morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

JavaScript analysis: correctness, performance and capability completion #1600

New issue

Open

opened 2026-10-16 21:07:46 +00:00 by bsakaguchi · 5 comments

bsakaguchi commented

2026-10-16 21:07:46 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 15, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4027

Originally assigned to: @N0zoM1z0 on GitHub.

Outcome

Track a bounded, evidence-backed improvement programme for browser, Electron and JavaScript analysis: trustworthy results and ownership first, useful answers at reasonable agent/analysis cost, then narrowly scoped capability additions.

Area: Evidence, artifacts, reconstruction and MCP/agent integration. Target interaction: reading selected local artifacts/captures; existing browser/Electron launch or attach workflows and their declared instrumentation. This tracker performs no target mutation and does not grant new runtime authority. Unverified target/platform/provider coverage is identified below.

This consolidates execution across #39, #774, #64, #375 and the MCP cost roadmap #1065; it does not replace their history or imply their already-shipped capabilities are missing. Existing source selection, retained Evidence, summary/module views, captured-script export, source-map tracing, runtime reconciliation, offline captures and Wakaru recovery should be reused.

Research baseline: 2026-10-15, main 6fcfc5b5e0c063300cd5278dd8bad5b1ab1374f6. Paginated snapshot: 566 open issues / 334 open PRs; inspected relevant source owners, issue bodies, recent merges, and detailed status/comments for 18 PRs plus review threads for 14. A pre-publication refresh found 336 open PRs; all PR bodies were cross-referenced, including proposals whose titles do not mention JavaScript. Counts and PR states below are time-sensitive. Source-derived items and other contributors' reports are not claimed as reproductions by this investigation.

Independently executed evidence

Linux x64, AMD EPYC 7B12, Node 24.18.0, npm 11.16.0, locked dependencies and built checkout:

Real Chrome for Testing 156.0.8078.4: npm run verify:browser and npm run verify:browser:runtime passed, including public CLI/stdio MCP, network content/redirect/same-URL association, script export, module identity, large screenshot recovery, popup, scenario environment/storage/service-worker and owned cleanup checks. This does not prove every browser report is fixed or establish Windows/macOS/Electron compatibility.
#3986 / #3987 reproduced through real Chrome + CLI and stdio MCP. An inert served script containing registerTool({ name: "catalog", [``]: 0 }) loses the known name; quoted empty keys retain it. A literal input schema property "" disappears while its ordinary sibling remains. Source-derived root cause: the old string-returning key helper conflates an unknown key with a legal empty key, and two consumers either guess from AST kind or filter by truthiness. Reuse semanticStaticPropertyKey's string | null facts at the producing boundary and remove the workaround. Preserve dynamic/spread/overwrite uncertainty and untrusted declaration status.
#3878 reproduced with real Chrome: the selected page URL contains a fragment, while bundle capture.target_url drops it.
#3924 reproduced through real stdio MCP: a relative JavaScript application input is accepted despite the absolute-path contract.
Public shipped pdf.js sample: pdfjs-dist@5.3.93, wasm/openjpeg_nowasm_fallback.js, 462,316 bytes, SHA-256 53c228428a8861035a34738966af263fc9d4cee6df25a0ad942af947469a0bd9 (same bytes as #2498). The default public CLI request timed out after 303.36 s, with provider_timeout and retained partial Evidence; wait-accounted CPU 338.86 s, sampled peak process-family RSS 1.11 GiB. This is an observed failed task, not a completed-analysis benchmark or a cross-host regression comparison. Some independent probes overlapped this run.
Answer-cost calibration: select only lib/asar.js from shipped @electron/asar@4.2.0 (12,755 source bytes; complete 35-file inventory, 34 sources explicitly unselected). Full structured Evidence: 2,525,533 bytes / 921,355 cl100k_base tokens. The same retained parent summary: 11,134 bytes / 2,319 tokens; a five-module page: 9,257 bytes / 1,991 tokens. detail: "summary" returns that summary while retaining the same parent Evidence identity. These are BPE counts of serialized values, not model billing or reasoning-token measurements. Summary changes delivery; it does not avoid the initial analysis. Counting the two selected input contracts, requests and follow-ups, the structured full-answer workflow costs 929,063 BPE tokens, versus 12,102 for summary + a module page (98.7% lower under this defined projection). This is a delivery comparison on identical code, not a code-change speedup.
Discovery cost: default tools/list has 207 tools. Its name/description/input-schema projection measures 195,136 cl100k_base tokens; the two contracts used for analysis + views measure 7,667. Full wire catalog including output schemas is larger; actual host projection is unmeasured. Include catalog, requests, follow-ups and retries when comparing whole tasks.

For the completed ASAR task, two fresh CLI processes returned byte-identical Evidence: 3.19 / 3.45 s elapsed, 4.74 / 5.16 s wait-accounted CPU, 472 / 464 MiB sampled peak process-family RSS. In one MCP session, first full delivery took 8.16 s, equivalent repeated full delivery 2.00 s, retained summary 76.6 ms, and module page 8.4 ms. Built artifacts and the filesystem were warm; some probes overlapped on this shared host. RSS was sampled every 50 ms, may miss brief peaks and counts shared pages per process. MCP harness resource totals also include BPE counting, so they are not attributed solely to REA. No optimized before/after implementation or hosted-model run was performed.

Prioritized work, existing owners and dependencies

Unchecked means work remains or exact-current-main proof is still needed. Reuse the linked issue/PR; do not open duplicate bug reports or merge overlapping fixes independently.

Priority	Work and acceptance boundary	Existing work
P0	Electron containment and owned runtime admission: block/record existing OS-effect attempts, preserve selected environment inputs, verify all packaged-launch prerequisites and cleanup	#3452 → overlapping PRs #3466/#3471; #3474 → #3559; #3414 → #3544; Windows packaged app blockers #2974
P1	Bound semantic growth before allocation, preserve useful static facts and truthful omitted/frontier coverage; profile completed real bundles before choosing new budgets	getter expansion #3839 → #3848; wasm2js traversal #2498 → #2891; large-source omission #3670 → #3852; parent/projection accounting #3671, #3538 → #3545/#3550; broad admission work #2092/#2097
P1	Correct identities and uncertainty across traces/comparisons	#3879 → #4014; dropped WebMCP #3989; fragment identity #3878; destroyed-context attribution #3382 → #3823; late frames #3910; window action identity #3936; missing ASAR add-on digest #3926; native-addon timeout scope #3948; mapped-file digest contradiction #3316
P1	Normalize exact AST facts once; preserve equivalent syntax, capture lifetimes, receiver identity and unknown alternatives	empty keys #3986/#3987; schema keywords #3331 → #3765; string allocation #3933; nonfinite defaults #3861 / timers #3400 → #3464/#3456; callback capture #3880/#3881; module-table writes #3883; optional/local native require #3884/#3885; factory fallthrough #3963; fingerprint semantics #3952 → #4020
P1	Bundler, package and source-map correctness with exact source/path provenance	renamed factory exports #3551 → #3552; esbuild shim #3535 → #3596; false preload joins #3962 → #3996; Vite table/spread indexes #3907 → focused #4023 and broader #1840; TypeScript erased imports #3932 and source media types #3945; directive-prologue WASM glue literals #4001; directory map candidates #3909 and HTML file/directory intent #3882; reference-source resolution #3895 → #4017, #3896 → #3973, #3915/#3916 and replaced require #3982; path policy #829 with explicit migration decision
P1	Honest browser completeness, bounded windows and reusable external targets	Windows cancellation #3816 → #4010; scenario/passive timer overflow #3392/#3929 → #3515 (scenario portion); locale #3395; screenshot navigation #3941 and PNG validity #3928; malformed worker/AX inventories #3378/#3376 → #3513/#3850; incomplete AX #3385 → #3824; omission accounting #3957; discarded credential budget #3959 → #3994
P1	Agent-facing contract fixes and efficient discovery/delivery; preserve complete retained Evidence and caller choice	relative inputs #3924; worker/filesystem effects #3867; offline HAR availability #3947; Electron diagnostics #3865; tool families #3246 → #3026; compact schemas #2813 → #2905; valid screenshot example #3938 → #3995; ordered CLI sessions #2927 → #3028; paged handoffs #2701. Evaluate full vs selected/summary workflows and actual client schemas
P2	Complete conservative static Electron and Node effect recovery after the above owners stabilize	BrowserWindow constants/open-handler overrides #3536; wrapper/bootstrap work #2094/#2948; protocol registrations #2978; filesystem writes/synchronous child effects #3431 → #3433 (child slice only); replaced globals/handles/receivers #3367/#3362/#3360/#3358 → #3849/#3819/#3857/#3794
P2	Useful browser-to-code and API questions through existing tools, with compact inline answers and provenance	exact DOM-node reuse #2289; worker/service-worker ownership #883 → #2068; wrapper endpoint candidates #3539; static vs recorded API surfaces #3591; historical API comparison #2914; value-free SSE/NDJSON #3593; selected header/cookie-name facets #3592 → #3622 (Part A only; not the related API comparison features); SAZ/mitmproxy surfaces #2857/#2915 → #2884; screenshot regions #2988
P3 / design	Keep optional new engines and adjacent runtimes narrow until scope, authority and real-provider proof are resolved	jsbeautify #2093; js-redox #1815; IPC effect prototype #3742; passive iframe #3759; Cordova/Capacitor #3518; Tauri #3686; CEF #3685; React/RSC/Hermes #3608; WebGPU #3727; game-specific #3650/#3647

