[GH-ISSUE #5128] [Bug] Node-limited UI traces overwrite omitted call sites sharing a target #3156

New issue

Closed

opened 2026-10-31 00:37:17 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-31 00:37:17 +00:00

Owner

Originally created by @morluto on GitHub (Oct 18, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5128

Before submitting

Searched open and closed issues. #3922 concerns incorrect omitted-call relations; this report concerns losing a distinct call site even after its relation is preserved. #5073 concerns loss before node budgeting.
Evidence uses inert, self-authored fixture addresses and no sensitive target data.

Area

Native analysis or decompilation; Evidence.

Observed behavior

A public MCP trace_native_ui_action fixture with max_nodes:2 retains one callee, then omits two calls from different sites to the same other callee. Only the later omitted site survives in unresolved.

The controlled provider reports complete kind metadata and these calls:

0x1004 -> 0x2000 direct
0x1008 -> 0x3000 indirect
0x100c -> 0x3000 direct

Request: {"action":"0x1000","max_nodes":2,"max_depth":1}.
Actual retained omission: {"id":"unknown-node-bound:0x1000:0x3000","relation":"direct_call","resolution":"unresolved","to":null}, with evidence location 0x100c. The independently observed 0x1008 site disappears.

Reproduction

Executed pinned Node 24.18 vitest run --project mcp-boundary tests/boundary/mcp/nativeUiPartialCallRoutesMcp.test.ts through the registered server and official SDK in-memory transport. The added shared-target test failed while the other eight cases passed. This is a controlled provider fixture, not a real native-engine reproduction.

Source HEAD is 22ddd820143b0ce455756b24acf60ed251286622 plus the uncommitted #5073/#3922 route-retention/relation fix; the target-only omitted-edge ID is unchanged from that commit. The reduced assertion shows only the later site, rather than two separate omissions.

Expected behavior

Retain distinct omitted calls by procedure, call site and target. Keep each relation, unresolved status and original provider/site evidence. Node limits bound retained nodes; they should not merge distinct observations that fit the edge budget.

Impact and scope

Observed loss of one call-site observation and its indirect classification. NOT_ENOUGH_INFO for real-provider frequency, other hosts, or real artifact occurrence.

REA version

Source HEAD 22ddd820143b0ce455756b24acf60ed251286622, with the working changes described above.

Runtime and platform

Node 24.18.0, macOS 26.3 arm64. No native provider engine was executed.

Target and artifact context

Controlled Mach-O-shaped subject with matching fixed SHA-256; synthetic addresses above.

Interface

MCP.

Earliest failure stage

Native analysis or reconstruction.

Relevant output or evidence

The actual failed assertion retains only 0x100c under the target-only ID above. Source: NativeUiActionTrace at the baseline, unknown-node-bound map insertion. The map key includes procedure and target but omits call site, so the second insertion replaces the first. This source-derived cause matches the executed public result.

