reference.identifier);
+        if (binding === null) continue;
+        if (!context.ssa.isRedefinedBetween(node, renderExit, binding)) continue;
+
+        reportedBindings.add(symbol.id);
+        context.report({
+          node: reference.identifier,
+          message: `"${symbol.name}" is captured by this hook closure but reassigned later in render. The closure runs later and will read the updated value, not the one captured here.`,
+        });
+      }
+    },
+  }),
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-unreleased-resource.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-unreleased-resource.test.ts
new file mode 100644
index 000000000..c18bc5fa2
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-unreleased-resource.test.ts
@@ -0,0 +1,216 @@
+import { describe, expect, it } from "vite-plus/test";
+import { runRule } from "../../../test-utils/run-rule.js";
+import { noUnreleasedResource } from "./no-unreleased-resource.js";
+
+const run = (code: string) => runRule(noUnreleasedResource, code, { filename: "fixture.tsx" });
+
+describe("no-unreleased-resource", () => {
+  it("flags a timer cleared inline on some paths but leaked on an early return", () => {
+    const result = run(`
+      function Component(flag) {
+        useEffect(() => {
+          const id = setInterval(tick, 1000);
+          if (flag) {
+            return;
+          }
+          clearInterval(id);
+        }, []);
+        return null;
+      }
+    `);
+    expect(result.parseErrors).toEqual([]);
+    expect(result.diagnostics).toHaveLength(1);
+  });
+
+  it("flags an AbortController aborted on some paths but not all in useLayoutEffect", () => {
+    const result = run(`
+      function Component(flag) {
+        useLayoutEffect(() => {
+          const controller = new AbortController();
+          if (flag) {
+            return;
+          }
+          controller.abort();
+        }, []);
+        return null;
+      }
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+  });
+
+  it("flags an event listener removed on some paths but not all", () => {
+    const result = run(`
+      function Component(flag) {
+        useEffect(() => {
+          target.addEventListener("click", handler);
+          if (flag) {
+            return;
+          }
+          target.removeEventListener("click", handler);
+        }, []);
+        return null;
+      }
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+  });
+
+  it("flags inside a React.useEffect member call", () => {
+    const result = run(`
+      function Component(flag) {
+        React.useEffect(() => {
+          const id = setInterval(tick, 1000);
+          if (flag) {
+            return;
+          }
+          clearInterval(id);
+        }, []);
+        return null;
+      }
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+  });
+
+  it("flags inside a useInsertionEffect callback", () => {
+    const result = run(`
+      function Component(flag) {
+        useInsertionEffect(() => {
+          const id = setInterval(tick, 1000);
+          if (flag) {
+            return;
+          }
+          clearInterval(id);
+        }, []);
+        return null;
+      }
+    `);
+    expect(result.diagnostics).toHaveLength(1);
+  });
+
+  it("does NOT flag a resource released on every path", () => {
+    const result = run(`
+      function Component(flag) {
+        useEffect(() => {
+          const id = setInterval(tick, 1000);
+          if (flag) {
+            clearInterval(id);
+            return;
+          }
+          clearInterval(id);
+        }, []);
+        return null;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a resource released via try/finally", () => {
+    const result = run(`
+      function Component(flag) {
+        useEffect(() => {
+          const id = setInterval(tick, 1000);
+          try {
+            if (flag) {
+              return;
+            }
+          } finally {
+            clearInterval(id);
+          }
+        }, []);
+        return null;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a resource that is never released (no intent to clean up)", () => {
+    const result = run(`
+      function Component() {
+        useEffect(() => {
+          const id = setInterval(tick, 1000);
+          return id;
+        }, []);
+        return null;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a conditional add with a returned cleanup (remove on unmount)", () => {
+    const result = run(`
+      function Component({ show }) {
+        useEffect(() => {
+          if (show) {
+            document.addEventListener('mousedown', handleClickOutside);
+          } else {
+            document.removeEventListener('mousedown', handleClickOutside);
+          }
+          return () => {
+            document.removeEventListener('mousedown', handleClickOutside);
+          };
+        }, [show]);
+        return null;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag the remove-then-add idiom guarded by a returned cleanup", () => {
+    const result = run(`
+      function Component({ blobUrl }) {
+        useEffect(() => {
+          audioRef.current.removeEventListener('ended', handleEnded);
+          audioRef.current.addEventListener('ended', handleEnded);
+          return () => {
+            audioRef.current.removeEventListener('ended', handleEnded);
+          };
+        }, [blobUrl]);
+        return null;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a class lifecycle method that releases in a sibling method", () => {
+    const result = run(`
+      class Manager {
+        attach(flag) {
+          target.addEventListener("click", this.handler);
+          if (flag) {
+            return;
+          }
+          target.removeEventListener("click", this.handler);
+        }
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a non-React framework effect (Solid createEffect)", () => {
+    const result = run(`
+      function Component(flag) {
+        createEffect(() => {
+          const id = setInterval(tick, 1000);
+          if (flag) {
+            return;
+          }
+          clearInterval(id);
+        });
+        return null;
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+
+  it("does NOT flag a plain helper function outside any effect", () => {
+    const result = run(`
+      function start(flag) {
+        const id = setInterval(tick, 1000);
+        if (flag) {
+          return;
+        }
+        clearInterval(id);
+      }
+    `);
+    expect(result.diagnostics).toEqual([]);
+  });
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-unreleased-resource.ts b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-unreleased-resource.ts
new file mode 100644
index 000000000..db71808a0
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/rules/state-and-effects/no-unreleased-resource.ts
@@ -0,0 +1,281 @@
+import {
+  TIMER_CALLEE_NAMES_REQUIRING_CLEANUP,
+  TIMER_CLEANUP_CALLEE_NAMES,
+} from "../../constants/dom.js";
+import {
+  BOUND_RESOURCE_RELEASE_METHOD_NAMES,
+  EFFECT_HOOK_NAMES,
+  GLOBAL_RELEASE_METHOD_NAMES,
+  SUBSCRIPTION_METHOD_NAMES,
+} from "../../constants/react.js";
+import { defineRule } from "../../utils/define-rule.js";
+import type { EsTreeNode } from "../../utils/es-tree-node.js";
+import type { EsTreeNodeOfType } from "../../utils/es-tree-node-of-type.js";
+import { isFunctionLike } from "../../utils/is-function-like.js";
+import { isHookCall } from "../../utils/is-hook-call.js";
+import { isNodeOfType } from "../../utils/is-node-of-type.js";
+import type { RuleContext } from "../../utils/rule-context.js";
+import { walkAst } from "../../utils/walk-ast.js";
+import type { ResourceEvent, TypestateAutomaton } from "@react-doctor/cfg";
+
+// A pure leak detector: a resource acquired in this function can rest in the
+// `opened` state on a normal-completion path. No error states — only the
+// leak matters — so it never accuses legal protocol use.
+const RESOURCE_AUTOMATON: TypestateAutomaton = {
+  initial: "initial",
+  transition: (state, event) => {
+    if (event === "open") return "opened";
+    if (event === "close") return state === "opened" ? "closed" : state;
+    return state;
+  },
+  errorStates: new Set(),
+  acceptingStates: new Set(["initial", "closed"]),
+};
+
+// Member-call release methods that pair with a variable-bound open
+// (`sub.unsubscribe()`, `controller.abort()`). The DOM listener pair is
+// handled separately, keyed structurally, so its methods are excluded here.
+const RECEIVER_RELEASE_METHODS = new Set(
+  [...GLOBAL_RELEASE_METHOD_NAMES, ...BOUND_RESOURCE_RELEASE_METHOD_NAMES].filter(
+    (name) => name !== "removeEventListener" && name !== "removeListener",
+  ),
+);
+// Subscribe-shaped open methods, minus the DOM listener registrars.
+const SUBSCRIBE_OPEN_METHODS = new Set(
+  [...SUBSCRIPTION_METHOD_NAMES].filter(
+    (name) => name !== "addEventListener" && name !== "addListener",
+  ),
+);
+const LISTENER_ADD_METHODS = new Set(["addEventListener", "addListener"]);
+const LISTENER_REMOVE_METHODS = new Set(["removeEventListener", "removeListener"]);
+
+const memberPropertyName = (node: EsTreeNode): string | null => {
+  if (!isNodeOfType(node, "MemberExpression")) return null;
+  if (node.computed || !isNodeOfType(node.property, "Identifier")) return null;
+  return node.property.name;
+};
+
+// The variable a resource-producing call is stored into — the resource's
+// identity. Only a direct `const x = …` / `x = …` gives a trackable name.
+const assignedVariableName = (node: EsTreeNode): string | null => {
+  const parent = node.parent;
+  if (!parent) return null;
+  if (isNodeOfType(parent, "VariableDeclarator") && isNodeOfType(parent.id, "Identifier")) {
+    return parent.id.name;
+  }
+  if (
+    isNodeOfType(parent, "AssignmentExpression") &&
+    parent.operator === "=" &&
+    isNodeOfType(parent.left, "Identifier")
+  ) {
+    return parent.left.name;
+  }
+  return null;
+};
+
+// A stable structural key for a listener registration's (target, type,
+// handler) triple, so `addEventListener`/`removeEventListener` on the same
+// arguments pair up. Null when any operand is too complex to key reliably
+// (so the listener is simply not tracked — no false leak).
+const expressionKey = (node: EsTreeNode | undefined): string | null => {
+  if (!node) return null;
+  if (isNodeOfType(node, "Identifier")) return `i:${node.name}`;
+  if (isNodeOfType(node, "ThisExpression")) return "this";
+  if (isNodeOfType(node, "Literal")) return `l:${String(node.value)}`;
+  if (isNodeOfType(node, "MemberExpression") && !node.computed) {
+    const object = expressionKey(node.object as EsTreeNode);
+    const property = memberPropertyName(node);
+    return object && property ? `${object}.${property}` : null;
+  }
+  return null;
+};
+
+const listenerKey = (
+  callee: EsTreeNodeOfType<"MemberExpression">,
+  call: EsTreeNodeOfType<"CallExpression">,
+): string | null => {
+  const target = expressionKey(callee.object as EsTreeNode);
+  const type = expressionKey(call.arguments[0] as EsTreeNode | undefined);
+  const handler = expressionKey(call.arguments[1] as EsTreeNode | undefined);
+  return target && type && handler ? `evt:${target}|${type}|${handler}` : null;
+};
+
+// Classify a single call / new expression as a resource open or close, or
+// null when it is neither.
+const classifyCall = (node: EsTreeNode): ResourceEvent | null => {
+  if (isNodeOfType(node, "NewExpression")) {
+    if (isNodeOfType(node.callee, "Identifier") && node.callee.name === "AbortController") {
+      const name = assignedVariableName(node);
+      return name ? { resource: `var:${name}`, event: "open", node } : null;
+    }
+    return null;
+  }
+  if (!isNodeOfType(node, "CallExpression")) return null;
+
+  if (isNodeOfType(node.callee, "Identifier")) {
+    if (TIMER_CALLEE_NAMES_REQUIRING_CLEANUP.has(node.callee.name)) {
+      const name = assignedVariableName(node);
+      return name ? { resource: `var:${name}`, event: "open", node } : null;
+    }
+    if (TIMER_CLEANUP_CALLEE_NAMES.has(node.callee.name)) {
+      const argument = node.arguments[0] as EsTreeNode | undefined;
+      if (argument && isNodeOfType(argument, "Identifier")) {
+        return { resource: `var:${argument.name}`, event: "close", node };
+      }
+    }
+    return null;
+  }
+
+  const method = memberPropertyName(node.callee);
+  if (!method || !isNodeOfType(node.callee, "MemberExpression")) return null;
+
+  if (LISTENER_ADD_METHODS.has(method)) {
+    const key = listenerKey(node.callee, node);
+    return key ? { resource: key, event: "open", node } : null;
+  }
+  if (LISTENER_REMOVE_METHODS.has(method)) {
+    const key = listenerKey(node.callee, node);
+    return key ? { resource: key, event: "close", node } : null;
+  }
+  if (SUBSCRIBE_OPEN_METHODS.has(method)) {
+    const name = assignedVariableName(node);
+    return name ? { resource: `var:${name}`, event: "open", node } : null;
+  }
+  if (RECEIVER_RELEASE_METHODS.has(method) && isNodeOfType(node.callee.object, "Identifier")) {
+    return { resource: `var:${node.callee.object.name}`, event: "close", node };
+  }
+  return null;
+};
+
+// All resource events inside a subtree, stopping at nested function
+// boundaries (each function owns its own CFG / resource scope).
