reverse-engineering-anything/docs/verification/javascript-route-inventory-2026-10-21.md

# Static JavaScript route inventory verification

Issue [#4772](https://github.com/morluto/rea/issues/4772). Qualified runtime
`b49ee40bf330b7bf1c5180b14dcc104c1c613a8e`, tree `0e5f8fe2feae1796c340c07c26e0e28e5d4328d8`,
integrates main `c8ed32853881b08aa83459d4da55a28a4e09b0c8`. Recorded at
`2026-10-22T08:30:58.269Z`. Subsequent verification-only
commits updated these reports. The [archived JSON record](https://github.com/morluto/rea/blob/7d0efef62d56d0a10134bea62d709302daa1565f/docs/verification/javascript-route-inventory-2026-10-21.json)
pins original inputs, exact commands, profiles, failed controls and historical revisions.
Current-head GitHub CI and automated review must be checked separately.

The full JSON archive is 2,681,223 bytes, with SHA-256
`9d7ea2582a6f33ff0741578aec9f01b9327b3256ce50c582437164868e544d51`. It remains available in Git
at the linked immutable revision; this page retains the historical summary.

The latest main contracts, selected environment and ASAR admission remain shared
by CLI and MCP. The staged-code hook runs lint fixes before formatting, resolving the
producing order behind the earlier CI format failure.

## Current implementation and executed checks

Shared source analysis produces stable route, occurrence, source and gap facts.
CLI and MCP use the same retained Evidence views, with filtering, selected fields,
batch identities and pagination; complete source Evidence remains accessible.
Coverage and explicit unknowns survive compact delivery and source deletion.
Selected CLI delivery requires a complete Evidence export; MCP retention is
checked before analysis. Immutable snapshots use weak identity caching with
parent identity checks; live target state is not cached.

Route scanning reuses semantic bindings, mutation, literal-field, reference and
truthiness owners. Navigation data ownership excludes query/search/hash values,
callee/projection/predicate edges and definitely inactive branches while keeping
independent lexical routes. Registration patterns preserve optional syntax and
initializer ranges. Unrecognized array/string methods do not become navigation.
Rest-copy exclusions, unresolved projections, mutations and cycles retain their
appropriate independent facts or unknowns. Next page classification shares one
owner, including private folders, encoded public underscores and unresolved
interception context. Source ranges use one-based lines, zero-based UTF-16
columns and exclusive ends.

Source/fact and inventory budgets are 8 MiB; optional facts fit the actual
remaining combined-result budget. Selected pages include the sealing digest
within their 1 MiB bound. Cancellation preserves earlier facts and Evidence;
worker cleanup and capacity failures retain typed outcomes.

The current integration uses main's canonical Evidence publication/cleanup owner
and deferred MCP runtime/catalog. CLI delivery explicitly produces JsonValue and
projects the two publication receipt scalars without cloning complete Evidence.
The canonical web-bundle state and coordinate owners replace duplicate types.
The coordinator parser-import boundary remains covered.

**3847 source checks and 116 compiled public checks passed**,
including 245 scanner regressions, actual full/compact SDK profiles, both JSON
Schema dialects, source selection/deletion, retained reads, cancellation,
recovery, real workers and CLI/browser adapters. The current public selection additionally covers ASAR admission, selected
environment, CLI resource closing and Electron file scope; earlier startup/
publication checks remain pinned to their recorded runtime.
Selected-path identity runs separately with its original 30-second deadline.
Typecheck/lint passed; documentation checks are recorded in JSON after generation.
The main-baseline service-worker deadline correction [#6186](https://github.com/morluto/rea/pull/6186)
is included; it retains the original stalled-handshake assertions and test guard.

A valid review case exposed overwritten query fields hiding independent route
initializers: seven corrected regressions failed before the fix, while182 tests
passed, including four new effective/uncertain-data controls. Ownership now
consults the existing cached effective-field reader. A known final slot or method
excludes discarded references; unknown spreads/computed keys remain conservative.
Full/compact SDK reads after source deletion and both browser adapters retain
the independent route. The public SDK assertion requires the exact expected count
and every expected path. The record preserves failed validation and a corrected
initial test-harness field name; no invalid harness failure is counted as a bug.

A second review case exposed selected member query data becoming page routes.
Six direct/computed/optional, alias, nested and array-member cases failed while 189
controls passed. The existing static member-chain helper now lives in the shared
AST owner; both require consumers use it and its old export is removed. Optional
admission checks charge each path step before retention. Navigation source
selection reuses canonical possible-value sources at each read and one selected-slot
walk shared with copied initializers, without claiming whole receivers or callee
namespaces. Current full/compact retained SDK queries and both browser adapters
exclude the selected query object while preserving its independent sibling.

