fix(javascript): preserve loader authority for exact suffixes (#9477)

* fix(javascript): require exact loader suffix case

* fix(javascript): share exact loader mode across import resolution

* test(process): align symlink fixture with filesystem checkpoints

* test(javascript): normalize the module resolution oracle path separators

* test(frida): assert the CLI spawn Evidence contract

* test(mcp): use an unsupported analysis-view parent

* test(browser): separate source-location line bounds from parity

* fix(javascript): preserve uncertain loader provenance

* test(javascript): cover uncertain require resolution

* fix(javascript): retain conditional Electron evidence

* fix(javascript): preserve timed semantic provenance

* fix(javascript): retain conditional builtin effects

* test(javascript): distinguish bundled host authority

* fix(javascript): preserve nested loader invocation identity

* test(javascript): qualify Electron fixture authority

* fix(javascript): preserve loader invocation authority

* fix(javascript): respect source order for resolver escapes

* fix(javascript): check nested loader callable mutations

* fix(javascript): retain conditional constructor requests

* fix(reference): retain constructor loader relationships

* fix(reference): follow nested loader callable paths

* refactor(javascript): share callable mutation interpretation

* fix(javascript): require exact package loader suffixes

* refactor(javascript): unify conditional relation evidence

* refactor(javascript): unify conditional node evidence

* fix(javascript): retain unknown authority for mixed case sources

* fix(javascript): preserve loader uncertainty for dotfiles

* fix(reference): classify javascript suffix dotfiles

* test(reference): cover suffix dotfiles through cli

* fix(javascript): retain equivalent conditional built-in origins

* fix(javascript): preserve wrapped resolver operation

* fix(javascript): retain nested conditional built-in receivers

* test(javascript): declare CommonJS in native addon fixtures

* fix(javascript): retain wrapped resolver candidates

* style: format merged native command schema

* fix(javascript): preserve uncertain loader authority

* test(javascript): require candidate preload evidence

* test(javascript): cover reference loader member writes

---------

Co-authored-by: ShuaixinHuang <1836656514@qq.com>

src/domain/javascript/javascriptSemanticProjection.ts

@@ -12,7 +12,7 @@ import {
   type JavaScriptSemanticAnalysisState,
   type JavaScriptSemanticScopeState,
 } from "./javascriptSemanticState.js";
-import { semanticRequireOrigin } from "./javascriptSemanticRequireOrigin.js";
+import { semanticRequireOriginCandidate } from "./javascriptSemanticRequireOrigin.js";
 import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
 import {
   completeSemanticSteps,
@@ -428,7 +428,7 @@ const collectRequireLink = (
   node: t.VariableDeclarator,
   state: JavaScriptSemanticAnalysisState,
 ): void => {
-  const required = semanticRequireOrigin(node.init, state);
+  const required = semanticRequireOriginCandidate(node.init, state);
   if (required === undefined) return;
   const { origin, call } = required;
   const bindings = requirePatternBindings(node.id, origin.importedPath);
@@ -437,6 +437,9 @@ const collectRequireLink = (
       state,
       {
         kind: "require",
+        ...(origin.loaderAuthority === "candidate"
+          ? { loaderAuthority: "candidate" as const }
+          : {}),
         specifier: origin.specifier,
         importedName: binding.importedName,
         localName: binding.localName,
@@ -453,12 +456,15 @@ const collectUnboundRequireLink = (
   state: JavaScriptSemanticAnalysisState,
 ): void => {
   if (state.linkedRequireCalls.has(node)) return;
-  const required = semanticRequireOrigin(node, state);
+  const required = semanticRequireOriginCandidate(node, state);
   if (required === undefined) return;
   addModuleLink(
     state,
     {
       kind: "require",
+      ...(required.origin.loaderAuthority === "candidate"
+        ? { loaderAuthority: "candidate" as const }
+        : {}),
       specifier: required.origin.specifier,
       importedName: null,
       localName: null,
@@ -515,6 +521,7 @@ const collectCommonJsExport = (
       exported.exportedName,
       applicability === "uncertain" ? null : exported.value,
       exported.projection,
+      exported.loaderAuthority,
     );
   }
 };
@@ -525,13 +532,14 @@ const addCommonJsExport = (
   exportedName: string,
   exported: t.Node | null,
   projection?: JavaScriptSemanticPropertyPath,
+  loaderAuthority?: "candidate",
 ): void => {
   // Simple assignment chains yield their rightmost assigned value.
   let value = exported;
   while (t.isAssignmentExpression(value, { operator: "=" }))
     value = value.right;
   const required =
-    value === null ? undefined : semanticRequireOrigin(value, state);
+    value === null ? undefined : semanticRequireOriginCandidate(value, state);
   // Copies retain their module provenance, but do not export the source object
   // itself. A wildcard with exclusions cannot express one module link.
   const origin = projection?.some(
@@ -545,6 +553,10 @@ const addCommonJsExport = (
     state,
     {
       kind: "commonjs-export",
+      ...(origin?.loaderAuthority === "candidate" ||
+      loaderAuthority === "candidate"
+        ? { loaderAuthority: "candidate" as const }
+        : {}),
       specifier: origin?.specifier ?? null,
       importedName:
         origin === undefined