+const collectEventsIn = (root: EsTreeNode): ResourceEvent[] => {
+  const events: ResourceEvent[] = [];
+  walkAst(root, (node) => {
+    if (node !== root && isFunctionLike(node)) return false;
+    const event = classifyCall(node);
+    if (event) events.push(event);
+  });
+  return events;
+};
+
+// True when `node` sits inside a `try`'s `finally` block. The CFG models
+// try/finally coarsely (a `return` in `try` routes straight to the exit
+// rather than through the finalizer), so a finally-based release would look
+// like a leak. But `finally` runs on every path by language semantics, so a
+// resource released there is never actually leaked.
+const isInFinallyBlock = (node: EsTreeNode): boolean => {
+  let child: EsTreeNode = node;
+  let current: EsTreeNode | null | undefined = node.parent;
+  while (current) {
+    if (isNodeOfType(current, "TryStatement") && current.finalizer === child) return true;
+    child = current;
+    current = current.parent ?? null;
+  }
+  return false;
+};
+
+const isNullishReturnArgument = (argument: EsTreeNode): boolean => {
+  if (isNodeOfType(argument, "Identifier")) return argument.name === "undefined";
+  if (isNodeOfType(argument, "Literal")) return argument.value === null;
+  return false;
+};
+
+// True when the effect hands React a cleanup on some path — a `return
+// <non-nullish>` at the top level of the callback (not inside a nested
+// function). That unmount / re-run release contract is owned by
+// `effect-cleanup-not-on-every-path`; its release sits in a nested closure
+// this rule cannot see, so any inline acquire/release alongside it is a
+// defensive remove-then-add idiom, not a leak. Deferring here is what keeps
+// the two rules from double-reporting.
+const effectReturnsCleanup = (root: EsTreeNode): boolean => {
+  let returnsCleanup = false;
+  walkAst(root, (node) => {
+    if (returnsCleanup || (node !== root && isFunctionLike(node))) return false;
+    if (
+      isNodeOfType(node, "ReturnStatement") &&
+      node.argument &&
+      !isNullishReturnArgument(node.argument as EsTreeNode)
+    ) {
+      returnsCleanup = true;
+      return false;
+    }
+  });
+  return returnsCleanup;
+};
+
+// React effect hooks whose callback bodies own inline resource cleanup.
+// Covers `useInsertionEffect` on top of the shared effect set, and the
+// namespaced `React.useEffect` / `React.useLayoutEffect` forms resolve through
+// `isHookCall` → `getCalleeName`'s member-expression handling.
+const EFFECT_CALLBACK_HOOK_NAMES = new Set<string>([...EFFECT_HOOK_NAMES, "useInsertionEffect"]);
+
+const isEffectCallback = (functionNode: EsTreeNode): boolean => {
+  const parent = functionNode.parent;
+  return Boolean(
+    parent &&
+    isHookCall(parent, EFFECT_CALLBACK_HOOK_NAMES) &&
+    isNodeOfType(parent, "CallExpression") &&
+    parent.arguments[0] === functionNode,
+  );
+};
+
+export const noUnreleasedResource = defineRule({
+  id: "no-unreleased-resource",
+  title: "Effect resource released inline on some paths but leaked on others",
+  severity: "warn",
+  tags: ["test-noise"],
+  recommendation:
+    "Release the resource on every path inside the effect. A timer, subscription, AbortController, or event listener you clear inline on some branches but skip on an early return leaks on that path. Move the early return before the acquisition, or return a cleanup function instead.",
+  create: (context: RuleContext) => {
+    // Scope: React effect callbacks only. The general open/close leak signal
+    // is too noisy outside effects — class lifecycle methods release in a
+    // sibling `dispose()` and non-React frameworks use their own cleanup
+    // registration (Solid's `onCleanup`), neither visible to a single CFG.
+    // Within an effect this catches an INLINE acquire/release pair bypassed by
+    // an early return. The returned-cleanup contract is owned by
+    // `effect-cleanup-not-on-every-path`, so when the effect returns a cleanup
+    // we defer entirely — its release lives in a nested closure this rule
+    // can't see, so an inline acquire/release alongside it (the defensive
+    // remove-then-add idiom) is not a leak.
+    const checkEffectCallback = (node: EsTreeNode): void => {
+      if (!isEffectCallback(node)) return;
+      if (effectReturnsCleanup(node)) return;
+
+      const events = collectEventsIn(node);
+      const closedResources = new Set<string>();
+      const finallyClosedResources = new Set<string>();
+      for (const event of events) {
+        if (event.event !== "close") continue;
+        closedResources.add(event.resource);
+        if (isInFinallyBlock(event.node)) finallyClosedResources.add(event.resource);
+      }
+      // Only flag a PARTIAL leak — a resource the author closes somewhere,
+      // proving intent, but misses on a path. A resource never closed at all
+      // is a different (and noisier) signal we deliberately leave alone.
+      if (closedResources.size === 0) return;
+
+      const violations = context.typestate.verify(node, {
+        automaton: RESOURCE_AUTOMATON,
+        classifier: collectEventsIn,
+      });
+
+      for (const violation of violations) {
+        if (violation.kind !== "leaked-resource") continue;
+        if (!closedResources.has(violation.resource)) continue;
+        // A finally-released resource runs on every path — never leaked.
+        if (finallyClosedResources.has(violation.resource)) continue;
+        context.report({
+          node: violation.node,
+          message:
+            "This effect resource is released inline on some paths but not all, so an early return leaks it. Release it on every path, or return a cleanup function.",
+        });
+      }
+    };
+
+    return {
+      FunctionExpression: checkEffectCallback,
+      ArrowFunctionExpression: checkEffectCallback,
+    };
+  },
+});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/semantic/control-flow-graph.oxc-unreachable.test.ts b/packages/oxlint-plugin-react-doctor/src/plugin/semantic/control-flow-graph.oxc-unreachable.test.ts
deleted file mode 100644
index e0d6ce3e1..000000000
--- a/packages/oxlint-plugin-react-doctor/src/plugin/semantic/control-flow-graph.oxc-unreachable.test.ts
+++ /dev/null
@@ -1,107 +0,0 @@
-import { describe, expect, it } from "vite-plus/test";
-import { analyzeControlFlow } from "./control-flow-graph.js";
-import { attachParentReferences } from "../../test-utils/attach-parent-references.js";
-import { parseFixture } from "../../test-utils/parse-fixture.js";
-import type { EsTreeNode } from "../utils/es-tree-node.js";
-
-// Control-flow fixtures ported from oxc's `eslint/no-unreachable` test
-// suite (crates/oxc_linter/src/rules/eslint/no_unreachable.rs). oxc
-// asserts these via the rule; here they exercise `cfg.isUnreachable`
-// directly. Every case shares a `x = 2` marker statement so the
-// assertion is uniform: in oxc's FAIL cases that statement is
-// unreachable, in its PASS cases it is reachable.
-//
-// Cases where our CFG deliberately diverges from oxc are omitted with a
-// note: `var`/function-declaration hoisting (a rule policy, not a CFG
-// fact). try/catch/finally normal-completion is now modeled via
-// Finalize/Join edges and is covered in control-flow-graph.try-finally.test.ts.
-
-const analyze = (code: string) => {
-  const parsed = parseFixture(code);
-  attachParentReferences(parsed.program);
-  return { ...analyzeControlFlow(parsed.program), program: parsed.program, errors: parsed.errors };
-};
-
-// Find the `x = 2` assignment-expression node shared by every fixture.
-const findMarker = (root: EsTreeNode): EsTreeNode | null => {
-  let found: EsTreeNode | null = null;
-  const visit = (node: EsTreeNode): void => {
-    if (found) return;
-    if (
-      node.type === "AssignmentExpression" &&
-      (node as { left: EsTreeNode }).left.type === "Identifier" &&
-      (node as { left: { name: string } }).left.name === "x" &&
-      (node as { right: EsTreeNode }).right.type === "Literal" &&
-      (node as { right: { value: unknown } }).right.value === 2
-    ) {
-      found = node;
-      return;
-    }
-    const record = node as unknown as Record<string, unknown>;
-    for (const key of Object.keys(record)) {
-      if (key === "parent") continue;
-      const child = record[key];
-      if (Array.isArray(child)) {
-        for (const item of child) {
-          if (item && typeof item === "object" && "type" in item) visit(item as EsTreeNode);
-        }
-      } else if (child && typeof child === "object" && "type" in (child as object)) {
-        visit(child as EsTreeNode);
-      }
-    }
-  };
-  visit(root);
-  return found;
-};
-
-// oxc FAIL cases: the `x = 2` marker is unreachable.
-const UNREACHABLE_FIXTURES: ReadonlyArray<string> = [
-  "function foo() { var x = 1; if (x) { return; } else { throw e; } x = 2; }",
-  "function foo() { var x = 1; if (x) return; else throw -1; x = 2; }",
-  "function foo() { var x = 1; try { return; } finally {} x = 2; }",
-  "function foo() { var x = 1; try { } finally { return; } x = 2; }",
-  "function foo() { var x = 1; do { return; } while (x); x = 2; }",
-  "function foo() { var x = 1; for (;;) { if (x) continue; } x = 2; }",
-  // The infinite-loop cases are why we port oxc's loop handling — with
-  // no `break`, code after the loop is unreachable:
-  "function foo() { var x = 1; while (true) { } x = 2; }",
-  "function foo() { var x = 1; do { } while (true); x = 2; }",
-];
-
-// oxc PASS cases: the `x = 2` marker is reachable.
-const REACHABLE_FIXTURES: ReadonlyArray<string> = [
-  "function foo() { var x = 1; if (x) { return; } x = 2; }",
-  "function foo() { var x = 1; if (x) { } else { return; } x = 2; }",
-  "function foo() { var x = 1; switch (x) { case 0: break; default: return; } x = 2; }",
-  "function foo() { var x = 1; while (x) { return; } x = 2; }",
-  "function foo() { var x = 1; for (x in {}) { return; } x = 2; }",
-  // Infinite loop, but an explicit `break` lets control reach the marker.
-  "function foo() { var x = 1; for (;;) { if (x) break; } x = 2; }",
-  "function foo() { var x = 1; for (;x == 1;) { if (x) continue; } x = 2; }",
-];
-
-describe("control-flow-graph: oxc no-unreachable fixtures", () => {
-  describe("unreachable marker (oxc FAIL cases)", () => {
-    for (const fixture of UNREACHABLE_FIXTURES) {
-      it(fixture, () => {
-        const analysis = analyze(fixture);
-        expect(analysis.errors).toEqual([]);
-        const marker = findMarker(analysis.program);
-        expect(marker).not.toBeNull();
-        expect(analysis.isUnreachable(marker!)).toBe(true);
-      });
-    }
-  });
-
-  describe("reachable marker (oxc PASS cases)", () => {
-    for (const fixture of REACHABLE_FIXTURES) {
-      it(fixture, () => {
-        const analysis = analyze(fixture);
-        expect(analysis.errors).toEqual([]);
-        const marker = findMarker(analysis.program);
-        expect(marker).not.toBeNull();
-        expect(analysis.isUnreachable(marker!)).toBe(false);
-      });
-    }
-  });
-});
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/semantic/control-flow-graph.ts b/packages/oxlint-plugin-react-doctor/src/plugin/semantic/control-flow-graph.ts
deleted file mode 100644
index 0ecca6f49..000000000
--- a/packages/oxlint-plugin-react-doctor/src/plugin/semantic/control-flow-graph.ts
+++ /dev/null
@@ -1,1163 +0,0 @@
-import type { EsTreeNode } from "../utils/es-tree-node.js";
-import { isAstNode } from "../utils/is-ast-node.js";
-import { isFunctionLike } from "../utils/is-function-like.js";
-import { isNodeOfType } from "../utils/is-node-of-type.js";
-
-// Per-function CFG. Mirrors the subset of `oxc_cfg` we need to answer:
-// "Is this AST node guaranteed to execute on every call to its
-// enclosing function?" (isUnconditionalFromEntry — used by rules-of-hooks)
-//
-// Edge kinds, mapped from oxc_cfg's richer `EdgeType` taxonomy to the
-// distinctions our analyses actually consume:
-//   uncond   — sequential fall-through (oxc `Normal`)
-//   cond     — a conditional branch: true / false / loop-enter / case
-//              (oxc `Jump` + the `Normal` else-arm; we don't split them
-//              because reachability/dominance weight every edge equally)
-//   backedge — a loop's back-edge to its header (oxc `Backedge`); the
-//              sole creator of cycles, so loop detection keys off it
-//   throw    — an exception path to a catch/finally or the function exit
-//              (oxc `Error`); excluded from "normal completion" reachability
-//   finalize — entry into a `finally` block, taken on every path through
-//              the protected region — even a `return`/`throw` in `try`
-//              (oxc `Finalize`). An abrupt completion can't sever it, so
-//              the `finally` body stays reachable.
