fix(javascript): align module lookup and source evidence

Preserve CommonJS literal paths and confined ESM URL semantics, including package main fallback, directory intent, Unicode identity, and present opaque modules. Parse extraction inputs at their AST/source owner, retain skipped HTML and source-map coverage, and distinguish endpoint candidates from proven receiver facts. Version structural fingerprints with computed literal contents and propagate them through worker contracts.

Reviewed fixes include #1810, #1840, #2642, #2700, #2702, #2714, #2803, #2960, #2968, #2986, #3035, and #3036.

Validation: 158 resolver tests passed; public CLI/MCP module lookup controls, package-main/Unicode workflows, and six builtin workflows passed in the current compiled lane. Worker schema/fingerprint regressions passed. Large public pdf.js completion and real Electron analysis remain unverified.

src/domain/javascript/javascriptRuntimeStaticCandidates.ts

@@ -16,6 +16,12 @@ export interface StaticRuntimeCandidate {
   readonly node: ApplicationNode;
   readonly category: "renderer" | "javascript" | "worker" | "service-worker";
   readonly paths: readonly string[];
+  readonly nativeDeclarationPaths: Readonly<
+    Record<
+      "posix" | "windows",
+      readonly { readonly path: string; readonly sourcePath: string | null }[]
+    >
+  >;
   readonly digests: readonly {
     readonly sha256: string;
     readonly basis: "content-sha256" | "module-source-sha256";
@@ -24,6 +30,9 @@ export interface StaticRuntimeCandidate {
 
 export interface MappedRuntimePath {
   readonly path: string;
+  readonly fileStyle: "posix" | "windows" | null;
+  readonly nativeRelativePath: string | null;
+  readonly artifactPrefix: string;
   readonly basis:
     | "artifact-path"
     | "operator-file-mapping"
@@ -54,9 +63,20 @@ export const mappedRuntimePaths = (
   entity: RuntimeReconciliationEntity,
 ): MappedRuntimePath[] => {
   const paths: MappedRuntimePath[] = [];
+  const fileStyle =
+    entity.location.kind === "file"
+      ? absoluteFilePathStyle(entity.location.value)
+      : null;
   if (entity.location.kind === "file" && layer.result.format === "directory") {
     const path = pathBelowRoot(layer.result.input_path, entity.location.value);
-    if (path !== null) paths.push({ path, basis: "artifact-path" });
+    if (path !== null)
+      paths.push({
+        path,
+        fileStyle,
+        nativeRelativePath: path,
+        artifactPrefix: "",
+        basis: "artifact-path",
+      });
   }
   for (const mapping of layer.runtimeMappings) {
     const suffix =
@@ -70,6 +90,9 @@ export const mappedRuntimePaths = (
     if (path === null) continue;
     paths.push({
       path,
+      fileStyle,
+      nativeRelativePath: mapping.kind === "file-root" ? suffix : null,
+      artifactPrefix: normalizeArtifactPrefix(mapping.artifact_prefix),
       basis:
         mapping.kind === "file-root"
           ? "operator-file-mapping"
@@ -111,6 +134,7 @@ const candidatesForLayer = (
         node,
         category,
         paths: pathsByNodeId.get(node.node_id) ?? [],
+        nativeDeclarationPaths: nativeDeclarationPaths(node),
         digests: candidateDigests(node),
       },
     ];
@@ -157,7 +181,9 @@ const indexStaticPaths = (
       node.node_id,
       uniqueSorted([
         ...nodePaths(node),
-        ...(relatedBySource.get(node.node_id) ?? []).flatMap(nodePaths),
+        ...(usesApplicationFileDeclaration(node)
+          ? []
+          : (relatedBySource.get(node.node_id) ?? []).flatMap(nodePaths)),
       ]),
     ]),
   );
@@ -168,9 +194,21 @@ const nodePaths = (node: ApplicationNode): string[] => {
   if (node.identity.strategy === "canonical-path")
     paths.push(node.identity.path);
   for (const observation of node.observations) {
-    for (const property of ["path", "resolved_path", "declared_path"])
-      if (typeof observation.properties[property] === "string")
-        paths.push(observation.properties[property]);
+    const rawApplicationFile =
+      node.kind === "electron-renderer" &&
+      isRawApplicationFileObservation(observation);
+    if (typeof observation.properties.path === "string")
+      paths.push(observation.properties.path);
+    if (rawApplicationFile) continue;
+    if (typeof observation.properties.resolved_path === "string")
+      paths.push(observation.properties.resolved_path);
+    const declaration = observation.properties.declared_path;
+    if (
+      !hasOwnedArtifactPath(node) &&
+      typeof declaration === "string" &&
+      !declaration.includes("\\")
+    )
+      paths.push(declaration);
     if (
       observation.evidence.location.available &&
       observation.evidence.location.value.kind === "artifact-path"
@@ -184,6 +222,95 @@ const nodePaths = (node: ApplicationNode): string[] => {
     );
 };
 
