rea/docs/verification/javascript-route-inventory-2026-10-21.md

Static JavaScript route inventory verification

Issue #4772. Qualified runtime b49ee40bf330b7bf1c5180b14dcc104c1c613a8e, tree 0e5f8fe2feae1796c340c07c26e0e28e5d4328d8, integrates main c8ed32853881b08aa83459d4da55a28a4e09b0c8. Recorded at 2026-10-22T08:30:58.269Z. Subsequent verification-only commits change these reports. The JSON record pins original inputs, exact commands, profiles, failed controls and historical revisions. Current-head GitHub CI and automated review must be checked separately.

The latest main contracts, selected environment and ASAR admission remain shared by CLI and MCP. The staged-code hook runs lint fixes before formatting, resolving the producing order behind the earlier CI format failure.

Current implementation and executed checks

Shared source analysis produces stable route, occurrence, source and gap facts. CLI and MCP use the same retained Evidence views, with filtering, selected fields, batch identities and pagination; complete source Evidence remains accessible. Coverage and explicit unknowns survive compact delivery and source deletion. Selected CLI delivery requires a complete Evidence export; MCP retention is checked before analysis. Immutable snapshots use weak identity caching with parent identity checks; live target state is not cached.

Route scanning reuses semantic bindings, mutation, literal-field, reference and truthiness owners. Navigation data ownership excludes query/search/hash values, callee/projection/predicate edges and definitely inactive branches while keeping independent lexical routes. Registration patterns preserve optional syntax and initializer ranges. Unrecognized array/string methods do not become navigation. Rest-copy exclusions, unresolved projections, mutations and cycles retain their appropriate independent facts or unknowns. Next page classification shares one owner, including private folders, encoded public underscores and unresolved interception context. Source ranges use one-based lines, zero-based UTF-16 columns and exclusive ends.

Source/fact and inventory budgets are 8 MiB; optional facts fit the actual remaining combined-result budget. Selected pages include the sealing digest within their 1 MiB bound. Cancellation preserves earlier facts and Evidence; worker cleanup and capacity failures retain typed outcomes.

The current integration uses main's canonical Evidence publication/cleanup owner and deferred MCP runtime/catalog. CLI delivery explicitly produces JsonValue and projects the two publication receipt scalars without cloning complete Evidence. The canonical web-bundle state and coordinate owners replace duplicate types. The coordinator parser-import boundary remains covered.

3847 source checks and 116 compiled public checks passed, including 245 scanner regressions, actual full/compact SDK profiles, both JSON Schema dialects, source selection/deletion, retained reads, cancellation, recovery, real workers and CLI/browser adapters. The current public selection additionally covers ASAR admission, selected environment, CLI resource closing and Electron file scope; earlier startup/ publication checks remain pinned to their recorded runtime. Selected-path identity runs separately with its original 30-second deadline. Typecheck/lint passed; documentation checks are recorded in JSON after generation. The main-baseline service-worker deadline correction #6186 is included; it retains the original stalled-handshake assertions and test guard.

A valid review case exposed overwritten query fields hiding independent route initializers: seven corrected regressions failed before the fix, while182 tests passed, including four new effective/uncertain-data controls. Ownership now consults the existing cached effective-field reader. A known final slot or method excludes discarded references; unknown spreads/computed keys remain conservative. Full/compact SDK reads after source deletion and both browser adapters retain the independent route. The public SDK assertion requires the exact expected count and every expected path. The record preserves failed validation and a corrected initial test-harness field name; no invalid harness failure is counted as a bug.

A second review case exposed selected member query data becoming page routes. Six direct/computed/optional, alias, nested and array-member cases failed while 189 controls passed. The existing static member-chain helper now lives in the shared AST owner; both require consumers use it and its old export is removed. Optional admission checks charge each path step before retention. Navigation source selection reuses canonical possible-value sources at each read and one selected-slot walk shared with copied initializers, without claiming whole receivers or callee namespaces. Current full/compact retained SDK queries and both browser adapters exclude the selected query object while preserving its independent sibling.