Integration holds observed in existing work

PR titles, ready status and green checks are insufficient. Snapshot findings include unresolved widening correctness in #3848, missing representative completed before/after measurement in #2891, eight unresolved threads in #2092, historical unknown-count and destructuring-projection blockers in #3852/#3596, and test integration/proof gaps in the overlapping move-to-Applications PRs. #2097/#2068 have failed checks at their inspected heads; this audit has not attributed their causes. #2093 lacks inspected real-engine proof and has unresolved threads; #1815 has unresolved findings and attributed reports of provider/firmware failures. #3742 explicitly awaits maintainer scope review. Reconcile exact current heads and required checks before integration.

Performance and code-quality contract for each slice

Start from fresh origin/main, use a separate branch/worktree for one issue or one inseparable producing-boundary fix, and link the existing issue plus this tracker.
Fix representation/ownership at its producer and update all directly affected consumers; remove superseded reparsing and wrappers. Preserve observed/derived/inferred/unknown distinctions, source bytes/digests, caller choices and partial Evidence. Use tagged expected failures and Result.
Select sources before analysis; return summaries or focused pages where sufficient and retain full Evidence. Avoid an extra lookup merely to discover provenance. Evaluate actual converted schemas, intended clients, request/response sizes and failures.
Measure equivalent completed tasks before/after: answer/schema/request/follow-up BPE tokens (label tokenizer and unmeasured model costs), elapsed time, CPU, sampled peak process-family memory, retained facts and coverage. Separate first-process and warm-session runs; do not describe a warm build or filesystem as OS-cold. Failed/time-limited cases are separate robustness observations.
Optimize measured repeated work first. Existing AST indexes and semantic caches already exist. Prefer query-owned memoization; a persistent static cache needs exact source digest, analyzer/parser/schema versions, module-resolution/package/source-map context, options and completeness/resource policy, with bounded eviction, invalidation and cancellation. Never cache live browser state by URL and report it as fresh.
Prefer public CLI/MCP + real source/producer verification; retain distinct malformed, cancellation, cleanup, permission, identity, capacity and uncertainty regressions. Synthetic fixtures complement shipped applications. Claims for Windows/macOS, Electron, Wakaru or other engines require their actual lanes; otherwise state NOT_ENOUGH_INFO with the missing evidence.
Keep each PR current, run CI/review on its final head, fix findings attributable to that change, and merge before starting the next implementation. New runtime/injection/mutation/protection-recovery capabilities still need the final scoped maintainer decision; routine fixes within existing authority can proceed.

Proposed execution order and completion

Complete the initial backlog/source audit and reproducible evidence/measurement ledger. Refresh the backlog against latest main before each implementation slice.
Land one structural empty-key fix for #3986/#3987, with public CLI/MCP real-Chrome regressions and unknown-key/overwrite controls; coordinate with #3765's separate schema-keyword fix.
Fix incorrect agent contracts (#3924/#3867/#3947/#3865), then source/window/digest identity and incomplete-comparison cases without duplicate downstream repairs.
Reconcile and verify containment/lifecycle fixes before extending owned Electron runtime behavior.
Address semantic expansion and admission as separate measured changes; require an equivalent completed pdf.js task and representative Electron bundles, not only microbenchmarks or successful timeout handling.
Integrate useful retained/discovery/batch and worker/static recovery work after its actual blockers are resolved; then add the P2 analyst workflows one at a time.
Close only after linked selected slices have landed with documented correctness, resource, CLI/MCP and real-provider evidence; explicitly defer unresolved P3 proposals rather than treating them as approved integration.

Primary upstream references for candidate design: Electron fuses, CDP target lifecycle, Node ESM URL identity, ECMA-426 source maps, Wakaru multi-chunk recovery. These constrain design; their documentation does not establish REA compatibility or authorize new target effects.

Current implementation progress (2026-10-15)

Decision #4091 defers production code mode. #4063 is closed as not planned while its experimental branch/results remain preserved; #4082 stays closed without merging. Prioritize composable identities/facts, selected data, explicit source coverage and shared CLI/MCP ownership.

Landed slice	Result and validation
#4092 → #4097 (`ec394a2bdfbc1474851f4849611d6d308d8e60a0`)	Typed, filtered retained module-reference facts. Real Obsidian: identical 23 selected facts and exact CLI/MCP Evidence identity; 24 → 1 calls, selected-schema task BPE 85,302 → 16,548. 112 initial focused tests plus 32/32 expanded domain tests; final 42 CI checks passed. Three review findings fixed, verified and resolved; final automated reviews had no new findings.
#3867 → #4121 (`e9a71efa31d6c3675b67938b8a79fa4ddf01604c`)	Canonical JavaScript analysis effects now declare the existing owned worker and temporary source writes; actual catalog/session metadata agree. 27 focused tests, full static/docs checks and final 40 CI checks passed; both automated reviews had no findings. Real Obsidian before/after retained identical parent/view/facts and exact CLI/MCP parity.
#3933 → #4140 (`9f8659e0536e4e50a438f5b9d5661f3c9624f6ac`)	Exact literals/defaults use the primitive owner; projection keeps limits and per-analysis coverage records encountered bounds. Complete endpoint lookup identities and aggregate wire capacity preserved. 67 distinct focused cases across documented invocations, 932 semantic tests on the restored identical runtime, full static/docs and real Obsidian controls. Final 18 CI checks successful/15 lanes skipped; merged source/built report 15,614 passed/139 skipped. Both final reviews had no new findings.
#3926 → #4179 (`c7f6b8bad1a34d5efb30ff2a017672dea1fcdabb`)	Native handoffs consume canonical byte identity; unavailable companions keep path/provenance/partial facts without archive-digest links. 58 distinct focused cases across documented invocations, final static/docs and real Joplin available/missing controls with exact CLI/MCP parity. All40 final CI checks passed; both automated reviews completed without findings. Available-case Evidence/facts and token costs unchanged; timing variability unresolved, no performance-equivalence claim.
#3948 → #4207 (`85eac7b92bac39bf2da6c00ebf6ba1b11b4c8d1f`)	File processing preserves applicable operation/authority and interrupted/not-started status; shared semantic projection excludes non-JavaScript modules in both builders.78 distinct focused cases across10files, final static/docs and strict real Joplin timeout/default controls with exact CLI/MCP parity. Final38 CI checks passed plus one superseded title cancellation; both automated reviews completed without new findings after two valid fixes. All failed attempts/outliers/source versions preserved; no speedup claim.
#4190 → #4265 (`d9d085a15e17bce525a316a48c7e3eeae1f60423`)	Exact retained metadata/native observations by batched original Evidence paths/kinds, selected properties, optional field names and paging; shared coverage owner. 114 focused cases across documented invocations / 7 files, 106 Python cases, 18 versioned real Joplin workflows and 9 full CLI/MCP view parity controls. All 41 final checks succeeded after one Windows deadline retry; both reviews clear. Source 16 hashes/whole tracked tree/coauthor verified; #4190 closed. Normal 12 rows unchanged, current semantic unknowns 41161→41162; timeout 11-row complete answer unchanged. Negative context/cost outcomes retained.

