[PR #825] [MERGED] fix(browser): preserve form destinations and satisfies mutation uncertainty #2266

New issue

Closed

opened 2026-10-16 21:16:30 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:16:30 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/825
Author: @N0zoM1z0
Created: 10/7/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/website-evidence-regressions

📝 Commits (1)

56c4518 fix(browser): preserve form destinations and satisfies mutation uncertainty

📊 Changes

11 files changed (+272 additions, -4 deletions)

View changed files

📝 docs/testing.md (+6 -0)
📝 package.json (+1 -0)
📝 scripts/fixtures/browser-verifier-site.mjs (+1 -1)
➕ scripts/lib/browser-dom-destinations-e2e.mjs (+60 -0)
📝 scripts/lib/browser-verifier-assertions.mjs (+18 -0)
➕ scripts/verify-browser-dom-destinations.mjs (+53 -0)
📝 scripts/verify-real-browser.mjs (+6 -0)
📝 src/browser/CdpCaptureDocuments.baseUrl.test.ts (+78 -0)
📝 src/browser/CdpCaptureDocuments.ts (+26 -3)
📝 src/domain/javascriptSemanticAnalysis.member_mutations.test.ts (+22 -0)
📝 src/domain/javascriptSemanticMemberMutations.ts (+1 -0)

📄 Description

Changes

Preserve the current document URL for empty FORM action and BUTTON/INPUT formaction, including query/fragment identity and foreign-base filtering.
Match observed Chrome HTML-whitespace FORM action behavior without extending that rule to whitespace-only submit controls, vertical tabs or nonbreaking spaces.
Unwrap TypeScript satisfies aliases during explicit property mutation tracking; retain unknown mutated slots and known unaffected properties.
Add real-browser form fixture checks through provider, CLI and stdio MCP. No public schema or authority change.

Fixes #820. Follow-up to #780 and #752; website roadmap #774.

Verification

Fail-before: 8 regression failures with 42 passing controls on original production code.
npm run test:local -- src/browser/CdpCaptureDocuments.baseUrl.test.ts src/browser/CdpCaptureDocuments.test.ts src/domain/javascriptSemanticAnalysis.member_mutations.test.ts src/application/JavaScriptSemanticGraphBuilder.test.ts: 80 passed.
npm run build:cached: passed.
npm run check:fast: passed.
Independent Chrome 153.0.8010.12 oracle: all 21 form/action URL comparisons passed, including whitespace controls.
Native Node 24 TypeScript oracle: runtime returns updated; REA reports the mutated slot unknown.
npm run verify:browser:dom: real Chrome CLI/MCP plus native DOM-property oracle passed, including current-document query and fragment identity.
Full browser run reached the new final public check after existing lanes; that check exposed a harness assumption: CDP TargetInfo URL can omit a fragment present in DocumentSnapshot/document URL. The focused oracle now supplies the independently observed document URL; the full check is moved before other fixtures navigate the target. Hosted CI owns the final full-lane rerun.

No Hopper/Ghidra verification: unrelated to these browser/static-JavaScript corrections. All local verification used one CPU and bounded heaps; no host defaults or global installs changed.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/825 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/7/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/website-evidence-regressions` --- ### 📝 Commits (1) - [`56c4518`](https://github.com/morluto/rea/commit/56c4518565cb27e2552164c2535306f54154ee2c) fix(browser): preserve form destinations and satisfies mutation uncertainty ### 📊 Changes **11 files changed** (+272 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `docs/testing.md` (+6 -0) 📝 `package.json` (+1 -0) 📝 `scripts/fixtures/browser-verifier-site.mjs` (+1 -1) ➕ `scripts/lib/browser-dom-destinations-e2e.mjs` (+60 -0) 📝 `scripts/lib/browser-verifier-assertions.mjs` (+18 -0) ➕ `scripts/verify-browser-dom-destinations.mjs` (+53 -0) 📝 `scripts/verify-real-browser.mjs` (+6 -0) 📝 `src/browser/CdpCaptureDocuments.baseUrl.test.ts` (+78 -0) 📝 `src/browser/CdpCaptureDocuments.ts` (+26 -3) 📝 `src/domain/javascriptSemanticAnalysis.member_mutations.test.ts` (+22 -0) 📝 `src/domain/javascriptSemanticMemberMutations.ts` (+1 -0) </details> ### 📄 Description ## Changes - Preserve the current document URL for empty FORM action and BUTTON/INPUT formaction, including query/fragment identity and foreign-base filtering. - Match observed Chrome HTML-whitespace FORM action behavior without extending that rule to whitespace-only submit controls, vertical tabs or nonbreaking spaces. - Unwrap TypeScript satisfies aliases during explicit property mutation tracking; retain unknown mutated slots and known unaffected properties. - Add real-browser form fixture checks through provider, CLI and stdio MCP. No public schema or authority change. Fixes #820. Follow-up to #780 and #752; website roadmap #774. ## Verification - Fail-before: 8 regression failures with 42 passing controls on original production code. - `npm run test:local -- src/browser/CdpCaptureDocuments.baseUrl.test.ts src/browser/CdpCaptureDocuments.test.ts src/domain/javascriptSemanticAnalysis.member_mutations.test.ts src/application/JavaScriptSemanticGraphBuilder.test.ts`: 80 passed. - `npm run build:cached`: passed. - `npm run check:fast`: passed. - Independent Chrome 153.0.8010.12 oracle: all 21 form/action URL comparisons passed, including whitespace controls. - Native Node 24 TypeScript oracle: runtime returns updated; REA reports the mutated slot unknown. - `npm run verify:browser:dom`: real Chrome CLI/MCP plus native DOM-property oracle passed, including current-document query and fragment identity. - Full browser run reached the new final public check after existing lanes; that check exposed a harness assumption: CDP TargetInfo URL can omit a fragment present in DocumentSnapshot/document URL. The focused oracle now supplies the independently observed document URL; the full check is moved before other fixtures navigate the target. Hosted CI owns the final full-lane rerun. No Hopper/Ghidra verification: unrelated to these browser/static-JavaScript corrections. All local verification used one CPU and bounded heaps; no host defaults or global installs changed. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:16:30 +00:00