A previous runtime's public batch hit two original 30-second schema deadlines. That failed attempt, successful isolated rerun and their combined resource cost remain pinned in JSON. Current execution runs schema validity alone, 18 other suites together and selected-path identity alone, retaining original assertions and deadlines.

Five prototype/own-property cases failed before the latest fix while 198 passed. The field owner now reuses the existing AST prototype-setter predicate. Setters retain unresolved inheritance but cannot overwrite computed/shorthand own keys; setter data references are not discarded as own-key writes. Direct, member and destructured query selection share this owner. Full/compact historical SDK reads and both browser adapters exclude the prototype-shaped query payload. The runtime retains main's integer-schema allocation optimization and integrates the latest main contracts, shared keyed ordering and retained-parent parser. The only merge conflict was the analysis-view description: the complete upstream text plus the exact route-view sentence were retained. Current catalog changes and fresh client/schema checks are recorded separately in JSON.

A later review found that lifetime identity eligibility retained fields proved replaced before a query read. Eight cases failed while 206 controls passed. Both member reads and direct identifiers now use canonical value-flow sources or binding snapshots for their read site. Unknown order keeps possible sources; known replacements exclude stale ones. Binding-once deduplication is removed because separate reads may select different values; syntax-cycle and resource bounds remain. Both SDK profiles after deletion and both browser adapters preserve the independent route through member and direct-variable replacements, while actual replacement payloads and earlier/possible query data remain excluded.

A further review reproduced four failures through conditional aliases, unknown array members and nested receiver aliases, while 215 controls passed. The shared mutation producer now distinguishes proved receiver identity from possible aliasing. Canonical read-time selection requires both identity and ordering before discarding original values or superseded prefixes. Deferred reference paths retain this proof and assigned-value provenance; deduplication includes certainty. Direct writes through the read's own alias still prove replacement. Both public SDK profiles after deletion and both browser adapters cover a distinct uncertain-alias payload without claiming the entire receiver.

CI also caught our integration regression in the unrelated Dart ABI advertisement: lint removed a slash escape, making the pattern invalid in JavaScript v mode. The ABI schema now encodes the slash as a hex code point, consistent with existing portable patterns and stable under lint fixes. The original advertised-pattern client test is included in this qualification. The prior inference that escaped and unescaped character classes were equivalent across clients is withdrawn; no Dart-provider execution is claimed. The interrupted superseded local run and failed CI are retained in the JSON record.

Two later review cases reproduced eleven failures while 222 controls passed: possible query fields cleared by spreads became pages, and selected member configurations claimed unrelated siblings. The selected-slot walk now uses the canonical possible object/array reference owners; exact fields still prove positive destinations. Configuration ownership preserves member and copied initializer paths through the same walk. Conditional-container selection reuses existing value-edge/truthiness rules. Normal paths advance offsets; exceptional path expansion is charged before allocation and node/path visits bound cycles.

This also exposed a canonical computed-key overwrite defect: an independent semantic-analysis regression failed with unknown coverage before the owner fix and retains its original literal afterward. Earlier unknown computed values are excluded by later definite slots; a getter paired with only a later setter stays possible. Accessor and conditional-container controls pass. Both SDK profiles after source deletion and both browser adapters exclude a distinct possible-query payload and preserve the selected configuration's independent sibling with exact counts. Unsupported projected configurations keep explicit gaps. Actual SDK tool definitions remain structurally identical to the preceding qualified runtime.

The next review reproduced two growing getter projections exhausting the 8 MiB route budget and hiding an independent route. An existing direct reader golden also retained overwritten computed-key alternatives; the earlier selected test matrix had omitted that producer suite. Three cases failed and 241 controls passed, including a finite repeated-getter control. The source-order expectations now match the shared owner's definite overwrite rule.