Reproduction scripts/code, executed source hashes, failed/prior attempts and compact measurements are in module-reference verification and effect-metadata verification. The former's complete final verifier used 35.797 s wall / 35.197 s CPU / 1,938,313,216 B peak cgroup memory. The latter's real before/after workflow used 30.470/31.059 s wall, 29.940/30.663 s CPU and 1,551,282,176/1,584,574,464 B peak. One CPU / 8 GiB, cleanup verified and no OOM. Memory includes file cache. Static BPE uses declared catalog projections, not hosted-model billing. Serial legacy reads, unmeasured optimized concurrency/host rendering and uncontrolled caches prevent portable or whole-agent performance claims. Downloadable applications and large Evidence are not archived.

Overlap record: draft #4106 duplicates the now-landed #4092 schema; do not integrate it independently. Last-inspected #4040 covers #3986/#3987 and other fidelity issues; #3924/#3865 have another contributor working. Revalidate exact current heads before starting overlapping work.

Third-slice reproduction and compact measurements: literal byte-budget verification. Real Obsidian final control preserved parent/view Evidence, 23 facts, coverage/unknowns, CLI/MCP parity and BPE costs: 32.949 s wall / 32.559187 s CPU / 1,880,096,768 B peak, one CPU/8 GiB, no OOM and verified cleanup. No speedup or equivalence bound is claimed.

Review/CI lesson: an attempted primitive-byte policy for endpoint identities broke existing full lookup/trace behavior. It was reverted; the original large endpoint remains and the same string is now also tested as a bounded primitive. Rejected attempts and the actual CI failure remain in the verification record.

Fourth-slice verification: native handoff identity. Merged source hashes and required co-author verified; #3926 closed. Real Joplin available/missing final verifier receipts: 258.885/59.738 s wall, 106.221003/59.254776 s CPU, 2,678,456,320/2,571,235,328 B peak cgroup memory; no OOM and verified cleanup under one CPU/8 GiB. Earlier controls/failed attempts are preserved; no native provider/application execution is claimed.

Fifth-slice verification: interruption applicability. Merged source hashes(all16) and required co-author verified; #3948 closed. Final real Joplin timeout60.443s wall/59.970344s CPU/3,078,295,552B peak and default63.574s/63.177884s/3,189,719,040B preserve exact CLI/MCP parity and earlier analytical facts/Evidence/BPE. Final full static/docs117.636s/117.194118s/4,263,153,664B plus5 consistency tests. OneCPU/8GiB, clean owned exit/noOOM; all earlier attempts/outliers retained and no speedup/equivalence claim. Native Evidence simulated; target/native providers not executed. Alternate full-builder path has actual filesystem-boundary coverage rather than a separately measured real-app workflow. Final head40e0ce42a:38 successful checks, one obsolete title execution superseded/cancelled, aggregate CI required and current title passed; Codex exact-head summary has no findings and Greptile final review reports no blocking issue. Both valid threads structurally fixed/tested/resolved. #3852 remains separate work.

New scoped follow-up #4190 requests exact retained application metadata/native facts. A real Joplin package.json outgoing trace completed but exceeded10MiB reply admission twice, with identical parent/trace IDs; complete export remains available. The issue records reproducible inputs, current JS-only reference-view scope, provenance/coverage/batch-selection acceptance and whole-task measurement requirements. #4190 is now completed by #4265; see the sixth-slice verification below. Refreshed388openPR bodies show no competing #4190 implementation; browser scenario views #4163 and module refs #4106 have different/previously landed scope.

Sixth-slice verification: retained application facts. Main #4274 was integrated and independently reverified before merge. Latest normal retrieval 4.241 s export/projection versus 0.153 s view, but selected structured BPE 8,947 versus17,421; no universal speed/token claim. Parent/coverage disclose semantic unknown count 41,161→41,162 while all 12 original observations/per-row Evidence remain equal. Interrupted 11-row full answers remain identical. All local runs stayed within one CPU / 8 GiB with no OOM and verified cleanup; the largest new gate peaked 5,169,971,200 B including file cache. Failed local deadlines and the SDK 2.3.1 eager entire-output-catalog compilation diagnostic are retained alongside the unchanged test passing on an available CPU. Original 14 manual workflows and 8 agent attempts were checked unchanged before adding four new controls. No downloadable apps, raw large Evidence/transcripts or profiles are archived. #4265 merged with 41 successful status checks / 36 CI jobs, both exact-head automated reviews clear, and all review threads resolved; the first Windows 15 s timeout and unchanged-source retry remain visible in CI history. All 16 merged authored hashes plus whole tracked tree equality and required coauthor verified. Next implementation will start from freshly fetched main after checking overlap; #3936 is the current read-ahead candidate, not yet implemented.

Seventh slice: constant window options (#4366)

Merged #4400, closing #4366. #3536 remains open for popup overrides and optional spreads. #3936 is already covered by draft #4332; a source-only ordering/identity review was posted there instead of duplicating implementation.

Real official Joplin 3.7.21 ASAR, unchanged input and constructor identity: zero→five explicit preferences (four booleans and dynamic session). Const associations retain source ranges and inferred Evidence; CLI/MCP complete view Evidence matches. Full semantic content matches after excluding only the parent application-graph commitment and its derived graph ID; raw hashes remain recorded. Two original trial orders show projected structured-task BPE 13,337→13,432 (+95), with no speedup claim: reversed pair 42.958s main vs44.793s candidate. Latest shared-query follow-up 44.607s/43.883417s CPU/1,666,560,000B cgroup peak retains the exact complete answer and semantic fingerprint.

Review corrections restore constructor source order at the producer and use canonical lexical lookup plus early-exit mutation queries while retaining complete effects for consumers that need them. Synthetic 1024-constructor capacity CPU median 4.413→0.200s; V8 warm-up and raw samples are recorded, not a real-app or agent-task speed claim. The stored-alias review example already returned unknown; public CLI proof and a regression preserve the verified disagreement without broadening mutation rules.

Reproducible receipts, scripts and limitations. Final shared-query source: 107 focused cases/10files plus full static and docs/5 consistency cases passed. The earlier grouped 156/157 upstream 30s timeout and same-deadline passing main/candidate isolated controls remain recorded. Eight oracle mutations are rejected. One CPU/8GiB; no observed OOM and payload cleanup verified. Downloadable apps and large raw CLI exports are not committed.

Final head73ac512f9: core CI completed all36jobs successfully, current status checks passed, both exact-head automated reviews have no outstanding findings and all3review threads are resolved. All17 current authored hashes, the exact feature patch and required coauthor verified against merge d72d856f58. Whole-tree equality does not hold: unrelated main cleanup-diagnostic changes landed in four other files before merge. Combined-tree follow-up passed124cases/12files plus full static6tasks/architecture guards. A fresh real Joplin workflow preserves the exact complete answer/raw semantic fingerprint/CLI-MCP Evidence parity/BPE (45.102s at answer,44.669897CPU s,1,552,072,704B cgroup peak, noOOM/owned cleanup verified). These local post-merge checks are separate from PR-head CI. A body-edit title-check rerun briefly delayed normal merge and then passed; no override was used. Main #4274 is integrated; the old blocker is gone. Next slice starts from freshly fetched main after overlap checking; #3536 popup configuration is the read-ahead candidate.

