Questions about ExplorationMutator

Hello, I am studying ExplorationMutator, and I think it is a good idea to assist mutation through runtime information.
But I found that after detecting the type of the object, the mutation operation of ExplorationMutator is also completed through the js code, and these mutation operations are not diverse enough.

Why does ExplorationMutator need to mutate through js code? What if the type information is detected through runtime and then passed to Fuzzilli, and then Fuzzilli is responsible for mutation?

demo:

let arr = ["xxx", "yyy"];
let obj = {};
obj[arr[0]] = function(a) { ... };

explore(obj);

obj[arr[0]] will set an compute property, so Typer in Fuzzilli cannot infer that obj contains the property "xxx". Later, explore(obj) will detect the "xxx" attribute, and then pass the attribute name and the type of the attribute value to Fuzzilli, and Fuzzilli can perform more mutation operations on the attribute.

Start by reading the ExplorationMutator and Typer components, then trace how explore(obj) reports runtime properties and value types back to Fuzzilli. The issue does not name files or tests; completion would require a decided design for moving or expanding mutation responsibility and a way to verify computed-property coverage.