[GH-ISSUE #6673] [Bug] Tagged-template return references retain stale exported literals #4052

New issue

Closed

opened 2026-10-31 00:46:23 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:46:23 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6673

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

The production JavaScript artifact analyzer and export-return projection publish literal 1 after a local template tag returns an object and a write through that result changes its x property to 2. Native execution of the self-authored fixture returns 2. Replacing the tagged invocation with an ordinary call correctly produces an unknown return field. This is an executed source-boundary finding; the released CLI and MCP transports were not run.

Reproduction

From the source checkout identified under REA version, with its locked dependencies available, run the following command. The same script body ran once in the final five-case verification and exited zero. Earlier exploratory production-boundary probes also observed the three affected forms. The fixtures are small known reproductions, not claimed to be minimized.

node --import ./node_modules/tsx/dist/loader.mjs --input-type=module <<'JS'
import { createHash } from 'node:crypto';
import { analyzeJavaScriptArtifactFiles } from './src/application/javascript/JavaScriptArtifactAnalysis.ts';
import { projectJavaScriptModuleSemantics } from './src/domain/javascript/javascriptModuleSemanticIr.ts';
import { projectJavaScriptExportReturnShapes } from './src/domain/javascript/javascriptExportReturnShapeProjection.ts';
import { completeApplicationCoverage } from './src/domain/javascript/javascriptApplicationEvidenceSchemas.ts';

const cases = {
  tag_write: 'export function read(){const state={x:1};const tag=()=>state;tag``.x=2;return state.x;}',
  tag_alias: 'export function read(){const state={x:1};const tag=()=>state;const ref=tag``;ref.x=2;return state.x;}',
  tag_argument: 'export function read(){const state={x:1};const tag=()=>state;const put=(ref)=>{ref.x=2;};put(tag``);return state.x;}',
  ordinary_call: 'export function read(){const state={x:1};const tag=()=>state;tag().x=2;return state.x;}',
  no_invocation: 'export function read(){const state={x:1};const tag=()=>state;return state.x;}',
};

for (const [name, source] of Object.entries(cases)) {
  const sha = createHash('sha256').update(source).digest('hex');
  const analysis = analyzeJavaScriptArtifactFiles({
    files: [{ path: 'app.mjs', container_sha256: sha, sha256: sha,
      bytes: Buffer.byteLength(source), inventory_artifact_id: `art_${sha}`,
      kind: 'javascript', unpacked: false, text: { included: true, value: source } }],
    containers: [], unavailable_relevant_files: [],
    text_bytes_read: Buffer.byteLength(source), invalid_utf8_files: 0,
  });
  const ir = analysis.files[0]?.semantic?.ir;
  if (!ir) throw new Error('Missing semantic IR');
  const module = projectJavaScriptModuleSemantics(ir);
  const link = module.moduleLinks.find(item => item.exportedName === 'read');
  if (!link) throw new Error('Missing read export');
  const projection = projectJavaScriptExportReturnShapes({
    ir: module, link, modulePath: 'app.mjs', baseCoverage: completeApplicationCoverage(),
  });
  if (!projection) throw new Error('Missing return projection');
  const shape = projection.properties.static_return_shapes[0];
  const native = Function(source.replace('export ', '') + ';return read();')();
  console.log(JSON.stringify({
    case: name, parse_failures: analysis.parse_failures,
    semantic_coverage: ir.coverage.status,
    return_coverage: projection.properties.return_shape_coverage.status,
    projection_complete: projection.properties.return_shape_coverage.projection_complete,
    field: shape.fields[0], native,
  }));
}
JS

REA analyzes the inert source strings. The separate Function call executes only these self-authored, self-contained fixtures as a native-language reference control.

Expected behavior

A reference returned by a local function must retain mutation uncertainty when that function is invoked as a template tag. Do not publish the old state.x as a definite literal after a write through the returned object or an alias. Unknown is sufficient; recovering the exact post-write value is not required. The documented export-return contract preserves uncertainty for calls, tagged templates, returned local references and aliases. The executed ordinary-call control demonstrates the existing treatment of the same function and returned object.