Scoped cost exploration (#4415)

Exploratory #4415 records the selected Joplin workflow's remaining preparation cost. The merged-tree completed MCP task still takes45.102s to its first answer (preparation40.531s; view120.8ms then21–24ms). Separate parent-only CLI profile diagnostic38.147s/37.736337family CPU s/1,010,319,360B cgroup peak shows distributed graph/sealing/hash/I/O/GC costs; it is not an equivalent MCP timing pair and does not profile the worker. Sample counts and signed deltas (including one -2us delta) are preserved with explicit limitations. No speculative cache, selector, bypassed validation or production speedup is claimed.

Compact receipts and a replayed CPU-profile summarizer are committed locally as698f15e6a58253d680e8f476486c4a90d61abdfb on perf/javascript-analysis-cost-20261016. No exploration PR is open. Regenerable raw profiles/large CLI exports and the owned baseline control worktree are removed; shared application inputs and user files remain. OneCPU/8GiB, no observedOOM and payload cleanup verified. Popup#3536 remains separate: real Joplin recursively passes webContents through a helper, so method-name matching must not manufacture a proven opener. A safe and worthwhile optimization has not yet been established.

Originally created by @N0zoM1z0 on GitHub (Oct 15, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4027 Originally assigned to: @N0zoM1z0 on GitHub. ## Outcome Track a bounded, evidence-backed improvement programme for **browser, Electron and JavaScript analysis**: trustworthy results and ownership first, useful answers at reasonable agent/analysis cost, then narrowly scoped capability additions. **Area:** Evidence, artifacts, reconstruction and MCP/agent integration. **Target interaction:** reading selected local artifacts/captures; existing browser/Electron launch or attach workflows and their declared instrumentation. This tracker performs no target mutation and does not grant new runtime authority. Unverified target/platform/provider coverage is identified below. This consolidates execution across #39, #774, #64, #375 and the MCP cost roadmap #1065; it does not replace their history or imply their already-shipped capabilities are missing. Existing source selection, retained Evidence, summary/module views, captured-script export, source-map tracing, runtime reconciliation, offline captures and Wakaru recovery should be reused. Research baseline: **2026-10-15, main `6fcfc5b5e0c063300cd5278dd8bad5b1ab1374f6`**. Paginated snapshot: 566 open issues / 334 open PRs; inspected relevant source owners, issue bodies, recent merges, and detailed status/comments for 18 PRs plus review threads for 14. A pre-publication refresh found 336 open PRs; all PR bodies were cross-referenced, including proposals whose titles do not mention JavaScript. Counts and PR states below are time-sensitive. Source-derived items and other contributors' reports are not claimed as reproductions by this investigation. ## Independently executed evidence Linux x64, AMD EPYC 7B12, Node **24.18.0**, npm **11.16.0**, locked dependencies and built checkout: - **Real Chrome for Testing 156.0.8078.4:** `npm run verify:browser` and `npm run verify:browser:runtime` passed, including public CLI/stdio MCP, network content/redirect/same-URL association, script export, module identity, large screenshot recovery, popup, scenario environment/storage/service-worker and owned cleanup checks. This does not prove every browser report is fixed or establish Windows/macOS/Electron compatibility. - **#3986 / #3987 reproduced through real Chrome + CLI and stdio MCP.** An inert served script containing `registerTool({ name: "catalog", [``]: 0 })` loses the known name; quoted empty keys retain it. A literal input schema property `""` disappears while its ordinary sibling remains. Source-derived root cause: the old string-returning key helper conflates an unknown key with a legal empty key, and two consumers either guess from AST kind or filter by truthiness. Reuse `semanticStaticPropertyKey`'s `string | null` facts at the producing boundary and remove the workaround. Preserve dynamic/spread/overwrite uncertainty and untrusted declaration status. - **#3878 reproduced with real Chrome:** the selected page URL contains a fragment, while bundle `capture.target_url` drops it. - **#3924 reproduced through real stdio MCP:** a relative JavaScript application input is accepted despite the absolute-path contract. - **Public shipped pdf.js sample:** `pdfjs-dist@5.3.93`, `wasm/openjpeg_nowasm_fallback.js`, 462,316 bytes, SHA-256 `53c228428a8861035a34738966af263fc9d4cee6df25a0ad942af947469a0bd9` (same bytes as #2498). The default public CLI request timed out after **303.36 s**, with `provider_timeout` and retained partial Evidence; wait-accounted CPU **338.86 s**, sampled peak process-family RSS **1.11 GiB**. This is an observed failed task, not a completed-analysis benchmark or a cross-host regression comparison. Some independent probes overlapped this run. - **Answer-cost calibration:** select only `lib/asar.js` from shipped `@electron/asar@4.2.0` (12,755 source bytes; complete 35-file inventory, 34 sources explicitly unselected). Full structured Evidence: **2,525,533 bytes / 921,355 cl100k_base tokens**. The same retained parent summary: **11,134 bytes / 2,319 tokens**; a five-module page: **9,257 bytes / 1,991 tokens**. `detail: "summary"` returns that summary while retaining the same parent Evidence identity. These are BPE counts of serialized values, **not model billing or reasoning-token measurements**. Summary changes delivery; it does not avoid the initial analysis. Counting the two selected input contracts, requests and follow-ups, the structured full-answer workflow costs **929,063 BPE tokens**, versus **12,102** for summary + a module page (98.7% lower under this defined projection). This is a delivery comparison on identical code, not a code-change speedup. - **Discovery cost:** default `tools/list` has **207 tools**. Its name/description/input-schema projection measures **195,136 cl100k_base tokens**; the two contracts used for analysis + views measure **7,667**. Full wire catalog including output schemas is larger; actual host projection is unmeasured. Include catalog, requests, follow-ups and retries when comparing whole tasks. For the completed ASAR task, two fresh CLI processes returned byte-identical Evidence: **3.19 / 3.45 s** elapsed, **4.74 / 5.16 s** wait-accounted CPU, **472 / 464 MiB** sampled peak process-family RSS. In one MCP session, first full delivery took **8.16 s**, equivalent repeated full delivery **2.00 s**, retained summary **76.6 ms**, and module page **8.4 ms**. Built artifacts and the filesystem were warm; some probes overlapped on this shared host. RSS was sampled every 50 ms, may miss brief peaks and counts shared pages per process. MCP harness resource totals also include BPE counting, so they are not attributed solely to REA. No optimized before/after implementation or hosted-model run was performed. ## Prioritized work, existing owners and dependencies Unchecked means work remains or exact-current-main proof is still needed. Reuse the linked issue/PR; do not open duplicate bug reports or merge overlapping fixes independently. | Priority | Work and acceptance boundary | Existing work | | --- | --- | --- | | P0 | Electron containment and owned runtime admission: block/record existing OS-effect attempts, preserve selected environment inputs, verify all packaged-launch prerequisites and cleanup | #3452 → overlapping PRs #3466/#3471; #3474 → #3559; #3414 → #3544; Windows packaged app blockers #2974 | | P1 | Bound semantic growth before allocation, preserve useful static facts and truthful omitted/frontier coverage; profile completed real bundles before choosing new budgets | getter expansion #3839 → #3848; wasm2js traversal #2498 → #2891; large-source omission #3670 → #3852; parent/projection accounting #3671, #3538 → #3545/#3550; broad admission work #2092/#2097 | | P1 | Correct identities and uncertainty across traces/comparisons | #3879 → #4014; dropped WebMCP #3989; fragment identity #3878; destroyed-context attribution #3382 → #3823; late frames #3910; window action identity #3936; missing ASAR add-on digest #3926; native-addon timeout scope #3948; mapped-file digest contradiction #3316 | | P1 | Normalize exact AST facts once; preserve equivalent syntax, capture lifetimes, receiver identity and unknown alternatives | empty keys #3986/#3987; schema keywords #3331 → #3765; string allocation #3933; nonfinite defaults #3861 / timers #3400 → #3464/#3456; callback capture #3880/#3881; module-table writes #3883; optional/local native require #3884/#3885; factory fallthrough #3963; fingerprint semantics #3952 → #4020 | | P1 | Bundler, package and source-map correctness with exact source/path provenance | renamed factory exports #3551 → #3552; esbuild shim #3535 → #3596; false preload joins #3962 → #3996; Vite table/spread indexes #3907 → focused #4023 and broader #1840; TypeScript erased imports #3932 and source media types #3945; directive-prologue WASM glue literals #4001; directory map candidates #3909 and HTML file/directory intent #3882; reference-source resolution #3895 → #4017, #3896 → #3973, #3915/#3916 and replaced require #3982; path policy #829 with explicit migration decision | | P1 | Honest browser completeness, bounded windows and reusable external targets | Windows cancellation #3816 → #4010; scenario/passive timer overflow #3392/#3929 → #3515 (scenario portion); locale #3395; screenshot navigation #3941 and PNG validity #3928; malformed worker/AX inventories #3378/#3376 → #3513/#3850; incomplete AX #3385 → #3824; omission accounting #3957; discarded credential budget #3959 → #3994 | | P1 | Agent-facing contract fixes and efficient discovery/delivery; preserve complete retained Evidence and caller choice | relative inputs #3924; worker/filesystem effects #3867; offline HAR availability #3947; Electron diagnostics #3865; tool families #3246 → #3026; compact schemas #2813 → #2905; valid screenshot example #3938 → #3995; ordered CLI sessions #2927 → #3028; paged