A previous runtime's public batch hit two original 30-second schema deadlines.
That failed attempt, successful isolated rerun and their combined resource cost
remain pinned in JSON. Current execution runs schema validity alone, 18 other
suites together and selected-path identity alone, retaining original assertions
and deadlines.

Five prototype/own-property cases failed before the latest fix while 198 passed.
The field owner now reuses the existing AST prototype-setter predicate. Setters
retain unresolved inheritance but cannot overwrite computed/shorthand own keys;
setter data references are not discarded as own-key writes. Direct, member and
destructured query selection share this owner. Full/compact historical SDK reads
and both browser adapters exclude the prototype-shaped query payload.
The runtime retains main's integer-schema allocation optimization and integrates
the latest main contracts, shared keyed ordering and retained-parent parser. The
only merge conflict was the analysis-view description: the complete upstream
text plus the exact route-view sentence were retained. Current catalog changes
and fresh client/schema checks are recorded separately in JSON.

A later review found that lifetime identity eligibility retained fields proved
replaced before a query read. Eight cases failed while 206 controls passed. Both
member reads and direct identifiers now use canonical value-flow sources or
binding snapshots for their read site. Unknown order keeps possible sources;
known replacements exclude stale ones. Binding-once deduplication is removed
because separate reads may select different values; syntax-cycle and resource
bounds remain. Both SDK profiles after deletion and both browser adapters preserve
the independent route through member and direct-variable replacements, while
actual replacement payloads and earlier/possible query data remain excluded.

A further review reproduced four failures through conditional aliases, unknown
array members and nested receiver aliases, while 215 controls passed. The shared
mutation producer now distinguishes proved receiver identity from possible
aliasing. Canonical read-time selection requires both identity and ordering
before discarding original values or superseded prefixes. Deferred reference
paths retain this proof and assigned-value provenance; deduplication includes
certainty. Direct writes through the read's own alias still prove replacement.
Both public SDK profiles after deletion and both browser adapters cover a
distinct uncertain-alias payload without claiming the entire receiver.

CI also caught our integration regression in the unrelated Dart ABI advertisement:
lint removed a slash escape, making the pattern invalid in JavaScript `v` mode.
The ABI schema now encodes the slash as a hex code point, consistent with existing
portable patterns and stable under lint fixes. The original advertised-pattern
client test is included in this qualification. The prior inference that escaped
and unescaped character classes were equivalent across clients is withdrawn;
no Dart-provider execution is claimed. The interrupted superseded local run and
failed CI are retained in the JSON record.

Two later review cases reproduced eleven failures while 222 controls passed:
possible query fields cleared by spreads became pages, and selected member
configurations claimed unrelated siblings. The selected-slot walk now uses the
canonical possible object/array reference owners; exact fields still prove
positive destinations. Configuration ownership preserves member and copied
initializer paths through the same walk. Conditional-container selection reuses
existing value-edge/truthiness rules. Normal paths advance offsets; exceptional
path expansion is charged before allocation and node/path visits bound cycles.

This also exposed a canonical computed-key overwrite defect: an independent
semantic-analysis regression failed with unknown coverage before the owner fix
and retains its original literal afterward. Earlier unknown computed values are
excluded by later definite slots; a getter paired with only a later setter stays
possible. Accessor and conditional-container controls pass. Both SDK profiles
after source deletion and both browser adapters exclude a distinct possible-query
payload and preserve the selected configuration's independent sibling with exact
counts. Unsupported projected configurations keep explicit gaps. Actual SDK
tool definitions remain structurally identical to the preceding qualified runtime.

The next review reproduced two growing getter projections exhausting the 8 MiB
route budget and hiding an independent route. An existing direct reader golden
also retained overwritten computed-key alternatives; the earlier selected test
matrix had omitted that producer suite. Three cases failed and 241 controls
passed, including a finite repeated-getter control. The source-order expectations
now match the shared owner's definite overwrite rule.