Impact and scope

Three valid tagged-invocation forms produce a stale exported return fact: writing the tag result directly, saving it in an alias before writing, and passing it to a local mutating function. Every affected final-run case has zero parse failures and complete semantic/return coverage. The ordinary-call control becomes unknown, while the no-invocation control retains the correct 1. Complete coverage here describes retained syntax, not proof that the target ran. Real-application prevalence, downstream comparison effects, other tag forms and other platforms were not measured.

REA version

Source 99a5ffae3bf3d73f11bca3d9b8893347964b10b9, package version 6.7.0. The parent investigation identified 6.7.0 as the latest published package; these observations concern the stated source checkout, not an executed package installation.

Runtime and platform

Node.js v24.22.1; Linux x86_64; repository lockfile dependencies. No external analysis provider was started or mocked.

Target and artifact context

A self-authored ES module supplied as decoded app.mjs text to the production artifact-analysis boundary. It contains ordinary local objects and functions, without imports, getters, coercion hooks or external dependencies.

Interface

Other

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

Final-run output:

{"case":"tag_write","parse_failures":0,"semantic_coverage":"complete","return_coverage":"complete","projection_complete":true,"field":{"path":"","presence":"present","state":"literal","value":1,"reason":null},"native":2}
{"case":"tag_alias","parse_failures":0,"semantic_coverage":"complete","return_coverage":"complete","projection_complete":true,"field":{"path":"","presence":"present","state":"literal","value":1,"reason":null},"native":2}
{"case":"tag_argument","parse_failures":0,"semantic_coverage":"complete","return_coverage":"complete","projection_complete":true,"field":{"path":"","presence":"present","state":"literal","value":1,"reason":null},"native":2}
{"case":"ordinary_call","parse_failures":0,"semantic_coverage":"complete","return_coverage":"complete","projection_complete":true,"field":{"path":"","presence":"present","state":"unknown","value":null,"reason":"Own property x is unknown-coverage."},"native":2}
{"case":"no_invocation","parse_failures":0,"semantic_coverage":"complete","return_coverage":"complete","projection_complete":true,"field":{"path":"","presence":"present","state":"literal","value":1,"reason":null},"native":1}

Expected source: The pinned documented local-reference/alias uncertainty contract linked above, plus the executed ordinary-call control.
Failure source: The executed production artifact-analysis, module-retention and export-return projection calls shown inline; their projected fields are the contrary observations.
Evidence provenance: observed.
Local verification: reproduced.
Reproduction completeness: complete at the production analysis/projection boundary.

Source inspection established public-path applicability: CLI registration accepts an ordinary application directory; the shared service calls reconstruction; its worker uses the same parser/semantic pass and module retention; module relationships consume the same export-return projection. The probe supplied supported decoded module text and recovered an exact exported-callable link, without parser errors or source exclusions. This establishes normal-path applicability under successful worker/resource admission; it does not claim an executed isolated worker or transport.

Typed outcome or recovery expected

The three tag-return mutation cases should stop publishing literal 1; conservative unknown is an acceptable restored result. Preserve the no-invocation control's literal 1 and the ordinary-call control's uncertainty. This is a proposed restoration check; no fix was implemented.

Analysis or suspected cause

Source-derived: the member-mutation traversal exposes references returned by ordinary calls, optional calls and constructors. Its tagged-template branch exposes the method receiver and interpolated expressions but omits references handed back by the tag function. The tag in this fixture is a bare local arrow and has no interpolation or method receiver, so those branches do not invalidate state. The reference branch expansion also has no tagged-result case. These source observations explain the discriminating control without claiming a repair was tested or requiring target execution.

