diff --git a/debug/ref.php b/debug/ref.php
new file mode 100644
index 00000000..9463b731
--- /dev/null
+++ b/debug/ref.php
@@ -0,0 +1,60 @@
+<?php
+class StackHolder
+{
+    public static array $stack = [];
+
+    public static function push(string $item): void
+    {
+        self::$stack[] = $item;
+    }
+
+    public static function pop(): void
+    {
+        // 触发 bug: AOT 对 static 属性 array_pop 生成 php::toReference(v) 缺第 2 参数
+        array_pop(self::$stack);
+    }
+
+    public static function count(): int
+    {
+        return count(self::$stack);
+    }
+}
+
+// ── 对照：array_pop($localVar) 走不同代码生成路径，应该正常 ──
+function local_pop_test(): string
+{
+    $arr = ['x', 'y', 'z'];
+    array_pop($arr);
+
+    if (count($arr) !== 2) {
+        return 'FAIL: local_pop_test expected 2, got ' . count($arr);
+    }
+    if ($arr[0] !== 'x' || $arr[1] !== 'y') {
+        return 'FAIL: local_pop_test wrong elements';
+    }
+
+    return 'OK';
+}
+
+function main(): int
+{
+    // 测试 static 属性（已知 bug，预期编译失败）
+    StackHolder::push('a');
+    StackHolder::push('b');
+    StackHolder::pop();
+
+    if (StackHolder::count() !== 1) {
+        echo "FAIL: static_pop expected 1, got " . StackHolder::count() . "\n";
+        return 1;
+    }
+
+    // 测试局部变量（应该正常）
+    $result = local_pop_test();
+    echo $result . "\n";
+    if ($result !== 'OK') {
+        return 1;
+    }
+
+    echo "ALL OK\n";
+    return 0;
+}
\ No newline at end of file
diff --git a/phpunit/src/ClassMethodOverrideTest.php b/phpunit/src/ClassMethodOverrideTest.php
index f7f4e773..9fed4512 100644
--- a/phpunit/src/ClassMethodOverrideTest.php
+++ b/phpunit/src/ClassMethodOverrideTest.php
@@ -25,4 +25,24 @@ class ClassMethodOverrideTest extends \BaseTest
         // 子类方法未被覆盖
         $this->assertFalse($classMethodOverride[$childMethodLower], 'ChildOverride::bar should not be marked as overridden');
     }
+
+    public function testNamespacedOverrideKeysUseFullClassName(): void
+    {
+        $compiler = CompilerTest::create(ROOT_PATH);
+        $testFile = __DIR__ . '/../code/class-method-override-namespace.php';
+        $compiler->addFiles([$testFile]);
+        $compiler->prepareFile($testFile);
+
+        $ref = new ReflectionClass($compiler);
+        $prop = $ref->getProperty('classMethodOverride');
+        $classMethodOverride = $prop->getValue($compiler);
+
+        $parentMethodLower = strtolower('Demo\\Dispatch\\ParentBaseNs::bar');
+        $childMethodLower = strtolower('Demo\\Dispatch\\ChildOverrideNs::bar');
+
+        $this->assertArrayHasKey($parentMethodLower, $classMethodOverride, 'Namespaced parent method should be registered with full class name');
+        $this->assertArrayHasKey($childMethodLower, $classMethodOverride, 'Namespaced child method should be registered with full class name');
+        $this->assertTrue($classMethodOverride[$parentMethodLower], 'Namespaced parent method should be marked as overridden');
+        $this->assertFalse($classMethodOverride[$childMethodLower], 'Namespaced child method should not be marked as overridden');
+    }
 }
diff --git a/tests/aot/dynamic_call/call-abstract-method.phpt b/tests/aot/dynamic_call/call-abstract-method.phpt
index 266ab369..9596d1c2 100644
--- a/tests/aot/dynamic_call/call-abstract-method.phpt
+++ b/tests/aot/dynamic_call/call-abstract-method.phpt
@@ -2,8 +2,6 @@
 call abstract base method through concrete object
 --FILE--
 <?php
-use native_types;
-
 abstract class Base
 {
     abstract public function run(): string;
diff --git a/tests/aot/dynamic_call/call-interface-method.phpt b/tests/aot/dynamic_call/call-interface-method.phpt
new file mode 100644
index 00000000..842f12b6
--- /dev/null
+++ b/tests/aot/dynamic_call/call-interface-method.phpt
@@ -0,0 +1,32 @@
+--TEST--
+call interface method through concrete object
+--FILE--
+<?php
+interface Runner
+{
+    public function run(): string;
+}
+
+class FastRunner implements Runner
+{
+    public function run(): string
+    {
+        return 'fast';
+    }
+}
+
+function invoke(Runner $runner): string
+{
+    $alias = $runner;
+    return $alias->run();
+}
+
+function main(): int
+{
+    $r = invoke(new FastRunner());
+    echo "result: $r\n";
+    return $r === 'fast' ? 0 : 1;
+}
+?>
+--EXPECT--
+result: fast
diff --git a/tests/aot/dynamic_call/call-magic-fallback-typed-object.phpt b/tests/aot/dynamic_call/call-magic-fallback-typed-object.phpt
new file mode 100644
