* fix(reference): retain proven loader calls and unresolved targets
* refactor(reference): remove unused ancestor lookup
* fix(reference): drop loader calls that return a reassigned member
An immediate call could still use a member's original require initializer
because mutation facts were not built for a call-valued callee. A definite
assignment that precedes the call now replaces that initializer.
* fix(reference): select returned loaders from indexed read facts
* fix(reference): refresh loader facts for wrapped returned members
A sequence such as (0, box.load) still used the original require
initializer. Follow sequence, conditional, and logical returns to the
member before deciding whether a prior assignment replaced it.
* test(reference): record unresolved CommonJS targets in source evidence
unknown.cjs calls require with a non-literal target. The inventory now
keeps that coverage limitation on the file entry, and the boundary
fixture asserts it beside the resolved member relationships.
* fix(reference): cover opaque apply lists and assigned returned members
require.apply(null, args) has no normalized argument list, so the
inventory now records an unresolved target instead of complete coverage.
An assignment return such as f = box.load is followed to the member
before a prior replacement is trusted.
* fix(reference): keep self-defaulted module delegates loadable
Timing a member read at a later call made `box.load = box.load || null` observe its own write and drop the native delegate. Reads that already fed an earlier assignment stay at the member.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Share parser-owned package and runtime facts across dependency consumers.
Preserve uncertain loader requests and explicit wrapper bindings without
inventing unbound require authority in known modules. Cover selected source
grammar through the public MCP boundary and retain ambient/type dependencies.
Open each selected directory before loading its scoped policy, retaining
partial directory failures and cleanup ownership. Preserve explicit caller
negation precedence and source diagnostics across inventory projections.
Clarify how version comparison retains container provenance without claiming
semantic drift. Use independent unknown source inputs to keep candidate-limit
fixtures meaningful as conditional branch evaluation becomes more precise.
Fixes#6891Fixes#6882Fixes#6883Fixes#6859
* fix(source): retain CommonJS requires spelled as exact no-substitution templates
Admit expression-free template arguments at the CommonJS require gate and
read their single cooked quasi through the shared exact-literal reader.
Scope is the require path only: static ESM template declarations keep their
parse failures and dynamic import() keeps the explicit unknown/partial
<dynamic-import> relationship with no invented target.
Refs: #4382
* fix(source): admit TypeScript-wrapped exact require arguments via the shared literal reader
Address review: the require gate matched the outer AST node, so
runtime-transparent TS wrappers (as const, !, satisfies) around exact
strings or expression-free templates were still silently omitted even
though readExactJavaScriptLiteral unwraps them. Remove the gate and let
the shared exact-literal reader own argument exactness; computed
arguments remain silent and dynamic import() behavior is unchanged.
Refs: #4382
---------
Co-authored-by: Hemang Varshney <218273197+hemv-857@users.noreply.github.com>
Require a caller-owned artifact resource scope for source traversal and Git metadata reads. Preserve cancellation, filesystem reasons, partial entries and bytes, and cleanup observations through import and the CLI. Transfer exact failed file owners at regular-file admission and close boundaries, including multiple failures encountered by Git reference resolution.
Validation: 169 focused tests passed across 26 files; two Windows-only cases skipped. Build, typecheck, lint, formatting, knip, architecture guards, discovery and docs checks passed.
BREAKING CHANGE: Reference source readers and imports require an ArtifactResourceScope. VCS metadata reads return Result, and CLI import failures include observed details and partial evidence.
Share parser modes and collision-free composite keys, enforce architecture guards, and consolidate redundant unit assertions into filesystem, CLI, MCP, and producer-backed workflows. Preserve concurrent upstream boundary fixes and exclude legacy Objective-C class-name bookkeeping labels.
Validation: source/composition suites (3358 passing), focused canonical digest and MCP checks, typecheck/lint, Knip, formatting, architecture guards, and real Foundation archive and Apple legacy simulator CLI/MCP verification. No real Hopper, Ghidra, or IDA verification claim.