A subsequent review showed that suffix lengths are insufficient recursion proof: two finite getter chains were marked cyclic, leaking query data as page routes; 243 controls passed. That inference is withdrawn. Selected-value traversal now uses value/lookup/finish frames: evaluate each canonical returned-reference path, clear its unfinished receiver/key, then resume the caller's member path. Scoped visited maps preserve independent result sinks. The suffix-length heuristic and suffix concatenation have been removed. Three finite/nested cases pass alongside genuine direct/mutual recursive getters and finite repeated selections. Both retained SDK profiles after deletion and both browser adapters exclude distinct finite-getter query payloads while retaining exact independent routes and actual cyclic gaps. Current source qualification covers all 133 JavaScript domain suites plus eight related suites. It ran on the exact staged source tree; commit hooks left that tree identical, so its source tests were not needlessly repeated after commit. New build-dependent public and real-artifact workflows ran on the frozen runtime.

Real production inputs and oracle

Every one of the 67 saved production scripts was rehashed and freshly analyzed through production isolated workers, with one semantic projection node, 512 MiB worker old-space and the existing 15-second source deadline. Application sources were read as data. No source facts were reused for this qualification.

Homepage capture	Scripts	Bytes	Completed	Route checkpoints	Rooted patterns
nextjs-org	29	1,533,098	28	28	0
shadcn-ui	38	2,465,078	36	37	18

The full task cost 207.348 s / 313.817 CPU s / 502,669,312 bytes peak family RSS. The previous pinned runtime 972c5ad86 full-worker run took 277.184 s/409.684 CPU s. These are individual observations, not a timing distribution. Earlier paired source elapsed observations remain pinned to their measured revisions in JSON. There is no controlled causal ablation or repeated timing study, so neither the source correction nor the main integration is assigned a performance cause. Configured deadlines and partial/unavailable facts are explicit. Zero supported rooted Next patterns does not establish zero application routes. Lazy/server-only code, reachability and the full application route denominator remain unknown.

Independent direct-byte inspection of the 86,218-byte shadcn production chunk finds exactly 18 quoted /docs patterns, including 12 direct href properties. SHA-256: 45c6ead1e08cc578464e7a0c6b2e6764d7af83f99039e291f288a971b988b3fc. Every fresh SDK and browser verifier requires the entire sorted 18-pattern oracle, original source identity, provenance and complete retained Evidence.

An owned Chromium 156.0.8078.4 compiled this source via Runtime.compileScript/persistScript on a blank local page without running it. Actual CLI and official SDK analyze_web_bundle calls passively captured it via CDP and returned all 18 patterns, original URL and SHA-256. Source parsing was complete, enumeration partial and application coverage unknown. Owned process and temporary-profile cleanup succeeded. Cost: 10.379 s / 13.481 CPU s / 2,091,114,496 bytes peak family RSS.

Equivalent SDK task costs

Both fresh sessions list /docs patterns with confidence, mechanism and source provenance, preserve complete Evidence, perform three retained follow-up reads and export Evidence. They assert the same complete parent Evidence identity. Measurements include the instrumentation and use full input advertisements.

Delivery	Used declarations + all calls/replies, tokenx	Entire catalog + all calls/replies, tokenx	Task resources
Complete	1,934,534	3,035,567	13.785 s / 18.104 CPU s / 1,356,595,200 bytes peak family RSS
Selected	58,902	1,159,935	12.243 s / 15.909 CPU s / 1,303,572,480 bytes peak family RSS

Tokenx counts actual advertised schemas, arguments and full SDK replies, including exports and follow-ups; it estimates tokens rather than actual model usage. Initialization, JSON-RPC envelopes and separate token-count instrumentation costs remain unmeasured. Processes/sessions are fresh with warm OS caches; there is no filesystem-cache flush, repeated statistical timing study or claim of stable latency/analysis speedup. Default compact-advertisement costs are not measured. CPU is payload process-family wait-rusage delta and RSS samples all descendant tasks every 20 ms. Heavy tasks run sequentially on two CPUs with an 8 GiB family RSS/420-second guard. No qualification guard fired.

The JSON preserves prior failures, source-owner corrections and their exact before/after revisions. Historical CI/review does not establish the current head. Private issue samples, complete application routes, live route execution, external cloud clients and Windows/macOS provider execution remain unverified.