-//   join     — the normal continuation after a `finally` completes, added
-//              only when the protected region can itself complete normally
-//              (oxc `Join`). Its absence is what makes code after
-//              `try { return } finally { … }` unreachable.
-// oxc's `NewFunction` edge is absent by construction: every function gets
-// its own CFG here, so reachability never crosses a function boundary.
-//
-// Coverage vs. the React Compiler's HIR terminal taxonomy (the canonical
-// JS-side CFG, `BuildHIR.ts`). The compiler's terminals are: goto, if,
-// branch, switch, logical, ternary, optional, return, throw, do-while,
-// while, for, for-of, for-in, label, sequence, maybe-throw, try. We model
-// every one as basic blocks + the edges above:
-//   - Statement terminals (if / switch / loops / label / return / throw /
-//     try) → `buildStatement`.
-//   - Expression terminals — `ternary`, `logical` (`&&`/`||`/`??` and the
-//     `&&=`/`||=`/`??=` assignments), and `optional` (optional chaining) —
-//     → `buildExpression` / `buildOptionalChainLink`. Lowering these is what
-//     lets a hook / setState / effect nested in a short-circuit read as
-//     conditional, exactly like the compiler's value blocks. `sequence`
-//     (comma / value-block sequencing) needs no dedicated terminal here:
-//     the generic left-to-right child threading already orders it.
-//   - `maybe-throw` (an implicit edge to the nearest handler after EVERY
-//     throwable instruction) is modeled coarsely: a single `cond` edge from
-//     the try ENTRY to the catch. That already makes every later try-body
-//     block skippable via the catch bypass, so the primitives our rules
-//     consume (`isUnconditionalFromEntry`, post-dominance) get the same
-//     answer a per-instruction model would give. The only thing the coarse
-//     model loses is `isReachable(midTryStatement, catchStatement)`, which
-//     no rule needs — so per-instruction maybe-throw is a deliberate
-//     non-goal, not a gap.
-export type CfgEdgeKind = "uncond" | "cond" | "throw" | "backedge" | "finalize" | "join";
-
-export interface CfgEdge {
-  readonly from: BasicBlock;
-  readonly to: BasicBlock;
-  readonly kind: CfgEdgeKind;
-}
-
-export interface BasicBlock {
-  readonly id: number;
-  readonly nodes: EsTreeNode[];
-  readonly successors: CfgEdge[];
-  readonly predecessors: CfgEdge[];
-}
-
-export interface FunctionCfg {
-  readonly owner: EsTreeNode;
-  readonly entry: BasicBlock;
-  readonly exit: BasicBlock;
-  readonly blocks: BasicBlock[];
-  readonly blockOf: (node: EsTreeNode) => BasicBlock | null;
-}
-
-export interface ControlFlowAnalysis {
-  readonly cfgFor: (functionLike: EsTreeNode) => FunctionCfg | null;
-  readonly enclosingFunction: (node: EsTreeNode) => EsTreeNode | null;
-  // On every path from the enclosing function's entry to its exit.
-  readonly isUnconditionalFromEntry: (node: EsTreeNode) => boolean;
-  // Some control-flow path lets execution flow from `fromNode` to
-  // `toNode` within the same enclosing function. Cross-function pairs
-  // are never reachable.
-  readonly isReachable: (fromNode: EsTreeNode, toNode: EsTreeNode) => boolean;
-  // `aNode` executes on EVERY path that reaches `bNode` (graph
-  // dominance). A guard that dominates a sink runs before it on every
-  // path.
-  readonly dominates: (aNode: EsTreeNode, bNode: EsTreeNode) => boolean;
-  // `bNode` executes on EVERY path from `aNode` to the function exit
-  // (graph post-dominance). A cleanup that post-dominates a
-  // subscription always runs after it.
-  readonly postDominates: (bNode: EsTreeNode, aNode: EsTreeNode) => boolean;
-  // The node's basic block is part of a cycle in ITS OWN function's CFG
-  // — i.e. it executes once per iteration of an enclosing loop. A node
-  // inside a callback that merely escapes a loop is NOT inside the loop
-  // (the callback is a separate function with its own acyclic CFG).
-  readonly isInsideLoop: (node: EsTreeNode) => boolean;
-  // The node's block is not reachable from the function entry (dead
-  // code after an unconditional return / throw / break).
-  readonly isUnreachable: (node: EsTreeNode) => boolean;
-}
-
-interface CfgBuilder {
-  blocks: BasicBlock[];
-  entry: BasicBlock;
-  exit: BasicBlock;
-  // Map every AST node visited inside this function to the block it
-  // was appended to.
-  nodeBlock: Map<EsTreeNode, BasicBlock>;
-  // Stack of "loop-merge" / "loop-header" pairs for break/continue.
-  loopStack: Array<{ header: BasicBlock; merge: BasicBlock; label: string | null }>;
-  // Stack of "switch-merge" + label, for break in switches.
-  switchStack: Array<{ merge: BasicBlock; label: string | null }>;
-  // Stack of try-catch contexts: where to route ThrowStatement to.
-  tryStack: Array<{ catch: BasicBlock | null; finally: BasicBlock | null }>;
-  // Labels currently in scope: maps label name → loop/switch entry.
-  labelStack: Array<{ label: string; merge: BasicBlock; header: BasicBlock | null }>;
-}
-
-let nextBlockId = 0;
-
-const createBlock = (builder: CfgBuilder): BasicBlock => {
-  const block: BasicBlock = {
-    id: nextBlockId++,
-    nodes: [],
-    successors: [],
-    predecessors: [],
-  };
-  builder.blocks.push(block);
-  return block;
-};
-
-const addEdge = (from: BasicBlock, to: BasicBlock, kind: CfgEdgeKind): void => {
-  const edge: CfgEdge = { from, to, kind };
-  from.successors.push(edge);
-  to.predecessors.push(edge);
-};
-
-const appendNode = (builder: CfgBuilder, block: BasicBlock, node: EsTreeNode): void => {
-  block.nodes.push(node);
-  if (!builder.nodeBlock.has(node)) {
-    builder.nodeBlock.set(node, block);
-  }
-  // Walk all descendants attaching them to the same block UNLESS they
-  // would open a control-flow construct (those will get their own
-  // block treatment when buildStatement reaches them).
-  // We rely on the structured walker — appendNode only handles the
-  // node itself; the recursive descent happens inside buildStatement.
-};
-
-// Recursively map every descendant of `node` to `block`, EXCEPT when
-// crossing a function boundary (inner functions get their own CFG).
-const mapDescendantsToBlock = (builder: CfgBuilder, node: EsTreeNode, block: BasicBlock): void => {
-  builder.nodeBlock.set(node, block);
-  if (isFunctionLike(node)) return;
-  const record = node as unknown as Record<string, unknown>;
-  for (const key of Object.keys(record)) {
-    if (key === "parent") continue;
-    const child = record[key];
-    if (Array.isArray(child)) {
-      for (const item of child) if (isAstNode(item)) mapDescendantsToBlock(builder, item, block);
-    } else if (isAstNode(child)) {
-      mapDescendantsToBlock(builder, child, block);
-    }
-  }
-};
-
-// Returns true if the node introduces internal control flow we want to
-// expand into the CFG (rather than treat as a single statement).
-const hasInternalControlFlow = (node: EsTreeNode): boolean => {
-  switch (node.type) {
-    case "IfStatement":
-    case "WhileStatement":
-    case "DoWhileStatement":
-    case "ForStatement":
-    case "ForInStatement":
-    case "ForOfStatement":
-    case "SwitchStatement":
-    case "TryStatement":
-    case "ReturnStatement":
-    case "ThrowStatement":
-    case "BreakStatement":
-    case "ContinueStatement":
-    case "BlockStatement":
-    case "LabeledStatement":
-      return true;
-    default:
-      return false;
-  }
-};
-
-const findLabel = (
-  builder: CfgBuilder,
-  name: string | null,
-): { merge: BasicBlock; header: BasicBlock | null } | null => {
-  if (name === null) {
-    // Unlabeled break/continue → innermost loop or switch.
-    if (builder.loopStack.length > 0) {
-      const top = builder.loopStack[builder.loopStack.length - 1]!;
-      return { merge: top.merge, header: top.header };
-    }
-    if (builder.switchStack.length > 0) {
-      const top = builder.switchStack[builder.switchStack.length - 1]!;
-      return { merge: top.merge, header: null };
-    }
-    return null;
-  }
-  for (let i = builder.labelStack.length - 1; i >= 0; i--) {
-    const entry = builder.labelStack[i]!;
-    if (entry.label === name) return { merge: entry.merge, header: entry.header };
-  }
-  return null;
-};
-
-// A loop whose test is a compile-time truthy constant (`while (true)`,
-// `do … while (1)`) — or a `for (;;)` with no test at all — never exits
-// through its condition. We model that by omitting the header→merge
-// "cond" edge, so code after the loop is reachable only via an explicit
-// `break` (matching oxc's infinite-loop handling, which is what makes
-// `while (true) {} after();` flag `after()` as unreachable).
-const isAlwaysTruthyLoopTest = (test: EsTreeNode | null | undefined): boolean => {
-  if (!test) return true;
-  if (isNodeOfType(test, "Literal")) {
-    const literalValue = (test as { value?: unknown }).value;
-    if (typeof literalValue === "boolean") return literalValue;
-    if (typeof literalValue === "number") return literalValue !== 0;
-    if (typeof literalValue === "string") return literalValue.length > 0;
-    if (typeof literalValue === "bigint") return literalValue !== BigInt(0);
-  }
-  return false;
-};
-
-const LOGICAL_ASSIGNMENT_OPERATORS = new Set(["&&=", "||=", "??="]);
-
-const isLogicalAssignment = (node: EsTreeNode): boolean =>
-  isNodeOfType(node, "AssignmentExpression") &&
-  LOGICAL_ASSIGNMENT_OPERATORS.has((node as { operator: string }).operator);
-
-// True when an expression subtree contains short-circuiting control flow
-// we model as branches: a ternary, a `&&` / `||` / `??`, or a logical
-// assignment (`&&=` / `||=` / `??=`). Stops at nested function boundaries —
-// those get their own CFG. Lets `buildStatement` keep the cheap
-// `mapDescendantsToBlock` path for straight-line code and only pay the
-// block-splitting cost when an expression actually branches.
-const containsExpressionControlFlow = (node: EsTreeNode): boolean => {
-  let found = false;
-  const visit = (current: EsTreeNode): void => {
-    if (found) return;
-    if (
-      isNodeOfType(current, "ConditionalExpression") ||
-      isNodeOfType(current, "LogicalExpression") ||
-      isNodeOfType(current, "ChainExpression") ||
-      isLogicalAssignment(current)
-    ) {
-      found = true;
-      return;
-    }
-    if (isFunctionLike(current)) return;
-    const record = current as unknown as Record<string, unknown>;
-    for (const key of Object.keys(record)) {
-      if (key === "parent") continue;
-      const child = record[key];
-      if (Array.isArray(child)) {
-        for (const item of child) if (isAstNode(item)) visit(item);
-      } else if (isAstNode(child)) {
-        visit(child);
-      }
-    }
-  };
-  visit(node);
-  return found;
-};
-
-// Lower an expression's embedded control flow into the CFG — mirroring how
-// the React Compiler's HIR (and oxc_cfg) give a ternary's arms, a logical
-// operator's right operand, and a logical assignment's right operand their
-// own basic blocks. A hook / setState / effect nested in any of those is
-// then correctly seen as CONDITIONAL (short-circuited on some path), which
-// statement-level lowering alone cannot see. Returns — and maps the node to
-// — the block where its value becomes available (its join): a node's effect
-// happens AFTER its operands, so a `wrap(cond ? a : b)` call lands in the
-// post-arms block, not the pre-test one. Never descends into nested
-// functions (they get their own CFG).