handoffs #2701. Evaluate full vs selected/summary workflows and actual client schemas | | P2 | Complete conservative static Electron and Node effect recovery after the above owners stabilize | BrowserWindow constants/open-handler overrides #3536; wrapper/bootstrap work #2094/#2948; protocol registrations #2978; filesystem writes/synchronous child effects #3431 → #3433 (child slice only); replaced globals/handles/receivers #3367/#3362/#3360/#3358 → #3849/#3819/#3857/#3794 | | P2 | Useful browser-to-code and API questions through existing tools, with compact inline answers and provenance | exact DOM-node reuse #2289; worker/service-worker ownership #883 → #2068; wrapper endpoint candidates #3539; static vs recorded API surfaces #3591; historical API comparison #2914; value-free SSE/NDJSON #3593; selected header/cookie-name facets #3592 → #3622 (Part A only; not the related API comparison features); SAZ/mitmproxy surfaces #2857/#2915 → #2884; screenshot regions #2988 | | P3 / design | Keep optional new engines and adjacent runtimes narrow until scope, authority and real-provider proof are resolved | jsbeautify #2093; js-redox #1815; IPC effect prototype #3742; passive iframe #3759; Cordova/Capacitor #3518; Tauri #3686; CEF #3685; React/RSC/Hermes #3608; WebGPU #3727; game-specific #3650/#3647 | ### Integration holds observed in existing work PR titles, ready status and green checks are insufficient. Snapshot findings include unresolved widening correctness in #3848, missing representative completed before/after measurement in #2891, eight unresolved threads in #2092, historical unknown-count and destructuring-projection blockers in #3852/#3596, and test integration/proof gaps in the overlapping move-to-Applications PRs. #2097/#2068 have failed checks at their inspected heads; this audit has not attributed their causes. #2093 lacks inspected real-engine proof and has unresolved threads; #1815 has unresolved findings and attributed reports of provider/firmware failures. #3742 explicitly awaits maintainer scope review. Reconcile exact current heads and required checks before integration. ## Performance and code-quality contract for each slice - Start from fresh `origin/main`, use a separate branch/worktree for one issue or one inseparable producing-boundary fix, and link the existing issue plus this tracker. - Fix representation/ownership at its producer and update all directly affected consumers; remove superseded reparsing and wrappers. Preserve observed/derived/inferred/unknown distinctions, source bytes/digests, caller choices and partial Evidence. Use tagged expected failures and `Result`. - Select sources before analysis; return summaries or focused pages where sufficient and retain full Evidence. Avoid an extra lookup merely to discover provenance. Evaluate actual converted schemas, intended clients, request/response sizes and failures. - Measure equivalent **completed** tasks before/after: answer/schema/request/follow-up BPE tokens (label tokenizer and unmeasured model costs), elapsed time, CPU, sampled peak **process-family** memory, retained facts and coverage. Separate first-process and warm-session runs; do not describe a warm build or filesystem as OS-cold. Failed/time-limited cases are separate robustness observations. - Optimize measured repeated work first. Existing AST indexes and semantic caches already exist. Prefer query-owned memoization; a persistent static cache needs exact source digest, analyzer/parser/schema versions, module-resolution/package/source-map context, options and completeness/resource policy, with bounded eviction, invalidation and cancellation. Never cache live browser state by URL and report it as fresh. - Prefer public CLI/MCP + real source/producer verification; retain distinct malformed, cancellation, cleanup, permission, identity, capacity and uncertainty regressions. Synthetic fixtures complement shipped applications. Claims for Windows/macOS, Electron, Wakaru or other engines require their actual lanes; otherwise state `NOT_ENOUGH_INFO` with the missing evidence. - Keep each PR current, run CI/review on its final head, fix findings attributable to that change, and merge before starting the next implementation. New runtime/injection/mutation/protection-recovery capabilities still need the final scoped maintainer decision; routine fixes within existing authority can proceed. ## Proposed execution order and completion - [x] Complete the initial backlog/source audit and reproducible evidence/measurement ledger. Refresh the backlog against latest main before each implementation slice. - [ ] Land one structural empty-key fix for #3986/#3987, with public CLI/MCP real-Chrome regressions and unknown-key/overwrite controls; coordinate with #3765's separate schema-keyword fix. - [ ] Fix incorrect agent contracts (#3924/#3867/#3947/#3865), then source/window/digest identity and incomplete-comparison cases without duplicate downstream repairs. - [ ] Reconcile and verify containment/lifecycle fixes before extending owned Electron runtime behavior. - [ ] Address semantic expansion and admission as separate measured changes; require an equivalent completed pdf.js task and representative Electron bundles, not only microbenchmarks or successful timeout handling. - [ ] Integrate useful retained/discovery/batch and worker/static recovery work after its actual blockers are resolved; then add the P2 analyst workflows one at a time. - [ ] Close only after linked selected slices have landed with documented correctness, resource, CLI/MCP and real-provider evidence; explicitly defer unresolved P3 proposals rather than treating them as approved integration. Primary upstream references for candidate design: [Electron fuses](https://www.electronjs.org/docs/latest/tutorial/fuses), [CDP target lifecycle](https://chromedevtools.github.io/devtools-protocol/tot/Target/), [Node ESM URL identity](https://nodejs.org/api/esm.html#urls), [ECMA-426 source maps](https://tc39.es/ecma426/), [Wakaru multi-chunk recovery](https://wakarujs.com/docs/guides/unminify-a-webpack-bundle). These constrain design; their documentation does not establish REA compatibility or authorize new target effects. ### Current implementation progress (2026-10-15) Decision #4091 defers production code mode. #4063 is closed as not planned while its experimental branch/results remain preserved; #4082 stays closed without merging. Prioritize composable identities/facts, selected data, explicit source coverage and shared CLI/MCP ownership. | Landed slice | Result and validation | | --- | --- | | #4092 → #4097 (`ec394a2bdfbc1474851f4849611d6d308d8e60a0`) | Typed, filtered retained module-reference facts. Real Obsidian: identical 23 selected facts and exact CLI/MCP Evidence identity; 24 → 1 calls, selected-schema task BPE 85,302 → 16,548. 112 initial focused tests plus 32/32 expanded domain tests; final 42 CI checks passed. Three review findings fixed, verified and resolved; final automated reviews had no new findings. | | #3867 → #4121 (`e9a71efa31d6c3675b67938b8a79fa4ddf01604c`) | Canonical JavaScript analysis effects now declare the existing owned worker and temporary source writes; actual catalog/session metadata agree. 27 focused tests, full static/docs checks and final 40 CI checks passed; both automated reviews had no findings. Real Obsidian before/after retained identical parent/view/facts and exact CLI/MCP parity. | | #3933 → #4140 (`9f8659e0536e4e50a438f5b9d5661f3c9624f6ac`) | Exact literals/defaults use the primitive owner; projection keeps limits and per-analysis coverage records encountered bounds. Complete endpoint lookup identities and aggregate wire capacity preserved. 67 distinct focused cases across documented invocations, 932 semantic tests on the restored identical runtime, full static/docs and real Obsidian controls. Final 18 CI checks successful/15 lanes skipped; merged source/built report 15,614 passed/139 skipped. Both final reviews had no new findings. | | #3926 → #4179 (`c7f6b8bad1a34d5efb30ff2a017672dea1fcdabb`) | Native handoffs consume canonical byte identity; unavailable companions keep path/provenance/partial facts without archive-digest links. 58 distinct focused cases across documented invocations, final static/docs and real Joplin available/missing controls with exact CLI/MCP parity. All40 final CI checks passed; both automated reviews completed without findings. Available-case Evidence/facts and token costs unchanged; timing variability unresolved, no performance-equivalence claim. | | #3948 → #4207 (`85eac7b92bac39bf2da6c00ebf6ba1b11b4c8d1f`) | File processing preserves applicable operation/authority and interrupted/not-started status; shared semantic projection excludes non-JavaScript modules in both builders.78 distinct focused cases across10files, final static/docs and strict real Joplin timeout/default controls with exact CLI/MCP parity. Final38 CI checks passed plus one superseded title cancellation; both automated reviews completed without new findings after two valid fixes. All failed attempts/outliers/source versions preserved; no speedup claim. | | #4190 → #4265 (`d9d085a15e17bce525a316a48c7e3eeae1f60423`) | Exact retained metadata/native observations by batched original Evidence paths/kinds, selected properties, optional field names and paging; shared coverage owner. 