Here’s some more progress:
It’s aware of setmetatable() and keeps track of function return types:
setmetatable()