-const buildExpression = (
-  builder: CfgBuilder,
-  node: EsTreeNode | null | undefined,
-  current: BasicBlock,
-): BasicBlock => {
-  if (!node) return current;
-  if (isFunctionLike(node)) {
-    builder.nodeBlock.set(node, current);
-    return current;
-  }
-
-  if (isNodeOfType(node, "ConditionalExpression")) {
-    const afterTest = buildExpression(builder, node.test as EsTreeNode, current);
-    const consequentBlock = createBlock(builder);
-    const alternateBlock = createBlock(builder);
-    const merge = createBlock(builder);
-    addEdge(afterTest, consequentBlock, "cond");
-    addEdge(afterTest, alternateBlock, "cond");
-    const consequentEnd = buildExpression(builder, node.consequent as EsTreeNode, consequentBlock);
-    const alternateEnd = buildExpression(builder, node.alternate as EsTreeNode, alternateBlock);
-    addEdge(consequentEnd, merge, "uncond");
-    addEdge(alternateEnd, merge, "uncond");
-    builder.nodeBlock.set(node, merge);
-    return merge;
-  }
-
-  if (isNodeOfType(node, "LogicalExpression") || isLogicalAssignment(node)) {
-    // The left/target operand is always evaluated; the right operand is
-    // conditional (short-circuited). From the post-left block one successor
-    // evaluates the RHS and one skips straight to the join.
-    const afterLeft = buildExpression(builder, (node as { left: EsTreeNode }).left, current);
-    const rightBlock = createBlock(builder);
-    const merge = createBlock(builder);
-    addEdge(afterLeft, rightBlock, "cond");
-    addEdge(afterLeft, merge, "cond");
-    const rightEnd = buildExpression(builder, (node as { right: EsTreeNode }).right, rightBlock);
-    addEdge(rightEnd, merge, "uncond");
-    builder.nodeBlock.set(node, merge);
-    return merge;
-  }
-
-  if (isNodeOfType(node, "ChainExpression")) {
-    // Optional chain (`a?.b.c?.()`). The React Compiler models this with a
-    // SINGLE shared short-circuit target: any nullish optional link jumps to
-    // the same continuation (value = undefined). Everything to the right of
-    // a `?.` is conditional; the chain value is available at `merge`, where
-    // the short-circuit and the fully-evaluated paths rejoin.
-    const merge = createBlock(builder);
-    const chainEnd = buildOptionalChainLink(
-      builder,
-      (node as { expression: EsTreeNode }).expression,
-      current,
-      merge,
-    );
-    addEdge(chainEnd, merge, "uncond");
-    builder.nodeBlock.set(node, merge);
-    return merge;
-  }
-
-  // Generic expression: evaluate children left-to-right, threading the
-  // block so a control-flow child splits the siblings that follow it. The
-  // node itself completes in the final cursor block.
-  let cursor = current;
-  const record = node as unknown as Record<string, unknown>;
-  for (const key of Object.keys(record)) {
-    if (key === "parent") continue;
-    const child = record[key];
-    if (Array.isArray(child)) {
-      for (const item of child) {
-        if (isAstNode(item)) cursor = buildExpression(builder, item, cursor);
-      }
-    } else if (isAstNode(child)) {
-      cursor = buildExpression(builder, child, cursor);
-    }
-  }
-  builder.nodeBlock.set(node, cursor);
-  return cursor;
-};
-
-// Lower one link of an optional chain in evaluation order (innermost
-// object/callee first), branching to the shared `merge` (short-circuit) at
-// each optional `?.`. Mirrors the compiler's `lowerOptional*Expression`:
-// the base is evaluated unconditionally, then anything to the right of the
-// `?.` — a computed property, a deeper access, or a call's arguments —
-// evaluates in the conditional continuation. Returns the block where this
-// link's value is available on the non-short-circuit path.
-const buildOptionalChainLink = (
-  builder: CfgBuilder,
-  node: EsTreeNode,
-  current: BasicBlock,
-  merge: BasicBlock,
-): BasicBlock => {
-  if (isNodeOfType(node, "MemberExpression")) {
-    const afterObject = buildOptionalChainLink(builder, node.object as EsTreeNode, current, merge);
-    let cursor = afterObject;
-    if ((node as { optional?: boolean }).optional) {
-      const continuation = createBlock(builder);
-      addEdge(afterObject, continuation, "cond"); // base non-nullish → continue
-      addEdge(afterObject, merge, "cond"); // base nullish → short-circuit
-      cursor = continuation;
-    }
-    // A computed key (`a?.[expr]`) is only evaluated once the base is known
-    // non-nullish, so it belongs in the post-branch continuation.
-    if ((node as { computed?: boolean }).computed) {
-      cursor = buildExpression(builder, node.property as EsTreeNode, cursor);
-    }
-    builder.nodeBlock.set(node, cursor);
-    return cursor;
-  }
-
-  if (isNodeOfType(node, "CallExpression")) {
-    const afterCallee = buildOptionalChainLink(builder, node.callee as EsTreeNode, current, merge);
-    let cursor = afterCallee;
-    if ((node as { optional?: boolean }).optional) {
-      const continuation = createBlock(builder);
-      addEdge(afterCallee, continuation, "cond");
-      addEdge(afterCallee, merge, "cond");
-      cursor = continuation;
-    }
-    for (const argument of (node as { arguments: ReadonlyArray<EsTreeNode> }).arguments) {
-      if (isAstNode(argument)) cursor = buildExpression(builder, argument, cursor);
-    }
-    builder.nodeBlock.set(node, cursor);
-    return cursor;
-  }
-
-  // Chain base (an identifier, a parenthesized expression, a non-optional
-  // sub-expression): evaluate it normally.
-  return buildExpression(builder, node, current);
-};
-
-// Evaluate a sub-expression in `current`, returning the block where its
-// value is available. Falls back to the cheap whole-subtree mapping when
-// the expression has no embedded control flow.
-const buildSubExpression = (
-  builder: CfgBuilder,
-  node: EsTreeNode | null | undefined,
-  current: BasicBlock,
-): BasicBlock => {
-  if (!node) return current;
-  if (containsExpressionControlFlow(node)) return buildExpression(builder, node, current);
-  mapDescendantsToBlock(builder, node, current);
-  return current;
-};
-
-// Process a list of statements inside a block. Returns the block where
-// fall-through control flow ends up. Caller is responsible for
-// connecting that to the next block (e.g. exit, merge).
-const buildStatements = (
-  builder: CfgBuilder,
-  statements: ReadonlyArray<EsTreeNode>,
-  current: BasicBlock,
-): BasicBlock => {
-  let cursor = current;
-  for (const statement of statements) {
-    cursor = buildStatement(builder, statement, cursor);
-  }
-  return cursor;
-};
-
-// Process a single statement. Returns the block where control flow
-// ends up after the statement (possibly an orphan if the statement is
-// terminating).
-const buildStatement = (
-  builder: CfgBuilder,
-  statement: EsTreeNode,
-  current: BasicBlock,
-): BasicBlock => {
-  // Tag the statement node itself with the current block before
-  // descending — even for control-flow statements, the syntactic
-  // statement itself is "in" the current block.
-  builder.nodeBlock.set(statement, current);
-
-  if (!hasInternalControlFlow(statement)) {
-    appendNode(builder, current, statement);
-    // A plain statement can still carry expression-level control flow
-    // (`const x = cond ? useA() : useB()`, `cond && setState()`): lower it
-    // so the branched sub-expressions land in their own blocks. Otherwise
-    // every descendant maps to the current block (cheap path).
-    if (containsExpressionControlFlow(statement)) {
-      return buildExpression(builder, statement, current);
-    }
-    mapDescendantsToBlock(builder, statement, current);
-    return current;
-  }
-
-  if (isNodeOfType(statement, "BlockStatement")) {
-    return buildStatements(builder, statement.body as EsTreeNode[], current);
-  }
-
-  if (isNodeOfType(statement, "LabeledStatement")) {
-    // Push the label onto the stack with a placeholder; the body will
-    // create the merge block for `break <label>`.
-    const merge = createBlock(builder);
-    const labelEntry = {
-      label: statement.label.name,
-      merge,
-      header: null as BasicBlock | null,
-    };
-    builder.labelStack.push(labelEntry);
-    const body = (statement as { body: EsTreeNode }).body;
-    const end = buildStatement(builder, body, current);
-    builder.labelStack.pop();
-    addEdge(end, merge, "uncond");
-    return merge;
-  }
-
-  if (isNodeOfType(statement, "ReturnStatement")) {
-    const afterArgument = buildSubExpression(
-      builder,
-      statement.argument as EsTreeNode | null,
-      current,
-    );
-    addEdge(afterArgument, builder.exit, "uncond");
-    // Any subsequent statement is unreachable; create an orphan.
-    return createBlock(builder);
-  }
-
-  if (isNodeOfType(statement, "ThrowStatement")) {
-    const afterArgument = buildSubExpression(
-      builder,
-      statement.argument as EsTreeNode | null,
-      current,
-    );
-    // If we're in a try-catch, route to the catch (uncond — it's a
-    // normal control-flow successor for our analysis). Otherwise the
-    // throw escapes the function: route to exit but tag the edge as
-    // "throw" so the unconditional-from-entry analysis can ignore it
-    // (rules-of-hooks treats `if (x) throw; useHook();` as
-    // unconditional because the throw branch never normally returns).
-    const top = builder.tryStack[builder.tryStack.length - 1];
-    if (top?.catch) {
-      addEdge(afterArgument, top.catch, "uncond");
-    } else if (top?.finally) {
-      addEdge(afterArgument, top.finally, "uncond");
-    } else {
-      addEdge(afterArgument, builder.exit, "throw");
-    }
-    return createBlock(builder);
-  }
-
-  if (isNodeOfType(statement, "BreakStatement")) {
-    const targetLabel = statement.label ? statement.label.name : null;
-    const target = findLabel(builder, targetLabel);
-    if (target) addEdge(current, target.merge, "uncond");
-    else addEdge(current, builder.exit, "uncond");
-    return createBlock(builder);
-  }
-
-  if (isNodeOfType(statement, "ContinueStatement")) {
-    const targetLabel = statement.label ? statement.label.name : null;
-    const target = findLabel(builder, targetLabel);
-    if (target?.header) addEdge(current, target.header, "backedge");
-    return createBlock(builder);
-  }
-
-  if (isNodeOfType(statement, "IfStatement")) {
-    // Evaluate the test (its own short-circuits, e.g. `if (a && useX())`,
-    // become real branches); the if then forks from the post-test block.
-    const afterTest = buildSubExpression(builder, statement.test as EsTreeNode, current);
-    const thenBlock = createBlock(builder);
-    const merge = createBlock(builder);
-    addEdge(afterTest, thenBlock, "cond");
-    const thenEnd = buildStatement(builder, statement.consequent as EsTreeNode, thenBlock);
-    addEdge(thenEnd, merge, "uncond");
-    if (statement.alternate) {
-      const elseBlock = createBlock(builder);
-      addEdge(afterTest, elseBlock, "cond");
-      const elseEnd = buildStatement(builder, statement.alternate as EsTreeNode, elseBlock);
-      addEdge(elseEnd, merge, "uncond");
-    } else {
-      addEdge(afterTest, merge, "cond");
-    }
-    return merge;
-  }
-
-  if (isNodeOfType(statement, "WhileStatement") || isNodeOfType(statement, "DoWhileStatement")) {
-    const isDoWhile = isNodeOfType(statement, "DoWhileStatement");
-    mapDescendantsToBlock(builder, statement.test as EsTreeNode, current);
-    const isInfinite = isAlwaysTruthyLoopTest(statement.test as EsTreeNode);
-    const header = createBlock(builder);
-    const body = createBlock(builder);
-    const merge = createBlock(builder);
-    if (isDoWhile) {
-      // do-while: enter body first.
-      addEdge(current, body, "uncond");
-    } else {
-      addEdge(current, header, "uncond");
-      addEdge(header, body, "cond");
-      if (!isInfinite) addEdge(header, merge, "cond");
-    }
-    builder.loopStack.push({ header, merge, label: null });
-    const bodyEnd = buildStatement(builder, statement.body as EsTreeNode, body);
-    builder.loopStack.pop();
-    if (isDoWhile) {
-      // After body, test is evaluated → loop back or merge.
-      addEdge(bodyEnd, header, "backedge");
-      addEdge(header, body, "cond");
-      if (!isInfinite) addEdge(header, merge, "cond");
-    } else {
-      addEdge(bodyEnd, header, "backedge");
-    }
-    return merge;
-  }
-
-  if (isNodeOfType(statement, "ForStatement")) {
-    if (statement.init) mapDescendantsToBlock(builder, statement.init as EsTreeNode, current);
-    if (statement.test) mapDescendantsToBlock(builder, statement.test as EsTreeNode, current);
-    // `for (;;)` (no test) and `for (; true;)` never exit via condition.