+// Raw filesystem expressions have host syntax only when a captured file location
+// establishes that format. Genuinely owned artifact facts take precedence.
+const hasOwnedArtifactPath = (node: ApplicationNode): boolean =>
+  node.identity.strategy === "canonical-path" ||
+  node.observations.some(
+    ({ properties }) => typeof properties.path === "string",
+  ) ||
+  node.observations.some(
+    (observation) =>
+      !isRawApplicationFileObservation(observation) &&
+      typeof observation.properties.resolved_path === "string",
+  );
+
+// loadFile receives a raw literal here: the syntax producer does not retain
+// computed __dirname expressions. Electron resolves this relative to the app
+// root, so its source-relative inference is not an owned runtime target.
+const isRawApplicationFileObservation = (
+  observation: ApplicationNode["observations"][number],
+): boolean =>
+  observation.properties.resolution_context === "filesystem-expression" &&
+  typeof observation.properties.mechanism === "string" &&
+  observation.properties.mechanism.startsWith("call:") &&
+  observation.properties.mechanism.endsWith("loadFile");
+
+const usesApplicationFileDeclaration = (node: ApplicationNode): boolean =>
+  node.kind === "electron-renderer" &&
+  !hasOwnedArtifactPath(node) &&
+  node.observations.some(isRawApplicationFileObservation);
+
+const nativeDeclarationPaths = (
+  node: ApplicationNode,
+): StaticRuntimeCandidate["nativeDeclarationPaths"] => {
+  if (hasOwnedArtifactPath(node)) return { posix: [], windows: [] };
+  const declarations = node.observations.flatMap((observation) => {
+    const { properties } = observation;
+    return properties.resolution_context === "filesystem-expression" &&
+      typeof properties.declared_path === "string" &&
+      (isRawApplicationFileObservation(observation) ||
+        properties.declared_path.includes("\\"))
+      ? [
+          {
+            path: properties.declared_path,
+            sourcePath: nativeDeclarationSource(observation),
+          },
+        ]
+      : [];
+  });
+  const normalized = (windows: boolean) => {
+    const values = declarations.flatMap(({ path, sourcePath }) => {
+      if (windows && (win32.isAbsolute(path) || /^[a-z]:/iu.test(path)))
+        return [];
+      const normalizedPath = relativeLogicalPath(
+        windows ? path.replaceAll("\\", "/") : path,
+      );
+      return normalizedPath === null
+        ? []
+        : [{ path: normalizedPath, sourcePath }];
+    });
+    return [
+      ...new Map(
+        values.map((value) => [JSON.stringify(value), value]),
+      ).values(),
+    ].sort(
+      (left, right) =>
+        compareUnicodeCodePoints(left.path, right.path) ||
+        compareUnicodeCodePoints(left.sourcePath ?? "", right.sourcePath ?? ""),
+    );
+  };
+  return { posix: normalized(false), windows: normalized(true) };
+};
+
+// A source anchor constrains the selected application namespace; it does not
+// supply a module-relative base for the raw filesystem declaration.
+const nativeDeclarationSource = (
+  observation: ApplicationNode["observations"][number],
+): string | null => {
+  const location = observation.evidence.location;
+  if (!location.available) return null;
+  const source =
+    location.value.kind === "source-range"
+      ? location.value.source
+      : location.value.kind === "artifact-path"
+        ? location.value.path
+        : null;
+  return source === null || source === "artifact-root"
+    ? null
+    : relativeLogicalPath(source);
+};
+
 const candidateDigests = (
   node: ApplicationNode,
 ): StaticRuntimeCandidate["digests"] => {
@@ -217,7 +344,8 @@ const pathBelowRoot = (root: string, value: string): string | null => {
     rootStyle === "windows"
       ? win32.relative(root, value)
       : posix.relative(root, value);
-  const portableRemainder = remainder.replaceAll("\\", "/");
+  const portableRemainder =
+    rootStyle === "windows" ? remainder.replaceAll("\\", "/") : remainder;
   if (
     remainder === "" ||
     (rootStyle === "windows" && win32.isAbsolute(remainder)) ||
@@ -288,10 +416,13 @@ const activeArtifactPrefixes = (
             : false,
       )
     )
-      prefixes.add(mapping.artifact_prefix);
+      prefixes.add(normalizeArtifactPrefix(mapping.artifact_prefix));
   return [...prefixes].sort(compareUnicodeCodePoints);
 };
 
+const normalizeArtifactPrefix = (prefix: string): string =>
+  prefix === "" ? "" : normalizeJoinedLogicalPath(prefix);
+
 const pathWithinPrefix = (path: string, prefix: string): boolean =>
   prefix === "" || path === prefix || path.startsWith(`${prefix}/`);
 
@@ -299,6 +430,7 @@ const safeArtifactPath = (prefix: string, suffix: string): string | null =>
   relativeLogicalPath(prefix === "" ? suffix : posix.join(prefix, suffix));
 
 const relativeLogicalPath = (value: string): string | null => {
+  // These are artifact names or already parsed runtime paths, not declarations.
   const normalized = normalizeJoinedLogicalPath(value);
   return normalized !== "" &&
     normalized !== "." &&
@@ -312,10 +444,24 @@ const uniqueMappedPaths = (
 ): MappedRuntimePath[] =>
   [
     ...new Map(
-      values.map((value) => [`${value.basis}:${value.path}`, value]),
+      values.map((value) => [
+        JSON.stringify([
+          value.basis,
+          value.path,
+          value.fileStyle,
+          value.nativeRelativePath,
+          value.artifactPrefix,
+        ]),
+        value,
+      ]),
     ).values(),
   ].sort(
     (left, right) =>
       compareUnicodeCodePoints(left.path, right.path) ||
-      compareUnicodeCodePoints(left.basis, right.basis),
+      compareUnicodeCodePoints(left.basis, right.basis) ||
+      compareUnicodeCodePoints(
+        left.nativeRelativePath ?? "",
+        right.nativeRelativePath ?? "",
+      ) ||
+      compareUnicodeCodePoints(left.artifactPrefix, right.artifactPrefix),
   );