* docs(ci): add a repeatable static analysis example
* fix(ci): isolate example reports and repair the guide link
---------
Co-authored-by: gongfpp <22683417+gongfpp@users.noreply.github.com>
Pin admitted script identities and metadata before selected source reads. After the final CDP read, count unique additional retained IDs as dropped script inventory so incomplete captures stay unknown without extending source reads or inventing budget failures. Cover producer and comparison behavior through registered MCP tools.
Co-authored-by: gongfpp <22683417+gongfpp@users.noreply.github.com>
Keep ordinary UTF-8 digests and secret redaction, separate malformed UTF-16 preimages, and record storage fingerprint provenance. Compare legacy hashed snapshots as unknown without treating encoding metadata as a target change. Cover producer boundaries and real owned-browser CLI/MCP workflows.
BREAKING CHANGE: legacy hashed browser storage remains readable but comparisons return unknown until both sides are recaptured.
Co-authored-by: gongfpp <22683417+gongfpp@users.noreply.github.com>
The semantic member-mutation collector revisits the same nodes while it closes
alias chains, and each visit re-derived results that cannot change within the
phase:
- resolveSemanticBindingState re-walked the scope chain for the same identifier
node. Definition collection completes before this phase, and addBinding is
reachable only from it, so a scope's bindings no longer change.
- directInitializerPosition, directMutationPosition and
referenceInitializerPosition are pure functions of a node and the analysis
parent map, but were recomputed for every mutation and initializer.
- markValue re-encoded the same capture tuple with JSON.stringify and built a
fresh long key for every Set/Map lookup, so each lookup re-hashed the whole
key. The capture key is now cached per binding, origin and owner, and the
lifetime key is derived from it.
On pdfjs-dist 5.3.93 wasm/openjpeg_nowasm_fallback.js (462316 bytes, sha256
53c228428a8861035a34738966af263fc9d4cee6df25a0ad942af947469a0bd9) the semantic
phase takes 177.8 s instead of 272.9 s in-process, with a byte-identical
semantic IR. With --max-heap-mb 3072 and the default heap the base revision
exhausts the worker; with the default 300 s per-source deadline raised, the
completed CLI run takes 240.6 s instead of 396.7 s and its output is identical
apart from volatile identifiers.
Refs #2498
Co-authored-by: gongfpp <22683417+gongfpp@users.noreply.github.com>