-    const isInfinite = isAlwaysTruthyLoopTest(statement.test as EsTreeNode | null);
-    const header = createBlock(builder);
-    const body = createBlock(builder);
-    const merge = createBlock(builder);
-    addEdge(current, header, "uncond");
-    addEdge(header, body, "cond");
-    if (!isInfinite) addEdge(header, merge, "cond");
-    builder.loopStack.push({ header, merge, label: null });
-    const bodyEnd = buildStatement(builder, statement.body as EsTreeNode, body);
-    builder.loopStack.pop();
-    if (statement.update) mapDescendantsToBlock(builder, statement.update as EsTreeNode, header);
-    addEdge(bodyEnd, header, "backedge");
-    return merge;
-  }
-
-  if (isNodeOfType(statement, "ForInStatement") || isNodeOfType(statement, "ForOfStatement")) {
-    mapDescendantsToBlock(builder, statement.right as EsTreeNode, current);
-    mapDescendantsToBlock(builder, statement.left as EsTreeNode, current);
-    // A for-in / for-of iterates a (finite) collection, so the loop can
-    // always complete — the header→merge edge stays.
-    const header = createBlock(builder);
-    const body = createBlock(builder);
-    const merge = createBlock(builder);
-    addEdge(current, header, "uncond");
-    addEdge(header, body, "cond");
-    addEdge(header, merge, "cond");
-    builder.loopStack.push({ header, merge, label: null });
-    const bodyEnd = buildStatement(builder, statement.body as EsTreeNode, body);
-    builder.loopStack.pop();
-    addEdge(bodyEnd, header, "backedge");
-    return merge;
-  }
-
-  if (isNodeOfType(statement, "SwitchStatement")) {
-    const afterDiscriminant = buildSubExpression(
-      builder,
-      statement.discriminant as EsTreeNode,
-      current,
-    );
-    const merge = createBlock(builder);
-    builder.switchStack.push({ merge, label: null });
-    let previousCaseEnd: BasicBlock | null = null;
-    let hasDefault = false;
-    for (const switchCase of statement.cases) {
-      const caseBlock = createBlock(builder);
-      addEdge(afterDiscriminant, caseBlock, "cond");
-      // Fall-through from previous case (no break) connects to this case.
-      if (previousCaseEnd) addEdge(previousCaseEnd, caseBlock, "uncond");
-      const caseEnd = buildStatements(
-        builder,
-        (switchCase as { consequent: ReadonlyArray<EsTreeNode> }).consequent,
-        caseBlock,
-      );
-      previousCaseEnd = caseEnd;
-      if ((switchCase as { test: EsTreeNode | null }).test === null) hasDefault = true;
-    }
-    builder.switchStack.pop();
-    if (previousCaseEnd) addEdge(previousCaseEnd, merge, "uncond");
-    if (!hasDefault) addEdge(afterDiscriminant, merge, "cond"); // no case matched
-    return merge;
-  }
-
-  if (isNodeOfType(statement, "TryStatement")) {
-    const tryBlock = createBlock(builder);
-    const merge = createBlock(builder);
-    const catchBlock = statement.handler ? createBlock(builder) : null;
-    const finallyBlock = statement.finalizer ? createBlock(builder) : null;
-    addEdge(current, tryBlock, "uncond");
-
-    // Try body. A throw anywhere inside is modeled by a "cond" edge to
-    // catch (conditionally reached, like any branch — keeps catch out of
-    // the "every normal path" set without making it dead).
-    builder.tryStack.push({ catch: catchBlock, finally: finallyBlock });
-    const tryEnd = buildStatements(
-      builder,
-      (statement.block as { body: ReadonlyArray<EsTreeNode> }).body,
-      tryBlock,
-    );
-    builder.tryStack.pop();
-    if (catchBlock) addEdge(tryBlock, catchBlock, "cond");
-    const tryCompletesNormally = completesNormally(tryBlock, tryEnd);
-
-    let catchEnd: BasicBlock | null = null;
-    if (statement.handler && catchBlock) {
-      catchEnd = buildStatement(
-        builder,
-        (statement.handler as { body: EsTreeNode }).body,
-        catchBlock,
-      );
-    }
-    const catchCompletesNormally = catchEnd !== null && completesNormally(catchBlock!, catchEnd);
-
-    // The try STATEMENT can complete normally when its body does, or —
-    // if the throw is caught — when the catch body does.
-    const protectedCompletesNormally = catchBlock
-      ? tryCompletesNormally || catchCompletesNormally
-      : tryCompletesNormally;
-
-    if (finallyBlock && statement.finalizer) {
-      // `finally` runs on every path through the region — wire it from
-      // the region entries so a `return`/`throw` in try/catch can't make
-      // it unreachable. Also connect the normal ends so dominance sees
-      // the in-order path.
-      addEdge(tryBlock, finallyBlock, "finalize");
-      if (catchBlock) addEdge(catchBlock, finallyBlock, "finalize");
-      if (tryCompletesNormally && tryEnd !== tryBlock) addEdge(tryEnd, finallyBlock, "finalize");
-      if (catchEnd && catchCompletesNormally && catchEnd !== catchBlock) {
-        addEdge(catchEnd, finallyBlock, "finalize");
-      }
-      const finallyEnd = buildStatements(
-        builder,
-        (statement.finalizer as { body: ReadonlyArray<EsTreeNode> }).body,
-        finallyBlock,
-      );
-      // Resume-after-finally: code after the try is reachable only if the
-      // protected region could complete normally. (If `finally` itself
-      // completes abruptly, `finallyEnd` is an orphan and this join is
-      // dead regardless.)
-      if (protectedCompletesNormally) addEdge(finallyEnd, merge, "join");
-      return merge;
-    }
-
-    // No finally: after-try is reached from whichever of try / catch can
-    // complete normally.
-    if (tryCompletesNormally) addEdge(tryEnd, merge, "uncond");
-    if (catchEnd && catchCompletesNormally) addEdge(catchEnd, merge, "uncond");
-    return merge;
-  }
-
-  // Fallback (unhandled control-flow construct): treat as plain.
-  appendNode(builder, current, statement);
-  mapDescendantsToBlock(builder, statement, current);
-  return current;
-};
-
-const buildFunctionCfg = (functionNode: EsTreeNode, body: EsTreeNode): FunctionCfg => {
-  const builder: CfgBuilder = {
-    blocks: [],
-    entry: null as unknown as BasicBlock,
-    exit: null as unknown as BasicBlock,
-    nodeBlock: new Map(),
-    loopStack: [],
-    switchStack: [],
-    tryStack: [],
-    labelStack: [],
-  };
-  const entry = createBlock(builder);
-  const exit = createBlock(builder);
-  builder.entry = entry;
-  builder.exit = exit;
-
-  let bodyEnd: BasicBlock;
-  if (isNodeOfType(body, "BlockStatement")) {
-    bodyEnd = buildStatements(builder, body.body as EsTreeNode[], entry);
-  } else {
-    // Arrow expression body: a single Expression. Lower its control flow so
-    // `() => cond ? useA() : useB()` sees the hooks as conditional.
-    bodyEnd = buildSubExpression(builder, body, entry);
-  }
-  // Implicit return / fall-off the end of the function body.
-  addEdge(bodyEnd, exit, "uncond");
-
-  const blockOf = (node: EsTreeNode): BasicBlock | null => builder.nodeBlock.get(node) ?? null;
-
-  return {
-    owner: functionNode,
-    entry,
-    exit,
-    blocks: builder.blocks,
-    blockOf,
-  };
-};
-
-// A block B is "unconditional from entry" iff every execution path
-// from entry to exit passes through B. We compute this by, for each
-// block B, asking: if we removed B from the graph, is exit still
-// reachable from entry? If NO, B is on every path → unconditional.
-//
-// Cost: O(|blocks|^2) — fine for function-sized CFGs (typically <100
-// blocks). Avoids needing a full dominator tree.
-const computeUnconditionalSet = (cfg: FunctionCfg): Set<BasicBlock> => {
-  // Skip "throw" edges when computing reachability — uncaught throws
-  // don't represent a normal completion path. This makes
-  // `if (x) throw; useHook();` evaluate as unconditional (the
-  // `useHook` block is the only normal path to exit).
-  const reachableFromEntry = (excluded: BasicBlock | null): Set<BasicBlock> => {
-    const visited = new Set<BasicBlock>();
-    const queue: BasicBlock[] = [];
-    if (cfg.entry !== excluded) queue.push(cfg.entry);
-    while (queue.length > 0) {
-      const block = queue.shift()!;
-      if (visited.has(block)) continue;
-      visited.add(block);
-      for (const edge of block.successors) {
-        if (edge.kind === "throw") continue;
-        if (edge.to === excluded) continue;
-        queue.push(edge.to);
-      }
-    }
-    return visited;
-  };
-
-  // Whole-graph reachability: any block NOT in this set is dead code
-  // (e.g. statements after an unconditional `return;` / `throw;`).
-  // Dead-code blocks vacuously satisfy "unconditional from entry"
-  // because the call site is never reached at runtime — there's
-  // nothing to constrain.
-  const reachableFromEntryFull = reachableFromEntry(null);
-
-  const unconditional = new Set<BasicBlock>();
-  // Entry is trivially on every path.
-  unconditional.add(cfg.entry);
-  // Exit is on every (terminating) path.
-  unconditional.add(cfg.exit);
-  for (const block of cfg.blocks) {
-    if (unconditional.has(block)) continue;
-    if (!reachableFromEntryFull.has(block)) {
-      unconditional.add(block);
-      continue;
-    }
-    const stillReaches = reachableFromEntry(block).has(cfg.exit);
-    if (!stillReaches) unconditional.add(block);
-  }
-  return unconditional;
-};
-
-// Blocks reachable from entry over EVERY edge kind (including catch
-// edges). Used to answer `isUnreachable` — a block with no path from
-// entry is dead code.
-const computeReachableFromEntry = (cfg: FunctionCfg): Set<BasicBlock> => {
-  const visited = new Set<BasicBlock>();
-  const queue: BasicBlock[] = [cfg.entry];
-  while (queue.length > 0) {
-    const block = queue.shift()!;
-    if (visited.has(block)) continue;
-    visited.add(block);
-    for (const edge of block.successors) queue.push(edge.to);
-  }
-  return visited;
-};
-
-// Standard iterative dominator dataflow: dom(entry) = {entry};
-// dom(b) = {b} ∪ (⋂ dom(p) for predecessors p). `a` dominates `b` iff
-// `a ∈ dom(b)`. O(blocks²) — fine for function-sized graphs.
-const computeDominators = (cfg: FunctionCfg): Map<BasicBlock, Set<BasicBlock>> => {
-  const dominators = new Map<BasicBlock, Set<BasicBlock>>();
-  for (const block of cfg.blocks) {
-    dominators.set(block, block === cfg.entry ? new Set([cfg.entry]) : new Set(cfg.blocks));
-  }
-  let didChange = true;
-  while (didChange) {
-    didChange = false;
-    for (const block of cfg.blocks) {
-      if (block === cfg.entry) continue;
-      let intersection: Set<BasicBlock> | null = null;
-      for (const edge of block.predecessors) {
-        const predecessorDominators = dominators.get(edge.from)!;
-        if (intersection === null) {
-          intersection = new Set(predecessorDominators);
-        } else {
-          for (const candidate of intersection) {
-            if (!predecessorDominators.has(candidate)) intersection.delete(candidate);
-          }
-        }
-      }
-      const nextDominators = intersection ?? new Set<BasicBlock>();
-      nextDominators.add(block);
-      const previousDominators = dominators.get(block)!;
-      if (!areSetsEqual(previousDominators, nextDominators)) {
-        dominators.set(block, nextDominators);
-        didChange = true;
-      }
-    }
-  }
-  return dominators;
-};
-
-// Post-dominators are dominators on the reversed graph: postDom(exit) =
-// {exit}; postDom(b) = {b} ∪ (⋂ postDom(s) for successors s). `b`
-// post-dominates `a` iff `b ∈ postDom(a)`.