114 focused cases across documented invocations / 7 files, 106 Python cases, 18 versioned real Joplin workflows and 9 full CLI/MCP view parity controls. All 41 final checks succeeded after one Windows deadline retry; both reviews clear. Source 16 hashes/whole tracked tree/coauthor verified; #4190 closed. Normal 12 rows unchanged, current semantic unknowns 41161→41162; timeout 11-row complete answer unchanged. Negative context/cost outcomes retained. | Reproduction scripts/code, executed source hashes, failed/prior attempts and compact measurements are in [module-reference verification](https://github.com/morluto/rea/blob/ec394a2bdfbc1474851f4849611d6d308d8e60a0/docs/verification/javascript-module-references-2026-10-15.md) and [effect-metadata verification](https://github.com/morluto/rea/blob/e9a71efa31d6c3675b67938b8a79fa4ddf01604c/docs/verification/javascript-analysis-effects-2026-10-15.md). The former's complete final verifier used 35.797 s wall / 35.197 s CPU / 1,938,313,216 B peak cgroup memory. The latter's real before/after workflow used 30.470/31.059 s wall, 29.940/30.663 s CPU and 1,551,282,176/1,584,574,464 B peak. One CPU / 8 GiB, cleanup verified and no OOM. Memory includes file cache. Static BPE uses declared catalog projections, not hosted-model billing. Serial legacy reads, unmeasured optimized concurrency/host rendering and uncontrolled caches prevent portable or whole-agent performance claims. Downloadable applications and large Evidence are not archived. Overlap record: draft #4106 duplicates the now-landed #4092 schema; do not integrate it independently. Last-inspected #4040 covers #3986/#3987 and other fidelity issues; #3924/#3865 have another contributor working. Revalidate exact current heads before starting overlapping work. Third-slice reproduction and compact measurements: [literal byte-budget verification](https://github.com/morluto/rea/blob/9f8659e0536e4e50a438f5b9d5661f3c9624f6ac/docs/verification/javascript-literal-byte-budget-2026-10-15.md). Real Obsidian final control preserved parent/view Evidence, 23 facts, coverage/unknowns, CLI/MCP parity and BPE costs: 32.949 s wall / 32.559187 s CPU / 1,880,096,768 B peak, one CPU/8 GiB, no OOM and verified cleanup. No speedup or equivalence bound is claimed. Review/CI lesson: an attempted primitive-byte policy for endpoint identities broke existing full lookup/trace behavior. It was reverted; the original large endpoint remains and the same string is now also tested as a bounded primitive. Rejected attempts and the actual CI failure remain in the verification record. Fourth-slice verification: [native handoff identity](https://github.com/morluto/rea/blob/c7f6b8bad1a34d5efb30ff2a017672dea1fcdabb/docs/verification/javascript-native-handoff-identity-2026-10-15.md). Merged source hashes and required co-author verified; #3926 closed. Real Joplin available/missing final verifier receipts: 258.885/59.738 s wall, 106.221003/59.254776 s CPU, 2,678,456,320/2,571,235,328 B peak cgroup memory; no OOM and verified cleanup under one CPU/8 GiB. Earlier controls/failed attempts are preserved; no native provider/application execution is claimed. Fifth-slice verification: [interruption applicability](https://github.com/morluto/rea/blob/85eac7b92bac39bf2da6c00ebf6ba1b11b4c8d1f/docs/verification/javascript-interruption-applicability-2026-10-15.md). Merged source hashes(all16) and required co-author verified; #3948 closed. Final real Joplin timeout60.443s wall/59.970344s CPU/3,078,295,552B peak and default63.574s/63.177884s/3,189,719,040B preserve exact CLI/MCP parity and earlier analytical facts/Evidence/BPE. Final full static/docs117.636s/117.194118s/4,263,153,664B plus5 consistency tests. OneCPU/8GiB, clean owned exit/noOOM; all earlier attempts/outliers retained and no speedup/equivalence claim. Native Evidence simulated; target/native providers not executed. Alternate full-builder path has actual filesystem-boundary coverage rather than a separately measured real-app workflow. Final head40e0ce42a:38 successful checks, one obsolete title execution superseded/cancelled, aggregate CI required and current title passed; Codex exact-head summary has no findings and Greptile final review reports no blocking issue. Both valid threads structurally fixed/tested/resolved. #3852 remains separate work. New scoped follow-up #4190 requests exact retained application metadata/native facts. A real Joplin package.json outgoing trace completed but exceeded10MiB reply admission twice, with identical parent/trace IDs; complete export remains available. The issue records reproducible inputs, current JS-only reference-view scope, provenance/coverage/batch-selection acceptance and whole-task measurement requirements. #4190 is now completed by #4265; see the sixth-slice verification below. Refreshed388openPR bodies show no competing #4190 implementation; browser scenario views #4163 and module refs #4106 have different/previously landed scope. Sixth-slice verification: [retained application facts](https://github.com/morluto/rea/blob/d9d085a15e17bce525a316a48c7e3eeae1f60423/docs/verification/javascript-retained-facts-2026-10-15.md). Main #4274 was integrated and independently reverified before merge. Latest normal retrieval 4.241 s export/projection versus 0.153 s view, but selected structured BPE 8,947 versus17,421; no universal speed/token claim. Parent/coverage disclose semantic unknown count 41,161→41,162 while all 12 original observations/per-row Evidence remain equal. Interrupted 11-row full answers remain identical. All local runs stayed within one CPU / 8 GiB with no OOM and verified cleanup; the largest new gate peaked 5,169,971,200 B including file cache. Failed local deadlines and the SDK 2.3.1 eager entire-output-catalog compilation diagnostic are retained alongside the unchanged test passing on an available CPU. Original 14 manual workflows and 8 agent attempts were checked unchanged before adding four new controls. No downloadable apps, raw large Evidence/transcripts or profiles are archived. #4265 merged with 41 successful status checks / 36 CI jobs, both exact-head automated reviews clear, and all review threads resolved; the first Windows 15 s timeout and unchanged-source retry remain visible in CI history. All 16 merged authored hashes plus whole tracked tree equality and required coauthor verified. Next implementation will start from freshly fetched main after checking overlap; #3936 is the current read-ahead candidate, not yet implemented. ## Seventh slice: constant window options (#4366) Merged [#4400](https://github.com/morluto/rea/pull/4400), closing #4366. #3536 remains open for popup overrides and optional spreads. #3936 is already covered by draft #4332; a source-only ordering/identity review was posted there instead of duplicating implementation. Real official Joplin 3.7.21 ASAR, unchanged input and constructor identity: zero→five explicit preferences (four booleans and dynamic session). Const associations retain source ranges and inferred Evidence; CLI/MCP complete view Evidence matches. Full semantic content matches after excluding only the parent application-graph commitment and its derived graph ID; raw hashes remain recorded. Two original trial orders show projected structured-task BPE 13,337→13,432 (+95), with no speedup claim: reversed pair 42.958s main vs44.793s candidate. Latest shared-query follow-up 44.607s/43.883417s CPU/1,666,560,000B cgroup peak retains the exact complete answer and semantic fingerprint. Review corrections restore constructor source order at the producer and use canonical lexical lookup plus early-exit mutation queries while retaining complete effects for consumers that need them. Synthetic 1024-constructor capacity CPU median 4.413→0.200s; V8 warm-up and raw samples are recorded, not a real-app or agent-task speed claim. The stored-alias review example already returned unknown; public CLI proof and a regression preserve the verified disagreement without broadening mutation rules. [Reproducible receipts, scripts and limitations](https://github.com/morluto/rea/blob/73ac512f9ae633e3a65849ec7a862ad3c151fa7f/docs/verification/javascript-window-options-2026-10-16.md). Final shared-query source: 107 focused cases/10files plus full static and docs/5 consistency cases passed. The earlier grouped 156/157 upstream 30s timeout and same-deadline passing main/candidate isolated controls remain recorded. Eight oracle mutations are rejected. One CPU/8GiB; no observed OOM and payload cleanup verified. Downloadable apps and large raw CLI exports are not committed. Final head73ac512f9: core CI completed all36jobs successfully, current status checks passed, both exact-head automated reviews have no outstanding findings and all3review threads are resolved. All17 current authored hashes, the exact feature patch and required coauthor verified against merge d72d856f58d4747c5eb4307426e80d20934e017c. Whole-tree equality does not hold: unrelated main cleanup-diagnostic changes landed in four other files before merge. Combined-tree follow-up passed124cases/12files plus full static6tasks/architecture guards. A fresh real Joplin workflow preserves the exact complete answer/raw semantic fingerprint/CLI-MCP Evidence parity/BPE (45.102s at answer,44.669897CPU s,1,552,072,704B cgroup peak, noOOM/owned cleanup verified). These local post-merge checks are separate from PR-head CI. A body-edit title-check rerun briefly delayed normal merge and then passed; no override was used. Main #4274 is integrated; the old blocker is gone. Next slice starts from freshly fetched main after overlap checking; #3536 popup configuration is the read-ahead candidate. ## Scoped cost exploration (#4415) Exploratory [#4415](https://github.com/morluto/rea/issues/4415) records the selected Joplin workflow's remaining preparation cost. The merged-tree completed MCP task still takes45.102s to its first answer (preparation40.531s; view120.8ms then21–24ms). Separate parent-only CLI profile diagnostic38.147s/37.736337family CPU s/1,010,319,360B cgroup peak shows distributed graph/sealing/hash/I/O/GC costs; it is not an equivalent MCP timing pair and does not profile the worker. Sample counts and signed deltas (including one -2us delta) are preserved with explicit limitations. No speculative cache, selector, bypassed validation or production speedup is claimed. Compact receipts and a replayed CPU-profile summarizer are committed locally as698f15e6a58253d680e8f476486c4a90d61abdfb on perf/javascript-analysis-cost-20261016. No exploration PR is open. Regenerable raw profiles/large CLI exports and the owned baseline control worktree are removed; shared application inputs and user files remain. OneCPU/8GiB, no observedOOM and payload cleanup verified. Popup#3536 remains separate: real Joplin recursively passes webContents through a helper, so method-name matching must not manufacture a proven opener. A safe and worthwhile optimization has not yet been established.