A subsequent review showed that suffix lengths are insufficient recursion proof:
two finite getter chains were marked cyclic, leaking query data as page routes;
243 controls passed. That inference is withdrawn. Selected-value traversal now
uses value/lookup/finish frames: evaluate each canonical returned-reference path,
clear its unfinished receiver/key, then resume the caller's member path. Scoped
visited maps preserve independent result sinks. The suffix-length heuristic and
suffix concatenation have been removed. Three finite/nested cases pass alongside
genuine direct/mutual recursive getters and finite repeated selections. Both
retained SDK profiles after deletion and both browser adapters exclude distinct
finite-getter query payloads while retaining exact independent routes and actual
cyclic gaps.
Current source qualification covers **all 133 JavaScript domain suites plus eight
related suites**. It ran on the exact staged source tree; commit hooks left that
tree identical, so its source tests were not needlessly repeated after commit.
New build-dependent public and real-artifact workflows ran on the frozen runtime.

## Real production inputs and oracle

Every one of the 67 saved production scripts was rehashed and freshly analyzed
through production isolated workers, with one semantic projection node, 512 MiB
worker old-space and the existing 15-second source deadline. Application sources
were read as data. No source facts were reused for this qualification.

| Homepage capture | Scripts |     Bytes | Completed | Route checkpoints | Rooted patterns |
| ---------------- | ------: | --------: | --------: | ----------------: | --------------: |
| nextjs-org       |      29 | 1,533,098 |        28 |                28 |               0 |
| shadcn-ui        |      38 | 2,465,078 |        36 |                37 |              18 |

The full task cost **207.348 s / 313.817 CPU s / 502,669,312 bytes peak family RSS**. The previous pinned runtime `972c5ad86` full-worker run
took 277.184 s/409.684 CPU s. These are individual observations, not a timing
distribution. Earlier paired source elapsed observations
remain pinned to their measured revisions in JSON. There is no controlled causal ablation or repeated timing
study, so neither the source correction nor the main integration is assigned
a performance cause. Configured deadlines and partial/unavailable
facts are explicit. Zero supported rooted Next patterns does not establish zero
application routes. Lazy/server-only code, reachability and the full application
route denominator remain unknown.

Independent direct-byte inspection of the
[86,218-byte shadcn production chunk](https://ui.shadcn.com/_next/static/immutable/chunks/0ftd4gqztonqp.js)
finds exactly 18 quoted `/docs` patterns, including 12 direct href properties.
SHA-256: `45c6ead1e08cc578464e7a0c6b2e6764d7af83f99039e291f288a971b988b3fc`.
Every fresh SDK and browser verifier requires the entire sorted 18-pattern oracle,
original source identity, provenance and complete retained Evidence.

An owned Chromium 156.0.8078.4 compiled this source via
Runtime.compileScript/persistScript on a blank local page without running it.
Actual CLI and official SDK analyze_web_bundle calls passively captured it via
CDP and returned all 18 patterns, original URL and SHA-256. Source parsing was
complete, enumeration partial and application coverage unknown. Owned process
and temporary-profile cleanup succeeded. Cost: **10.379 s / 13.481 CPU s / 2,091,114,496 bytes peak family RSS**.

## Equivalent SDK task costs

Both fresh sessions list `/docs` patterns with confidence, mechanism and source
provenance, preserve complete Evidence, perform three retained follow-up reads
and export Evidence. They assert the same complete parent Evidence identity.
Measurements include the instrumentation and use full input advertisements.

| Delivery | Used declarations + all calls/replies, tokenx | Entire catalog + all calls/replies, tokenx | Task resources                                                |
| -------- | --------------------------------------------: | -----------------------------------------: | ------------------------------------------------------------- |
| Complete |                                     1,934,534 |                                  3,035,567 | 13.785 s / 18.104 CPU s / 1,356,595,200 bytes peak family RSS |
| Selected |                                        58,902 |                                  1,159,935 | 12.243 s / 15.909 CPU s / 1,303,572,480 bytes peak family RSS |

Tokenx counts actual advertised schemas, arguments and full SDK replies, including
exports and follow-ups; it estimates tokens rather than actual model usage.
Initialization, JSON-RPC envelopes and separate token-count instrumentation costs
remain unmeasured. Processes/sessions are fresh with warm OS caches; there is no
filesystem-cache flush, repeated statistical timing study or claim of stable
latency/analysis speedup. Default compact-advertisement costs are not measured.
CPU is payload process-family wait-rusage delta and RSS samples all descendant
tasks every 20 ms. Heavy tasks run sequentially on two CPUs with an 8 GiB family
RSS/420-second guard. No qualification guard fired.

The JSON preserves prior failures, source-owner corrections and their exact
before/after revisions. Historical CI/review does not establish the current head.
Private issue samples, complete application routes, live route execution,
external cloud clients and Windows/macOS provider execution remain unverified.