-const computePostDominators = (cfg: FunctionCfg): Map<BasicBlock, Set<BasicBlock>> => {
-  const postDominators = new Map<BasicBlock, Set<BasicBlock>>();
-  for (const block of cfg.blocks) {
-    postDominators.set(block, block === cfg.exit ? new Set([cfg.exit]) : new Set(cfg.blocks));
-  }
-  let didChange = true;
-  while (didChange) {
-    didChange = false;
-    for (const block of cfg.blocks) {
-      if (block === cfg.exit) continue;
-      let intersection: Set<BasicBlock> | null = null;
-      for (const edge of block.successors) {
-        const successorPostDominators = postDominators.get(edge.to)!;
-        if (intersection === null) {
-          intersection = new Set(successorPostDominators);
-        } else {
-          for (const candidate of intersection) {
-            if (!successorPostDominators.has(candidate)) intersection.delete(candidate);
-          }
-        }
-      }
-      const nextPostDominators = intersection ?? new Set<BasicBlock>();
-      nextPostDominators.add(block);
-      const previousPostDominators = postDominators.get(block)!;
-      if (!areSetsEqual(previousPostDominators, nextPostDominators)) {
-        postDominators.set(block, nextPostDominators);
-        didChange = true;
-      }
-    }
-  }
-  return postDominators;
-};
-
-// A block is on a cycle iff it can reach itself by following non-throw
-// successor edges (loop back-edges are normal "uncond" edges; a
-// throw→catch edge is not a loop).
-const computeCyclicBlocks = (cfg: FunctionCfg): Set<BasicBlock> => {
-  const cyclicBlocks = new Set<BasicBlock>();
-  for (const startBlock of cfg.blocks) {
-    const visited = new Set<BasicBlock>();
-    const queue: BasicBlock[] = [];
-    for (const edge of startBlock.successors) {
-      if (edge.kind !== "throw") queue.push(edge.to);
-    }
-    let isOnCycle = false;
-    while (queue.length > 0) {
-      const block = queue.shift()!;
-      if (block === startBlock) {
-        isOnCycle = true;
-        break;
-      }
-      if (visited.has(block)) continue;
-      visited.add(block);
-      for (const edge of block.successors) {
-        if (edge.kind !== "throw") queue.push(edge.to);
-      }
-    }
-    if (isOnCycle) cyclicBlocks.add(startBlock);
-  }
-  return cyclicBlocks;
-};
-
-// Source-order index for every node owned by this function (not
-// descending into nested functions). Used to break ties for two nodes
-// that share a basic block: within a straight-line block the earlier
-// node dominates the later one.
-const computeNodeOrder = (functionNode: EsTreeNode, body: EsTreeNode): Map<EsTreeNode, number> => {
-  const nodeOrder = new Map<EsTreeNode, number>();
-  let nextOrder = 0;
-  const walk = (node: EsTreeNode): void => {
-    if (!nodeOrder.has(node)) nodeOrder.set(node, nextOrder++);
-    if (node !== functionNode && isFunctionLike(node)) return;
-    const record = node as unknown as Record<string, unknown>;
-    for (const key of Object.keys(record)) {
-      if (key === "parent") continue;
-      const child = record[key];
-      if (Array.isArray(child)) {
-        for (const item of child) if (isAstNode(item)) walk(item);
-      } else if (isAstNode(child)) {
-        walk(child);
-      }
-    }
-  };
-  walk(body);
-  return nodeOrder;
-};
-
-const areSetsEqual = <Value>(first: Set<Value>, second: Set<Value>): boolean => {
-  if (first.size !== second.size) return false;
-  for (const value of first) if (!second.has(value)) return false;
-  return true;
-};
-
-const isBlockReachableFromBlock = (
-  fromBlock: BasicBlock,
-  toBlock: BasicBlock,
-  includeEdge: (edge: CfgEdge) => boolean = () => true,
-): boolean => {
-  const visited = new Set<BasicBlock>();
-  const queue: BasicBlock[] = [fromBlock];
-  while (queue.length > 0) {
-    const block = queue.shift()!;
-    for (const edge of block.successors) {
-      if (!includeEdge(edge)) continue;
-      if (edge.to === toBlock) return true;
-      if (!visited.has(edge.to)) {
-        visited.add(edge.to);
-        queue.push(edge.to);
-      }
-    }
-  }
-  return false;
-};
-
-// A protected region (the `try` body or a `catch` body) "completes
-// normally" iff its end block is reachable from its entry without
-// leaving via an exception (`throw`) or diverting into the `finally`
-// (`finalize`). `return` / `throw` / `break` route elsewhere and strand
-// the region end as an orphan, so it stays unreachable here.
-const completesNormally = (regionEntry: BasicBlock, regionEnd: BasicBlock): boolean =>
-  regionEntry === regionEnd ||
-  isBlockReachableFromBlock(
-    regionEntry,
-    regionEnd,
-    (edge) => edge.kind !== "throw" && edge.kind !== "finalize",
-  );
-
-interface FunctionCfgEntry {
-  cfg: FunctionCfg;
-  unconditionalSet: Set<BasicBlock>;
-  dominators: Map<BasicBlock, Set<BasicBlock>>;
-  postDominators: Map<BasicBlock, Set<BasicBlock>>;
-  cyclicBlocks: Set<BasicBlock>;
-  reachableFromEntry: Set<BasicBlock>;
-  nodeOrder: Map<EsTreeNode, number>;
-}
-
-// Walks the AST building a CFG for every function-like node + the
-// program. Lookups for an arbitrary AST node find the enclosing
-// function and consult that function's CFG.
-export const analyzeControlFlow = (program: EsTreeNode): ControlFlowAnalysis => {
-  nextBlockId = 0;
-  const functionCfgs = new Map<EsTreeNode, FunctionCfgEntry>();
-
-  const buildFor = (functionNode: EsTreeNode, body: EsTreeNode): void => {
-    const cfg = buildFunctionCfg(functionNode, body);
-    functionCfgs.set(functionNode, {
-      cfg,
-      unconditionalSet: computeUnconditionalSet(cfg),
-      dominators: computeDominators(cfg),
-      postDominators: computePostDominators(cfg),
-      cyclicBlocks: computeCyclicBlocks(cfg),
-      reachableFromEntry: computeReachableFromEntry(cfg),
-      nodeOrder: computeNodeOrder(functionNode, body),
-    });
-  };
-
-  // Build CFG for the program itself (treat as a "function" for
-  // top-level reasoning).
-  if (isNodeOfType(program, "Program")) {
-    // Synthesize a body block matching BlockStatement shape so
-    // buildFunctionCfg can iterate it.
-    const synthBody = { type: "BlockStatement", body: program.body } as unknown as EsTreeNode;
-    buildFor(program, synthBody);
-    // Also walk into every nested function-like node and build its own CFG.
-  }
-
-  // Walk every function-like node, build its CFG.
-  const visit = (node: EsTreeNode): void => {
-    if (isFunctionLike(node)) {
-      const body = (node as { body: EsTreeNode }).body;
-      if (body) buildFor(node, body);
-    }
-    const record = node as unknown as Record<string, unknown>;
-    for (const key of Object.keys(record)) {
-      if (key === "parent") continue;
-      const child = record[key];
-      if (Array.isArray(child)) {
-        for (const item of child) if (isAstNode(item)) visit(item);
-      } else if (isAstNode(child)) {
-        visit(child);
-      }
-    }
-  };
-  visit(program);
-
-  const enclosingFunction = (node: EsTreeNode): EsTreeNode | null => {
-    let current: EsTreeNode | null | undefined = node;
-    while (current) {
-      if (isFunctionLike(current)) return current;
-      if (isNodeOfType(current, "Program")) return current;
-      current = current.parent ?? null;
-    }
-    return null;
-  };
-
-  const cfgFor = (functionLike: EsTreeNode): FunctionCfg | null => {
-    return functionCfgs.get(functionLike)?.cfg ?? null;
-  };
-
-  const isUnconditionalFromEntry = (node: EsTreeNode): boolean => {
-    const owner = enclosingFunction(node);
-    if (!owner) return true;
-    const entry = functionCfgs.get(owner);
-    if (!entry) return true;
-    const block = entry.cfg.blockOf(node);
-    if (!block) return true;
-    return entry.unconditionalSet.has(block);
-  };
-
-  interface LocatedNode {
-    owner: EsTreeNode;
-    entry: FunctionCfgEntry;
-    block: BasicBlock;
-  }
-
-  const locate = (node: EsTreeNode): LocatedNode | null => {
-    const owner = enclosingFunction(node);
-    if (!owner) return null;
-    const entry = functionCfgs.get(owner);
-    if (!entry) return null;
-    const block = entry.cfg.blockOf(node);
-    if (!block) return null;
-    return { owner, entry, block };
-  };
-
-  const isReachable = (fromNode: EsTreeNode, toNode: EsTreeNode): boolean => {
-    const from = locate(fromNode);
-    const to = locate(toNode);
-    if (!from || !to || from.owner !== to.owner) return false;
-    if (from.block === to.block) {
-      if (from.entry.cyclicBlocks.has(from.block)) return true;
-      const fromOrder = from.entry.nodeOrder.get(fromNode) ?? 0;
-      const toOrder = to.entry.nodeOrder.get(toNode) ?? 0;
-      return fromOrder <= toOrder;
-    }
-    return isBlockReachableFromBlock(from.block, to.block);
-  };
-
-  const dominates = (aNode: EsTreeNode, bNode: EsTreeNode): boolean => {
-    const dominator = locate(aNode);
-    const dominated = locate(bNode);
-    if (!dominator || !dominated || dominator.owner !== dominated.owner) return false;
-    if (dominator.block === dominated.block) {
-      const aOrder = dominator.entry.nodeOrder.get(aNode) ?? 0;
-      const bOrder = dominated.entry.nodeOrder.get(bNode) ?? 0;
-      return aOrder <= bOrder;
-    }
-    return dominated.entry.dominators.get(dominated.block)?.has(dominator.block) ?? false;
-  };
-
-  const postDominates = (bNode: EsTreeNode, aNode: EsTreeNode): boolean => {
-    const postDominator = locate(bNode);
-    const postDominated = locate(aNode);
-    if (!postDominator || !postDominated || postDominator.owner !== postDominated.owner) {
-      return false;
-    }
-    if (postDominator.block === postDominated.block) {
-      const bOrder = postDominator.entry.nodeOrder.get(bNode) ?? 0;
-      const aOrder = postDominated.entry.nodeOrder.get(aNode) ?? 0;
-      return bOrder >= aOrder;
-    }
-    return (
-      postDominated.entry.postDominators.get(postDominated.block)?.has(postDominator.block) ?? false
-    );
-  };
-
-  const isInsideLoop = (node: EsTreeNode): boolean => {
-    const located = locate(node);
-    if (!located) return false;
-    return located.entry.cyclicBlocks.has(located.block);
-  };
-
-  const isUnreachable = (node: EsTreeNode): boolean => {
-    const located = locate(node);
-    if (!located) return false;
-    return !located.entry.reachableFromEntry.has(located.block);
-  };
-
-  return {
-    cfgFor,
-    enclosingFunction,
-    isUnconditionalFromEntry,
-    isReachable,
-    dominates,
-    postDominates,
-    isInsideLoop,
-    isUnreachable,
-  };
-};
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/semantic/scope-analysis.ts b/packages/oxlint-plugin-react-doctor/src/plugin/semantic/scope-analysis.ts
index 76500120d..da26204ee 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/semantic/scope-analysis.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/semantic/scope-analysis.ts
@@ -581,6 +581,12 @@ const isNonReferencePosition = (identifier: EsTreeNode): boolean => {
     case "MethodDefinition":
     case "PropertyDefinition":
       return parent.key === identifier && !parent.computed;
+    case "TSPropertySignature":
+    case "TSMethodSignature":
+      // Interface / object-type member names (`interface X { onRender?: T }`)
+      // are type-space keys, never value references — recording them as
+      // references would resolve them to a same-named value binding.
+      return parent.key === identifier && !parent.computed;
     case "JSXAttribute":
       return parent.name === identifier;
     case "ImportSpecifier":
@@ -868,6 +874,15 @@ const walk = (node: EsTreeNode, state: BuilderState): void => {
     node.type === "TSInterfaceDeclaration"
   ) {
     handleTsDeclarations(node, state);
+    // An interface / type-alias body is entirely type space — erased at
+    // compile time and never executed — so nothing inside it (heritage
+    // `extends`, index-signature parameters, computed property keys) is a
+    // runtime value reference. Stop descending, or those identifiers leak in
+    // as phantom references and trip value-level rules like the TDZ check.
+    // (`import =` and namespaces can bind real values, so they keep walking.)