bsakaguchi commented

2026-10-16 21:07:47 +00:00

Author

Owner

@N0zoM1z0 commented on GitHub (Oct 16, 2026):

Progress: #4388 is closed by merged PR #4387 (180ba03bfddd5916251e81e97a500b1ede7a9eea). Current-head CI passed all 39 checks; fresh Codex and Greptile reviews are clear and all eight review threads were resolved. A genuine verifier false-pass finding was fixed before merge, with both old-helper negative controls reproduced and six corrected oracle cases passing.

Post-merge verification includes the new Rizin main commit: all ten authored paths are identical to the reviewed head, and the complete actual tree matches the predicted combination. The affected six compiled modules are byte-identical. All 49 focused cases pass on the merged tree (80.307 s wall, 78.180099 family CPU s, 3,188,281,344 peak cgroup bytes including cache; payload-exit observation, not final scope counters; no OOM).

Real Joplin 3.7.21 on generic Electron 44.7.0 again retained cancellation in 5.331 s, with cleanup still unverified and a nonzero verifier exit. Linux cleanup/first-signal CLI exit (#4282) and the packaged-runtime startup failure remain explicit gaps; this is no claim of a complete runtime pass or token/whole-task speedup. External owned-scope recovery is separate from provider cleanup.

Reproduction scripts and compact evidence, including all failed attempts and verifier follow-up.

Next: #4390 / existing #4389, then #4393, from fresh main and separate branches. The broader six-area work remains open.

@N0zoM1z0 commented on GitHub (Oct 16, 2026): Progress: #4388 is closed by merged PR #4387 (`180ba03bfddd5916251e81e97a500b1ede7a9eea`). Current-head CI passed all 39 checks; fresh Codex and Greptile reviews are clear and all eight review threads were resolved. A genuine verifier false-pass finding was fixed before merge, with both old-helper negative controls reproduced and six corrected oracle cases passing. Post-merge verification includes the new Rizin main commit: all ten authored paths are identical to the reviewed head, and the complete actual tree matches the predicted combination. The affected six compiled modules are byte-identical. All 49 focused cases pass on the merged tree (80.307 s wall, 78.180099 family CPU s, 3,188,281,344 peak cgroup bytes including cache; payload-exit observation, not final scope counters; no OOM). Real Joplin 3.7.21 on generic Electron 44.7.0 again retained cancellation in 5.331 s, with cleanup still unverified and a nonzero verifier exit. Linux cleanup/first-signal CLI exit (#4282) and the packaged-runtime startup failure remain explicit gaps; this is no claim of a complete runtime pass or token/whole-task speedup. External owned-scope recovery is separate from provider cleanup. [Reproduction scripts and compact evidence, including all failed attempts and verifier follow-up](https://github.com/morluto/rea/blob/180ba03bfddd5916251e81e97a500b1ede7a9eea/docs/verification/electron-cancellation-2026-10-16.md). Next: #4390 / existing #4389, then #4393, from fresh main and separate branches. The broader six-area work remains open.

bsakaguchi referenced this issue

2026-10-17 21:01:32 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi commented

2026-10-17 21:02:27 +00:00

Author

Owner

@N0zoM1z0 commented on GitHub (Oct 16, 2026):

Electron IPC correctness slice #4390 is merged through #4389 (bf3475867ff136b9fbdbadd37ba01a4f3c642a74). Native traversal/dispatch, exact callable metadata behavior within documented scope, private primitive lifetimes, snapshots and owned/unowned/unknown listener links share one producing implementation. Both CLI/MCP retain explicit observation gaps rather than fabricated facts.

Current-head39 checks and Greptile5/5 pass; final Codex review is unavailable due repo quota, not claimed approved. Actual merged-tree102 cases pass, and unchanged real draw.io UI operations complete with7IPC; overall cleanup still fails. Postmerge evidence and limitations plus the committed verification record retain the distinction. #4513 remains unfixed; no full-workflow speed/token benefit is claimed.

Next in the agreed order: synchronous shell coverage #4393, for which a new existing PR #4562 is now available and will be reviewed rather than duplicated. Related async trashItem work remains #3474/#3559. All remaining six-priority work stays active: large-JS correctness/performance, #4415 measured preparation cost, #4437 class relations, remaining #3536 popup/preload relations and #2289 node references.