Originally created by @morluto on GitHub (Oct 18, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5128 ### Before submitting - [x] Searched open and closed issues. #3922 concerns incorrect omitted-call relations; this report concerns losing a distinct call site even after its relation is preserved. #5073 concerns loss before node budgeting. - [x] Evidence uses inert, self-authored fixture addresses and no sensitive target data. ### Area Native analysis or decompilation; Evidence. ### Observed behavior A public MCP `trace_native_ui_action` fixture with `max_nodes:2` retains one callee, then omits two calls from different sites to the same other callee. Only the later omitted site survives in `unresolved`. The controlled provider reports complete kind metadata and these calls: ```text 0x1004 -> 0x2000 direct 0x1008 -> 0x3000 indirect 0x100c -> 0x3000 direct ``` Request: `{"action":"0x1000","max_nodes":2,"max_depth":1}`. Actual retained omission: `{"id":"unknown-node-bound:0x1000:0x3000","relation":"direct_call","resolution":"unresolved","to":null}`, with evidence location `0x100c`. The independently observed `0x1008` site disappears. ### Reproduction Executed pinned Node 24.18 `vitest run --project mcp-boundary tests/boundary/mcp/nativeUiPartialCallRoutesMcp.test.ts` through the registered server and official SDK in-memory transport. The added shared-target test failed while the other eight cases passed. This is a controlled provider fixture, not a real native-engine reproduction. Source HEAD is `22ddd820143b0ce455756b24acf60ed251286622` plus the uncommitted #5073/#3922 route-retention/relation fix; the target-only omitted-edge ID is unchanged from that commit. The reduced assertion shows only the later site, rather than two separate omissions. ### Expected behavior Retain distinct omitted calls by procedure, call site and target. Keep each relation, unresolved status and original provider/site evidence. Node limits bound retained nodes; they should not merge distinct observations that fit the edge budget. ### Impact and scope Observed loss of one call-site observation and its indirect classification. NOT_ENOUGH_INFO for real-provider frequency, other hosts, or real artifact occurrence. ### REA version Source HEAD `22ddd820143b0ce455756b24acf60ed251286622`, with the working changes described above. ### Runtime and platform Node 24.18.0, macOS 26.3 arm64. No native provider engine was executed. ### Target and artifact context Controlled Mach-O-shaped subject with matching fixed SHA-256; synthetic addresses above. ### Interface MCP. ### Earliest failure stage Native analysis or reconstruction. ### Relevant output or evidence The actual failed assertion retains only `0x100c` under the target-only ID above. Source: [NativeUiActionTrace at the baseline](https://github.com/morluto/rea/blob/22ddd820143b0ce455756b24acf60ed251286622/src/application/native/NativeUiActionTrace.ts), `unknown-node-bound` map insertion. The map key includes procedure and target but omits call site, so the second insertion replaces the first. This source-derived cause matches the executed public result.

bsakaguchi

2026-10-31 00:37:17 +00:00

closed this issue
added the
triage

bug
labels

bsakaguchi commented

2026-10-31 00:37:18 +00:00

Author

Owner

@morluto commented on GitHub (Oct 18, 2026):

Fixed on main in 65884350f.

The omitted-edge map keyed observations only by procedure and target, so the second call site replaced the first. Its identity now includes the source site, matching normal call-edge identity. Both omitted observations retain their own relation, provider and site evidence without allocating additional target nodes. The caller-selected node and edge bounds remain in force.

Validation: 69 focused cases passed, followed by a final 30-case rerun and the final 9-case public MCP assertion check. The public regressions cover mixed kinds, failed fallback, overlap, cancellation, direct/indirect/provider node omissions and shared-target sites. Before the fixes, the corrected committed-baseline public fixture failed 6/8 cases; the additional identity regression failed with 8 controls passing. Full static/architecture checks, docs, test discovery (1,593 files), hooks and pre-push checks passed. These are controlled providers through the actual SDK/server path; real native-engine behavior remains unverified. Current-head CI runs separately in the background.

@morluto commented on GitHub (Oct 18, 2026): Fixed on main in [65884350f](https://github.com/morluto/rea/commit/65884350ff3373f2adc7337c1945eeb54334693f). The omitted-edge map keyed observations only by procedure and target, so the second call site replaced the first. Its identity now includes the source site, matching normal call-edge identity. Both omitted observations retain their own relation, provider and site evidence without allocating additional target nodes. The caller-selected node and edge bounds remain in force. Validation: 69 focused cases passed, followed by a final 30-case rerun and the final 9-case public MCP assertion check. The public regressions cover mixed kinds, failed fallback, overlap, cancellation, direct/indirect/provider node omissions and shared-target sites. Before the fixes, the corrected committed-baseline public fixture failed 6/8 cases; the additional identity regression failed with 8 controls passing. Full static/architecture checks, docs, test discovery (1,593 files), hooks and pre-push checks passed. These are controlled providers through the actual SDK/server path; real native-engine behavior remains unverified. Current-head CI runs separately in the background.

bsakaguchi referenced this issue

2026-10-31 00:39:40 +00:00

[GH-ISSUE #5540] [Bug] decode-interface-builder misattributes object-limit omissions to the connection budget #3373

bsakaguchi referenced this issue

2026-10-31 01:08:13 +00:00

[PR #3156] [CLOSED] fix(apple): mark limited Interface Builder hierarchies incomplete #5645