index 00000000..515b2292
--- /dev/null
+++ b/tests/aot/dynamic_call/call-magic-fallback-typed-object.phpt
@@ -0,0 +1,29 @@
+--TEST--
+missing method on typed object dispatches to __call
+--FILE--
+<?php
+use native_types;
+
+class DynamicHandler
+{
+    public function __call(string $name, array $args): string
+    {
+        return $name . ':' . implode(',', $args);
+    }
+}
+
+function invoke(DynamicHandler $handler): string
+{
+    $alias = $handler;
+    return $alias->missing('a', 'b');
+}
+
+function main(): int
+{
+    $r = invoke(new DynamicHandler());
+    echo "result: $r\n";
+    return $r === 'missing:a,b' ? 0 : 1;
+}
+?>
+--EXPECT--
+result: missing:a,b
diff --git a/tests/aot/dynamic_call/call-multilevel-override.phpt b/tests/aot/dynamic_call/call-multilevel-override.phpt
new file mode 100644
index 00000000..0cb7fda4
--- /dev/null
+++ b/tests/aot/dynamic_call/call-multilevel-override.phpt
@@ -0,0 +1,41 @@
+--TEST--
+call method overridden in grandchild through base parameter
+--FILE--
+<?php
+use native_types;
+
+class Base
+{
+    public function value(): string
+    {
+        return 'base';
+    }
+}
+
+class Middle extends Base
+{
+}
+
+class Leaf extends Middle
+{
+    public function value(): string
+    {
+        return 'leaf';
+    }
+}
+
+function readValue(Base $obj): string
+{
+    $alias = $obj;
+    return $alias->value();
+}
+
+function main(): int
+{
+    $r = readValue(new Leaf());
+    echo "result: $r\n";
+    return $r === 'leaf' ? 0 : 1;
+}
+?>
+--EXPECT--
+result: leaf
diff --git a/tests/aot/dynamic_call/call-namespaced-parent-override.phpt b/tests/aot/dynamic_call/call-namespaced-parent-override.phpt
index 91318641..0bf1dacb 100644
--- a/tests/aot/dynamic_call/call-namespaced-parent-override.phpt
+++ b/tests/aot/dynamic_call/call-namespaced-parent-override.phpt
@@ -3,8 +3,6 @@ call overridden method through namespaced parent type
 --FILE--
 <?php
 namespace Demo {
-    use native_types;
-
     class Base
     {
         public function run(): string
diff --git a/tests/aot/dynamic_call/call-parent-return-override.phpt b/tests/aot/dynamic_call/call-parent-return-override.phpt
index d2a648eb..788892ba 100644
--- a/tests/aot/dynamic_call/call-parent-return-override.phpt
+++ b/tests/aot/dynamic_call/call-parent-return-override.phpt
@@ -2,8 +2,6 @@
 call overridden method through parent parameter type
 --FILE--
 <?php
-use native_types;
-
 class Base
 {
     public function run(): string
diff --git a/tests/aot/dynamic_call/call-parent-sibling-dispatch.phpt b/tests/aot/dynamic_call/call-parent-sibling-dispatch.phpt
new file mode 100644
index 00000000..afd93677
--- /dev/null
+++ b/tests/aot/dynamic_call/call-parent-sibling-dispatch.phpt
@@ -0,0 +1,48 @@
+--TEST--
+call overridden method on sibling subclasses through parent parameter
+--FILE--
+<?php
+use native_types;
+
+class Base
+{
+    public function name(): string
+    {
+        return 'base';
+    }
+}
+
+class Left extends Base
+{
+    public function name(): string
+    {
+        return 'left';
+    }
+}
+
+class Right extends Base
+{
+    public function name(): string
+    {
+        return 'right';
+    }
+}
+
+function readName(Base $obj): string
+{
+    $alias = $obj;
+    return $alias->name();
+}
+
+function main(): int
+{
+    $left = readName(new Left());
+    $right = readName(new Right());
+    echo "left: $left\n";
+    echo "right: $right\n";
+    return $left === 'left' && $right === 'right' ? 0 : 1;
+}
+?>
+--EXPECT--
+left: left
+right: right
diff --git a/tests/aot/dynamic_call/call-protected-override.phpt b/tests/aot/dynamic_call/call-protected-override.phpt
new file mode 100644
index 00000000..2f794f4a
--- /dev/null
+++ b/tests/aot/dynamic_call/call-protected-override.phpt
@@ -0,0 +1,41 @@
+--TEST--
+protected overridden method remains virtual through parent wrapper
+--FILE--
+<?php
+use native_types;
+
+class Base
+{
+    protected function token(): string
+    {
+        return 'base';
+    }
+
+    public function expose(): string
+    {
+        return $this->token();
+    }
+}
+
+class Child extends Base
+{
+    protected function token(): string
+    {
+        return 'child';
+    }
+}
+
+function main(): int
+{
+    $base = new Base();
+    $child = new Child();
+    $a = $base->expose();
+    $b = $child->expose();
+    echo "base: $a\n";
+    echo "child: $b\n";
+    return $a === 'base' && $b === 'child' ? 0 : 1;
+}
+?>
+--EXPECT--
+base: base
+child: child