+    if (node.type === "TSInterfaceDeclaration" || node.type === "TSTypeAliasDeclaration") {
+      return;
+    }
   }
 
   // Reference recording. Identifier in a non-binding position, AND
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/utils/es-tree-node-of-type.ts b/packages/oxlint-plugin-react-doctor/src/plugin/utils/es-tree-node-of-type.ts
index 8c7e6ba54..dccd32de4 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/utils/es-tree-node-of-type.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/utils/es-tree-node-of-type.ts
@@ -1,19 +1,3 @@
-import type { TSESTree } from "@typescript-eslint/types";
-import type { EsTreeNode } from "./es-tree-node.js";
-import type { EsTreeNodeType } from "./es-tree-node-type.js";
-
-// Distributes over the union so we can override `parent` without collapsing
-// discriminants. TSESTree pins each node's parent to a specific node kind
-// (e.g. JSXAttribute.parent: JSXOpeningElement), but our walker assigns
-// parent freely as it descends, so we relax it to `EsTreeNode | null` here.
-type WithLooseParent<NodeType> = NodeType extends NodeType
-  ? Omit<NodeType, "parent"> & { parent?: EsTreeNode | null }
-  : never;
-
-// Resolves a string `type` discriminant to the real TSESTree shape when known,
-// falling back to a loose `EsTreeNode & { type }` for nodes that TSESTree
-// doesn't model (none today, but keeps the helper safe under future TS evolution).
-export type EsTreeNodeOfType<NodeType extends EsTreeNodeType> =
-  Extract<TSESTree.Node, { type: NodeType }> extends never
-    ? EsTreeNode & { type: NodeType }
-    : WithLooseParent<Extract<TSESTree.Node, { type: NodeType }>>;
+// Single source of truth lives in `@react-doctor/cfg`; re-exported here so the
+// node-narrowing contract can't drift between two copies.
+export type { EsTreeNodeOfType } from "@react-doctor/cfg";
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/utils/es-tree-node-type.ts b/packages/oxlint-plugin-react-doctor/src/plugin/utils/es-tree-node-type.ts
index 9c876f215..9117012e7 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/utils/es-tree-node-type.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/utils/es-tree-node-type.ts
@@ -1,7 +1,3 @@
-import type { TSESTree } from "@typescript-eslint/types";
-
-// TSESTree models `type` as `AST_NODE_TYPES` enum members. Wrapping the union
-// in a template literal widens it to the underlying string-literal values, so
-// callers can pass plain strings like `"FunctionDeclaration"` to `isNodeOfType`
-// without importing the enum.
-export type EsTreeNodeType = `${TSESTree.Node["type"]}`;
+// Single source of truth lives in `@react-doctor/cfg`; re-exported here so the
+// node-type union can't drift between two copies.
+export type { EsTreeNodeType } from "@react-doctor/cfg";
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/utils/es-tree-node.ts b/packages/oxlint-plugin-react-doctor/src/plugin/utils/es-tree-node.ts
index f92a2e4eb..74fa66606 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/utils/es-tree-node.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/utils/es-tree-node.ts
@@ -1,19 +1,3 @@
-import type { TSESTree } from "@typescript-eslint/types";
-
-// Distributes over the TSESTree.Node union so each member gets its `parent`
-// relaxed independently — TSESTree pins each node's parent to a specific
-// kind (e.g. JSXAttribute.parent: JSXOpeningElement) but our walker assigns
-// parent freely as it descends, so we re-broaden to `EsTreeNode | null` here.
-type WithLooseParent<NodeType> = NodeType extends NodeType
-  ? Omit<NodeType, "parent"> & { parent?: EsTreeNode | null }
-  : never;
-
-// THE AST node type used everywhere a rule body walks an arbitrary AST.
-// It's the full TSESTree discriminated union (every concrete node kind),
-// with the `parent` field relaxed. Discriminated-union narrowing on
-// `.type` works natively — `node.type === "CallExpression"` narrows
-// `node.callee` to `Expression` etc. — and there's no `[key: string]: any`
-// escape hatch, so every property access requires the narrowing to have
-// happened first. `isNodeOfType(node, "X")` is the runtime-safe entry
-// point for narrowing through opaque helpers; native `===` works inline.
-export type EsTreeNode = WithLooseParent<TSESTree.Node>;
+// Single source of truth lives in `@react-doctor/cfg`; the plugin re-exports
+// it so the cross-package AST contract can't drift between two copies.
+export type { EsTreeNode } from "@react-doctor/cfg";
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/utils/has-type-property.ts b/packages/oxlint-plugin-react-doctor/src/plugin/utils/has-type-property.ts
index 544ffdbda..b87555eea 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/utils/has-type-property.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/utils/has-type-property.ts
@@ -1,4 +1,3 @@
-import type { ValueWithType } from "./value-with-type.js";
-
-export const hasTypeProperty = (value: unknown): value is ValueWithType =>
-  Boolean(value && typeof value === "object" && "type" in value);
+// Single source of truth lives in `@react-doctor/cfg`; re-exported here so the
+// AST shape guard can't drift between two copies.
+export { hasTypeProperty } from "@react-doctor/cfg";
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/utils/is-ast-node.ts b/packages/oxlint-plugin-react-doctor/src/plugin/utils/is-ast-node.ts
index 839a3e860..6b4ef91e5 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/utils/is-ast-node.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/utils/is-ast-node.ts
@@ -1,7 +1,3 @@
-import type { EsTreeNode } from "./es-tree-node.js";
-import { hasTypeProperty } from "./has-type-property.js";
-
-export const isAstNode = (value: unknown): value is EsTreeNode => {
-  if (!hasTypeProperty(value)) return false;
-  return typeof value.type === "string";
-};
+// Single source of truth lives in `@react-doctor/cfg`; re-exported here so the
+// AST-node guard can't drift between two copies.
+export { isAstNode } from "@react-doctor/cfg";
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/utils/is-captured-by-closure.ts b/packages/oxlint-plugin-react-doctor/src/plugin/utils/is-captured-by-closure.ts
new file mode 100644
index 000000000..38e56869a
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/utils/is-captured-by-closure.ts
@@ -0,0 +1,32 @@
+import type { ScopeDescriptor, SymbolDescriptor } from "../semantic/scope-analysis.js";
+
+// Scope kinds that own a runtime call frame — the granularity per-function
+// SSA / dataflow tracks. A binding read inside a NESTED frame is a closure
+// capture those analyses can't see across, so value-flow reasoning must bail
+// for it.
+const FRAME_SCOPE_KINDS: ReadonlySet<string> = new Set([
+  "module",
+  "function",
+  "arrow-function",
+  "method",
+]);
+
+const enclosingFrameScope = (scope: ScopeDescriptor): ScopeDescriptor => {
+  let current: ScopeDescriptor | null = scope;
+  while (current) {
+    if (FRAME_SCOPE_KINDS.has(current.kind)) return current;
+    current = current.parent;
+  }
+  return scope;
+};
+
+// True when the binding is referenced from a different call frame than the
+// one it's declared in (captured by a closure). SSA and definite-assignment
+// stop at function boundaries, so such references are invisible to them —
+// callers treat the binding conservatively to stay sound.
+export const isCapturedByClosure = (symbol: SymbolDescriptor): boolean => {
+  const declarationFrame = enclosingFrameScope(symbol.scope);
+  return symbol.references.some(
+    (reference) => enclosingFrameScope(reference.scope) !== declarationFrame,
+  );
+};
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/utils/is-declaration-file.ts b/packages/oxlint-plugin-react-doctor/src/plugin/utils/is-declaration-file.ts
new file mode 100644
index 000000000..db988fae2
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/utils/is-declaration-file.ts
@@ -0,0 +1,8 @@
+// A TypeScript declaration file (`.d.ts` / `.d.mts` / `.d.cts`) is pure
+// ambient type space — erased at compile time with no runtime execution — so
+// runtime value rules (TDZ, dead code, …) never apply. The ESM/CJS variants
+// are handled too so they don't slip through.
+export const isDeclarationFile = (filename: string | undefined): boolean => {
+  if (!filename) return false;
+  return filename.endsWith(".d.ts") || filename.endsWith(".d.mts") || filename.endsWith(".d.cts");
+};
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/utils/is-function-like.ts b/packages/oxlint-plugin-react-doctor/src/plugin/utils/is-function-like.ts
index 332bba0bf..8555aa029 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/utils/is-function-like.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/utils/is-function-like.ts
@@ -1,26 +1,3 @@
-import type { EsTreeNode } from "./es-tree-node.js";
-import type { EsTreeNodeOfType } from "./es-tree-node-of-type.js";
-import { isNodeOfType } from "./is-node-of-type.js";
-
-/**
- * Type-guard for the three "function-like" ESTree node shapes:
- * `ArrowFunctionExpression`, `FunctionExpression`,
- * `FunctionDeclaration`. Accepts `null | undefined` so callers
- * walking parent chains don't need their own pre-check.
- *
- * Was duplicated across five sites as both a plain boolean check
- * (`FUNCTION_LIKE_TYPES.has(node.type)`) and as a type-guard. The
- * type-guard form covers both shapes without callers paying a cast.
- */
-export const isFunctionLike = (
-  node: EsTreeNode | null | undefined,
-): node is
-  | EsTreeNodeOfType<"ArrowFunctionExpression">
-  | EsTreeNodeOfType<"FunctionExpression">
-  | EsTreeNodeOfType<"FunctionDeclaration"> =>
-  Boolean(
-    node &&
-    (isNodeOfType(node, "ArrowFunctionExpression") ||
-      isNodeOfType(node, "FunctionExpression") ||
-      isNodeOfType(node, "FunctionDeclaration")),
-  );
+// Single source of truth lives in `@react-doctor/cfg`; re-exported here so the
+// function-like guard can't drift between two copies.
+export { isFunctionLike } from "@react-doctor/cfg";
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/utils/is-node-of-type.ts b/packages/oxlint-plugin-react-doctor/src/plugin/utils/is-node-of-type.ts
index 04045075b..cdcffb5ed 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/utils/is-node-of-type.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/utils/is-node-of-type.ts
@@ -1,8 +1,3 @@
-import type { EsTreeNodeOfType } from "./es-tree-node-of-type.js";
-import type { EsTreeNodeType } from "./es-tree-node-type.js";
-import { hasTypeProperty } from "./has-type-property.js";
-
-export const isNodeOfType = <NodeType extends EsTreeNodeType>(
-  node: unknown,
-  type: NodeType,
-): node is EsTreeNodeOfType<NodeType> => Boolean(hasTypeProperty(node) && node.type === type);
+// Single source of truth lives in `@react-doctor/cfg`; re-exported here so the
+// node-narrowing guard can't drift between two copies.
+export { isNodeOfType } from "@react-doctor/cfg";
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/utils/node-start.ts b/packages/oxlint-plugin-react-doctor/src/plugin/utils/node-start.ts
new file mode 100644
index 000000000..0367b767e
--- /dev/null
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/utils/node-start.ts
@@ -0,0 +1,7 @@
+import type { EsTreeNode } from "./es-tree-node.js";
+
+// oxc's `parseSync` emits ESTree byte offsets as `start` / `end` and never
+// populates `range`, which TSESTree's types don't declare — so read the
+// offset structurally. Returns -1 when the node carries no usable offset.
+export const nodeStart = (node: EsTreeNode): number =>
+  "start" in node && typeof node.start === "number" ? node.start : -1;
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/utils/parse-source-file.ts b/packages/oxlint-plugin-react-doctor/src/plugin/utils/parse-source-file.ts
index b1a90cfaa..d5f736668 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/utils/parse-source-file.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/utils/parse-source-file.ts
@@ -4,6 +4,7 @@ import { parseSync } from "oxc-parser";
 import { CROSS_FILE_PARSE_MAX_BYTES } from "../constants/thresholds.js";
 import { attachParentReferences } from "./attach-parent-references.js";
 import type { EsTreeNode } from "./es-tree-node.js";
+import { isDeclarationFile } from "./is-declaration-file.js";
 
 const FILENAME_TO_LANG: Record<string, "ts" | "tsx" | "js" | "jsx"> = {
   ".ts": "ts",
@@ -75,14 +76,8 @@ export const parseSourceFile = (absoluteFilePath: string): EsTreeNode | null =>
 
   // TypeScript declaration files are types-only — they have no
   // runtime function bodies to analyse. Cache as miss so we don't
-  // retry parsing them on every cross-file lookup. All three
-  // declaration-file extensions are handled (`.d.ts`, `.d.mts`,
-  // `.d.cts`) so the ESM/CJS variants don't slip through.