@N0zoM1z0 commented on GitHub (Oct 16, 2026): Electron IPC correctness slice #4390 is merged through #4389 (`bf3475867ff136b9fbdbadd37ba01a4f3c642a74`). Native traversal/dispatch, exact callable metadata behavior within documented scope, private primitive lifetimes, snapshots and owned/unowned/unknown listener links share one producing implementation. Both CLI/MCP retain explicit observation gaps rather than fabricated facts. Current-head39 checks and Greptile5/5 pass; final Codex review is unavailable due repo quota, not claimed approved. Actual merged-tree102 cases pass, and unchanged real draw.io UI operations complete with7IPC; overall cleanup still fails. [Postmerge evidence and limitations](https://github.com/morluto/rea/pull/4389#issuecomment-6224030377) plus the committed verification record retain the distinction. #4513 remains unfixed; no full-workflow speed/token benefit is claimed. Next in the agreed order: synchronous shell coverage #4393, for which a new existing PR #4562 is now available and will be reviewed rather than duplicated. Related async trashItem work remains #3474/#3559. All remaining six-priority work stays active: large-JS correctness/performance, #4415 measured preparation cost, #4437 class relations, remaining #3536 popup/preload relations and #2289 node references.

bsakaguchi commented

2026-10-17 21:02:27 +00:00

Author

Owner

@N0zoM1z0 commented on GitHub (Oct 16, 2026):

Synchronous shell gap #4393 is closed by normal merge #4562 (709b5cbd). The shared table blocks/records showItemInFolder and writeShortcutLink with their synchronous refusal contracts; no new tool/schema. Source/verifier/compact evidence records are committed, regenerable raw apps/profiles are not archived.

Actual merged runtime rebuilt:87focused checks pass; real unchanged Joplin shipped attachment → actual menu/bridge →0to1blocked reveal and identical retained capture, image still visible/no page errors. Standard startup and provider cleanup remain failed/limited. Postmerge complete-family resource observation is unverified; no speed/token benefit claim. Complete postmerge evidence and review attribution.

The current review raised a substantive inherited-main IPC once runtime claim, now #4593 (Node24.21 comparison not independently run yet). Next: verify it in a new branch before the separate #3474/#3559 async trashItem work. Remaining large-JS, preparation-cost, class relations, popup/preload and stable-node-reference priorities all remain active.

@N0zoM1z0 commented on GitHub (Oct 16, 2026): Synchronous shell gap #4393 is closed by normal merge #4562 (`709b5cbd`). The shared table blocks/records showItemInFolder and writeShortcutLink with their synchronous refusal contracts; no new tool/schema. Source/verifier/compact evidence records are committed, regenerable raw apps/profiles are not archived. Actual merged runtime rebuilt:87focused checks pass; real unchanged Joplin shipped attachment → actual menu/bridge →0to1blocked reveal and identical retained capture, image still visible/no page errors. **Standard startup and provider cleanup remain failed/limited.** Postmerge complete-family resource observation is unverified; no speed/token benefit claim. [Complete postmerge evidence and review attribution](https://github.com/morluto/rea/pull/4562#issuecomment-6224694187). The current review raised a substantive inherited-main IPC once runtime claim, now #4593 (Node24.21 comparison not independently run yet). Next: verify it in a new branch before the separate #3474/#3559 async trashItem work. Remaining large-JS, preparation-cost, class relations, popup/preload and stable-node-reference priorities all remain active.

bsakaguchi commented

2026-10-17 21:02:27 +00:00

Author

Owner

@N0zoM1z0 commented on GitHub (Oct 16, 2026):

#4593 is now closed by #4605 (maintainer merge360626434). Postmerge88 focused hook/projection/MCP cases pass;39 native controls per three engines all agree. Real Joplin menu/bridge/reveal phase passes, but provider cleanup still fails; standard launch uses an explicit test shim. #4513 remains unfixed.

Full postmerge evidence on the PR distinguishes the maintainer merge from the subsequently failed inherited managed/Kuna CI tests; no all-green CI or full public-workflow success is claimed. Greptile final review5/5, Codex review unavailable due to repository quota.

All six priorities remain active. Next is existing ready #3559/#3474 from fresh main, preserving the author's work and verifying a real application. Official VSCodium1.140.06880 is acquired and checksum-verified; its actual main bundle has trashItem callers. Its read-only source-path preflight also supplied additional preparation/serialization cost evidence to #4415, with scope and measurement limits explicitly recorded. No codemode work is resumed.

@N0zoM1z0 commented on GitHub (Oct 16, 2026): #4593 is now closed by #4605 (maintainer merge360626434). Postmerge88 focused hook/projection/MCP cases pass;39 native controls per three engines all agree. Real Joplin menu/bridge/reveal phase passes, but provider cleanup still fails; standard launch uses an explicit test shim. #4513 remains unfixed. [Full postmerge evidence on the PR](https://github.com/morluto/rea/pull/4605) distinguishes the maintainer merge from the subsequently failed inherited managed/Kuna CI tests; no all-green CI or full public-workflow success is claimed. Greptile final review5/5, Codex review unavailable due to repository quota. All six priorities remain active. Next is existing ready #3559/#3474 from fresh main, preserving the author's work and verifying a real application. Official VSCodium1.140.06880 is acquired and checksum-verified; its actual main bundle has trashItem callers. Its read-only source-path preflight also supplied additional preparation/serialization cost evidence to [#4415](https://github.com/morluto/rea/issues/4415#issuecomment-6226046160), with scope and measurement limits explicitly recorded. No codemode work is resumed.

bsakaguchi referenced this issue

2026-10-17 21:12:43 +00:00

[PR #1600] [CLOSED] fix(javascript): preserve exact static CommonJS export keys #2997

bsakaguchi commented

2026-10-31 00:31:42 +00:00

Author

Owner

@CassieFox23 commented on GitHub (Oct 18, 2026):

TL;DR: Here's every open tracker in the repo, so people can hop between them.

Thanks, N0zoM1z0, for keeping this one.

Every open tracker in the repo, so you can get to any of them from here.

Bugs and duplicates

#3537: Open bugs, by subsystem (matbrgz)
#4330: Duplicate issues, in clusters (matbrgz)

Features and roadmap

#3796: Feature requests, by area (CassieFox23)
#2383: Support for the top 100 languages (matbrgz)
#2357: Static file and crash report work (matbrgz)
#3714 to #3719: six RFC epics on formats and bytecode (matbrgz)
#4027: Browser, Electron and JS work (N0zoM1z0)
#32: The main roadmap (morluto)
#48: The Evidence v2 epic (morluto)
#2039: The roadmap in plain words, a discussion (CassieFox23)

Docs

#3795: Open docs issues and PRs (CassieFox23)

Pull requests

#3582: Open PRs whose fix is already on main (CassieFox23)

Show and tell

#1435: Linux setup notes and test queue, a discussion (CassieFox23)

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

@CassieFox23 commented on GitHub (Oct 18, 2026): **TL;DR:** Here's every open tracker in the repo, so people can hop between them. Thanks, N0zoM1z0, for keeping this one. ### Related trackers Every open tracker in the repo, so you can get to any of them from here. **Bugs and duplicates** - #3537: Open bugs, by subsystem (matbrgz) - #4330: Duplicate issues, in clusters (matbrgz) **Features and roadmap** - #3796: Feature requests, by area (CassieFox23) - #2383: Support for the top 100 languages (matbrgz) - #2357: Static file and crash report work (matbrgz) - #3714 to #3719: six RFC epics on formats and bytecode (matbrgz) - #4027: Browser, Electron and JS work (N0zoM1z0) - #32: The main roadmap (morluto) - #48: The Evidence v2 epic (morluto) - #2039: The roadmap in plain words, a discussion (CassieFox23) **Docs** - #3795: Open docs issues and PRs (CassieFox23) **Pull requests** - #3582: Open PRs whose fix is already on main (CassieFox23) **Show and tell** - #1435: Linux setup notes and test queue, a discussion (CassieFox23) 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1600

No description provided.

Rows
Columns