-  if (
-    absoluteFilePath.endsWith(".d.ts") ||
-    absoluteFilePath.endsWith(".d.mts") ||
-    absoluteFilePath.endsWith(".d.cts")
-  ) {
+  // retry parsing them on every cross-file lookup.
+  if (isDeclarationFile(absoluteFilePath)) {
     parseCache.set(absoluteFilePath, {
       mtimeMs: fileStat.mtimeMs,
       size: fileStat.size,
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/utils/rule-context.ts b/packages/oxlint-plugin-react-doctor/src/plugin/utils/rule-context.ts
index d078fa2f1..f3546cb84 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/utils/rule-context.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/utils/rule-context.ts
@@ -1,7 +1,24 @@
 import type { ReportDescriptor } from "./report-descriptor.js";
-import type { ControlFlowAnalysis } from "../semantic/control-flow-graph.js";
+import type {
+  ControlFlowAnalysis,
+  DefiniteAssignmentAnalysis,
+  SsaAnalysis,
+  TypestateViolation,
+  VerifyTypestateOptions,
+} from "@react-doctor/cfg";
+import type { EsTreeNode } from "./es-tree-node.js";
 import type { ScopeAnalysis } from "../semantic/scope-analysis.js";
 
+// The typestate engine, scoped to the file's CFGs: a rule supplies an
+// automaton + event classifier and gets back the protocol violations in a
+// function-like (or the Program). Returns [] when the function has no CFG.
+export interface TypestateContext {
+  readonly verify: (
+    functionLike: EsTreeNode,
+    options: VerifyTypestateOptions,
+  ) => ReadonlyArray<TypestateViolation>;
+}
+
 // The "base" context the host (oxlint at runtime, ESLint via the
 // adapter, our test harness) hands to a rule. Pure I/O surface — the
 // host doesn't need to compute scope or CFG for us.
@@ -29,4 +46,12 @@ export interface BaseRuleContext {
 export interface RuleContext extends Omit<BaseRuleContext, "getFilename"> {
   readonly scopes: ScopeAnalysis;
   readonly cfg: ControlFlowAnalysis;
+  // Variable-level SSA over the file, sharing the scope analyzer's binding
+  // identities. Built lazily; rules that never read it pay nothing.
+  readonly ssa: SsaAnalysis;
+  // Definite-assignment dataflow (Layer A): which reads can be reached with
+  // the binding still unassigned. Lazy; opt-in.
+  readonly dataflow: DefiniteAssignmentAnalysis;
+  // Typestate protocol verification (Layer C). Lazy; opt-in.
+  readonly typestate: TypestateContext;
 }
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/utils/value-with-type.ts b/packages/oxlint-plugin-react-doctor/src/plugin/utils/value-with-type.ts
index e85a2cc5c..1f4d7201a 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/utils/value-with-type.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/utils/value-with-type.ts
@@ -1,3 +1,3 @@
-export interface ValueWithType {
-  type?: unknown;
-}
+// Single source of truth lives in `@react-doctor/cfg`; re-exported here so the
+// AST shape guard can't drift between two copies.
+export type { ValueWithType } from "@react-doctor/cfg";
diff --git a/packages/oxlint-plugin-react-doctor/src/plugin/utils/wrap-with-semantic-context.ts b/packages/oxlint-plugin-react-doctor/src/plugin/utils/wrap-with-semantic-context.ts
index 19f571f9e..d56208a33 100644
--- a/packages/oxlint-plugin-react-doctor/src/plugin/utils/wrap-with-semantic-context.ts
+++ b/packages/oxlint-plugin-react-doctor/src/plugin/utils/wrap-with-semantic-context.ts
@@ -1,13 +1,23 @@
 import type { EsTreeNode } from "./es-tree-node.js";
 import { findProgramRoot } from "./find-program-root.js";
 import type { Rule } from "./rule.js";
-import type { BaseRuleContext, RuleContext } from "./rule-context.js";
+import type { BaseRuleContext, RuleContext, TypestateContext } from "./rule-context.js";
 import type { HostRule } from "./rule-plugin.js";
 import type { RuleVisitors } from "./rule-visitors.js";
 import { analyzeScopes } from "../semantic/scope-analysis.js";
 import type { ScopeAnalysis } from "../semantic/scope-analysis.js";
-import { analyzeControlFlow } from "../semantic/control-flow-graph.js";
-import type { ControlFlowAnalysis } from "../semantic/control-flow-graph.js";
+import {
+  analyzeControlFlow,
+  analyzeDefiniteAssignment,
+  analyzeSsa,
+  ssaValueResolver,
+  verifyTypestate,
+} from "@react-doctor/cfg";
+import type {
+  ControlFlowAnalysis,
+  DefiniteAssignmentAnalysis,
+  SsaAnalysis,
+} from "@react-doctor/cfg";
 
 // Wraps a rule so `context.scopes` and `context.cfg` exist at runtime
 // even when oxlint's host context doesn't pre-build them. We build the
@@ -57,6 +67,29 @@ const FALLBACK_CFG: ControlFlowAnalysis = {
   postDominates: () => false,
   isInsideLoop: () => false,
   isUnreachable: () => false,
+  dominanceFrontier: () => [],
+  isInfiniteLoopStart: () => false,
+  toDot: () => null,
+};
+
+// Unreachable in practice (see the HACK note above). `isLiveValue` defaults
+// to `true` so a value-flow rule reading it errs toward NOT flagging (no
+// false dead-store) if the root capture ever fails.
+const FALLBACK_SSA: SsaAnalysis = {
+  controlFlow: FALLBACK_CFG,
+  ssaFor: () => null,
+  bindingOf: () => null,
+  versionAt: () => null,
+  reachingDefinition: () => null,
+  isLiveValue: () => true,
+  isRedefinedBetween: () => false,
+};
+
+// Unreachable in practice (see the HACK note above). `isMaybeUnassignedAt`
+// defaults to `false` so a use-before-define rule errs toward NOT flagging
+// if the root capture ever fails.
+const FALLBACK_DATAFLOW: DefiniteAssignmentAnalysis = {
+  isMaybeUnassignedAt: () => false,
 };
 
 export const wrapWithSemanticContext = (rule: Rule): HostRule => ({
@@ -65,6 +98,8 @@ export const wrapWithSemanticContext = (rule: Rule): HostRule => ({
     let programRoot: EsTreeNode | null = null;
     let cachedScopes: ScopeAnalysis | null = null;
     let cachedCfg: ControlFlowAnalysis | null = null;
+    let cachedSsa: SsaAnalysis | null = null;
+    let cachedDataflow: DefiniteAssignmentAnalysis | null = null;
 
     const getScopes = (): ScopeAnalysis => {
       if (cachedScopes) return cachedScopes;
@@ -80,6 +115,49 @@ export const wrapWithSemanticContext = (rule: Rule): HostRule => ({
       return cachedCfg;
     };
 
+    // SSA shares the scope analyzer's binding identities, so a rule can
+    // cross-reference `context.scopes` symbols with SSA versions.
+    const getSsa = (): SsaAnalysis => {
+      if (cachedSsa) return cachedSsa;
+      if (!programRoot) return FALLBACK_SSA;
+      const scopes = getScopes();
+      cachedSsa = analyzeSsa(programRoot, (identifier) => scopes.symbolFor(identifier)?.id ?? null);
+      return cachedSsa;
+    };
+
+    // Layer D seam: an SSA value read at two branches resolves to the SAME
+    // atom, so the feasibility checker can refute correlated-branch
+    // counterexamples. Shared by definite-assignment and typestate so both
+    // only ever drop PROVABLY-infeasible false positives.
+    const getResolveValue = () => ssaValueResolver(getSsa());
+
+    // Definite-assignment shares the scope analyzer's binding identities,
+    // matching the SSA occurrence stream it keys off.
+    const getDataflow = (): DefiniteAssignmentAnalysis => {
+      if (cachedDataflow) return cachedDataflow;
+      if (!programRoot) return FALLBACK_DATAFLOW;
+      const scopes = getScopes();
+      cachedDataflow = analyzeDefiniteAssignment(
+        programRoot,
+        (identifier) => scopes.symbolFor(identifier)?.id ?? null,
+        { resolveValue: getResolveValue() },
+      );
+      return cachedDataflow;
+    };
+
+    // Typestate verification is parameterized per rule (automaton +
+    // classifier), so it can't be cached file-wide; we resolve the target
+    // function's CFG and run the engine on demand. The feasibility refinement
+    // rides along via `resolveValue` unless the caller already supplied one.
+    const typestate: TypestateContext = {
+      verify: (functionLike, options) => {
+        if (!programRoot) return [];
+        const cfg = getCfg().cfgFor(functionLike);
+        if (!cfg) return [];
+        return verifyTypestate(cfg, { resolveValue: getResolveValue(), ...options });
+      },
+    };
+
     // Resolve from the host's modern `filename` property, falling back to
     // its deprecated `getFilename()` invoked ON the host (so a `this`-bound
     // class method keeps its binding — forwarding a bare reference dropped
@@ -96,6 +174,13 @@ export const wrapWithSemanticContext = (rule: Rule): HostRule => ({
       get cfg() {
         return getCfg();
       },
+      get ssa() {
+        return getSsa();
+      },
+      get dataflow() {
+        return getDataflow();
+      },
+      typestate,
     };
 
     const captureRootIfNeeded = (node: EsTreeNode): void => {
diff --git a/packages/oxlint-plugin-react-doctor/src/test-utils/run-rule.ts b/packages/oxlint-plugin-react-doctor/src/test-utils/run-rule.ts
index c710fa5fd..6b5ed7154 100644
--- a/packages/oxlint-plugin-react-doctor/src/test-utils/run-rule.ts
+++ b/packages/oxlint-plugin-react-doctor/src/test-utils/run-rule.ts
@@ -8,7 +8,13 @@ import type { Rule } from "../plugin/utils/rule.js";
 import type { RuleContext } from "../plugin/utils/rule-context.js";
 import type { RuleVisitors } from "../plugin/utils/rule-visitors.js";
 import { analyzeScopes } from "../plugin/semantic/scope-analysis.js";
-import { analyzeControlFlow } from "../plugin/semantic/control-flow-graph.js";
+import {
+  analyzeControlFlow,
+  analyzeDefiniteAssignment,
+  analyzeSsa,
+  ssaValueResolver,
+  verifyTypestate,
+} from "@react-doctor/cfg";
 
 export interface RunRuleOptions {
   filename?: string;
@@ -67,6 +73,10 @@ export const runRule = (rule: Rule, code: string, options: RunRuleOptions = {}):
   const diagnostics: RuleDiagnostic[] = [];
   const scopes = analyzeScopes(parsed.program);
   const cfg = analyzeControlFlow(parsed.program);
+  const resolveBinding = (identifier: EsTreeNode) => scopes.symbolFor(identifier)?.id ?? null;
+  const ssa = analyzeSsa(parsed.program, resolveBinding);
+  const resolveValue = ssaValueResolver(ssa);
+  const dataflow = analyzeDefiniteAssignment(parsed.program, resolveBinding, { resolveValue });
   const context: RuleContext = {
     report: (descriptor: ReportDescriptor) => {
       diagnostics.push({
@@ -80,6 +90,14 @@ export const runRule = (rule: Rule, code: string, options: RunRuleOptions = {}):
     settings: options.settings,
     scopes,
     cfg,
+    ssa,
+    dataflow,
+    typestate: {
+      verify: (functionLike, verifyOptions) => {
+        const functionCfg = cfg.cfgFor(functionLike);
+        return functionCfg ? verifyTypestate(functionCfg, { resolveValue, ...verifyOptions }) : [];
+      },
+    },
   };
 
   const visitors = rule.create(context);
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index c91c725d5..a0397c009 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -59,6 +59,19 @@ importers:
         specifier: ^25.6.0
         version: 25.6.0
 
+  packages/cfg:
+    dependencies:
+      '@typescript-eslint/types':
+        specifier: ^8.59.3
+        version: 8.59.3
+    devDependencies:
+      '@types/node':
+        specifier: ^25.6.0
+        version: 25.6.0
+      oxc-parser:
+        specifier: ^0.135.0
+        version: 0.135.0
+
   packages/core:
     dependencies:
       '@effect/platform-node-shared':
@@ -152,6 +165,9 @@ importers:
         specifier: ^0.135.0
         version: 0.135.0
     devDependencies:
+      '@react-doctor/cfg':
+        specifier: workspace:*
+        version: link:../cfg
       '@types/node':
         specifier: ^25.6.0
         version: 25.6.0