Additional context

The supplied open-issue corpus was searched before probing. Live open and closed searches covered tagged template, tagged-template, template tag, and tagged/reference/stale-literal combinations. Historical closed #1449 concerns ordinary function-return references; this report's ordinary-call control already becomes unknown at the tested baseline, while the tagged invocation still retains the stale literal. #6670 concerns implicit primitive coercion, which the reproducer does not use. No matching tagged-result report was found. NOT_ENOUGH_INFO: introducing revision, last known good release, released-package behavior, CLI/MCP execution and downstream comparison reproduction.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: Three bounded valid source forms produce an obsolete literal in exported return evidence, contradicted by native controls; no severe downstream incident was demonstrated.
Workaround status: unverified
Workaround basis: Replacing a tag with an ordinary call changes the original artifact and is only a control. No practical route preserving the original artifact was verified.

Originally created by @coygeek on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6673 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Evidence, artifacts, or reconstruction ## Observed behavior The production JavaScript artifact analyzer and export-return projection publish literal `1` after a local template tag returns an object and a write through that result changes its `x` property to `2`. Native execution of the self-authored fixture returns `2`. Replacing the tagged invocation with an ordinary call correctly produces an unknown return field. This is an executed source-boundary finding; the released CLI and MCP transports were not run. ## Reproduction From the source checkout identified under REA version, with its locked dependencies available, run the following command. The same script body ran once in the final five-case verification and exited zero. Earlier exploratory production-boundary probes also observed the three affected forms. The fixtures are small known reproductions, not claimed to be minimized. ```sh node --import ./node_modules/tsx/dist/loader.mjs --input-type=module <<'JS' import { createHash } from 'node:crypto'; import { analyzeJavaScriptArtifactFiles } from './src/application/javascript/JavaScriptArtifactAnalysis.ts'; import { projectJavaScriptModuleSemantics } from './src/domain/javascript/javascriptModuleSemanticIr.ts'; import { projectJavaScriptExportReturnShapes } from './src/domain/javascript/javascriptExportReturnShapeProjection.ts'; import { completeApplicationCoverage } from './src/domain/javascript/javascriptApplicationEvidenceSchemas.ts'; const cases = { tag_write: 'export function read(){const state={x:1};const tag=()=>state;tag``.x=2;return state.x;}', tag_alias: 'export function read(){const state={x:1};const tag=()=>state;const ref=tag``;ref.x=2;return state.x;}', tag_argument: 'export function read(){const state={x:1};const tag=()=>state;const put=(ref)=>{ref.x=2;};put(tag``);return state.x;}', ordinary_call: 'export function read(){const state={x:1};const tag=()=>state;tag().x=2;return state.x;}', no_invocation: 'export function read(){const state={x:1};const tag=()=>state;return state.x;}', }; for (const [name, source] of Object.entries(cases)) { const sha = createHash('sha256').update(source).digest('hex'); const analysis = analyzeJavaScriptArtifactFiles({ files: [{ path: 'app.mjs', container_sha256: sha, sha256: sha, bytes: Buffer.byteLength(source), inventory_artifact_id: `art_${sha}`, kind: 'javascript', unpacked: false, text: { included: true, value: source } }], containers: [], unavailable_relevant_files: [], text_bytes_read: Buffer.byteLength(source), invalid_utf8_files: 0, }); const ir = analysis.files[0]?.semantic?.ir; if (!ir) throw new Error('Missing semantic IR'); const module = projectJavaScriptModuleSemantics(ir); const link = module.moduleLinks.find(item => item.exportedName === 'read'); if (!link) throw new Error('Missing read export'); const projection = projectJavaScriptExportReturnShapes({ ir: module, link, modulePath: 'app.mjs', baseCoverage: completeApplicationCoverage(), }); if (!projection) throw new Error('Missing return projection'); const shape = projection.properties.static_return_shapes[0]; const native = Function(source.replace('export ', '') + ';return read();')(); console.log(JSON.stringify({ case: name, parse_failures: analysis.parse_failures, semantic_coverage: ir.coverage.status, return_coverage: projection.properties.return_shape_coverage.status, projection_complete: projection.properties.return_shape_coverage.projection_complete, field: shape.fields[0], native, })); } JS ``` REA analyzes the inert source strings. The separate `Function` call executes only these self-authored, self-contained fixtures as a native-language reference control. ## Expected behavior A reference returned by a local function must retain mutation uncertainty when that function is invoked as a template tag. Do not publish the old `state.x` as a definite literal after a write through the returned object or an alias. Unknown is sufficient; recovering the exact post-write value is not required. The [documented export-return contract](https://github.com/morluto/rea/blob/99a5ffae3bf3d73f11bca3d9b8893347964b10b9/docs/javascript-application-workflows.md#L367-L391) preserves uncertainty for calls, tagged templates, returned local references and aliases. The executed ordinary-call control demonstrates the existing treatment of the same function and returned object. ## Impact and scope Three valid tagged-invocation forms produce a stale exported return fact: writing the tag result directly, saving it in an alias before writing, and passing it to a local mutating function. Every affected final-run case has zero parse failures and complete semantic/return coverage. The ordinary-call control becomes unknown, while the no-invocation control retains the correct `1`. Complete coverage here describes retained syntax, not proof that the target ran. Real-application prevalence, downstream comparison effects, other tag forms and other platforms were not measured. ## REA version Source `99a5ffae3bf3d73f11bca3d9b8893347964b10b9`, package version 6.7.0. The parent investigation identified 6.7.0 as the latest published package; these observations concern the stated source checkout, not an executed package installation. ## Runtime and platform Node.js v24.22.1; Linux x86_64; repository lockfile dependencies. No external analysis provider was started or mocked. ## Target and artifact context A self-authored ES module supplied as decoded `app.mjs` text to the production artifact-analysis boundary. It contains ordinary local objects and functions, without imports, getters, coercion hooks or external dependencies. ## Interface Other ## Earliest failure stage Native analysis or reconstruction ## Relevant output or evidence Final-run output: ```jsonl {"case":"tag_write","parse_failures":0,"semantic_coverage":"complete","return_coverage":"complete","projection_complete":true,"field":{"path":"","presence":"present","state":"literal","value":1,"reason":null},"native":2} {"case":"tag_alias","parse_failures":0,"semantic_coverage":"complete","return_coverage":"complete","projection_complete":true,"field":{"path":"","presence":"present","state":"literal","value":1,"reason":null},"native":2} {"case":"tag_argument","parse_failures":0,"semantic_coverage":"complete","return_coverage":"complete","projection_complete":true,"field":{"path":"","presence":"present","state":"literal","value":1,"reason":null},"native":2} {"case":"ordinary_call","parse_failures":0,"semantic_coverage":"complete","return_coverage":"complete","projection_complete":true,"field":{"path":"","presence":"present","state":"unknown","value":null,"reason":"Own property x is unknown-coverage."},"native":2} {"case":"no_invocation","parse_failures":0,"semantic_coverage":"complete","return_coverage":"complete","projection_complete":true,"field":{"path":"","presence":"present","state":"literal","value":1,"reason":null},"native":1} ``` - Expected source: The pinned documented local-reference/alias uncertainty contract linked above, plus the executed ordinary-call control. - Failure source: The executed production artifact-analysis, module-retention and export-return projection calls shown inline; their projected fields are the contrary observations. - Evidence provenance: observed. - Local verification: reproduced. - Reproduction completeness: complete at the production analysis/projection boundary. Source inspection established public-path applicability: [CLI registration](https://github.com/morluto/rea/blob/99a5ffae3bf3d73f11bca3d9b8893347964b10b9/src/cli/electronCommands.ts#L302-L338) accepts an ordinary application directory; the [shared service](https://github.com/morluto/rea/blob/99a5ffae3bf3d73f11bca3d9b8893347964b10b9/src/application/javascript/JavaScriptApplicationService.ts#L41-L86) calls reconstruction; its [worker](https://github.com/morluto/rea/blob/99a5ffae3bf3d73f11bca3d9b8893347964b10b9/src/composition/javascriptAnalysisWorkerProcess.ts#L25-L64) uses the same parser/semantic pass and module retention; [module relationships](https://github.com/morluto/rea/blob/99a5ffae3bf3d73f11bca3d9b8893347964b10b9/src/application/javascript/JavaScriptModuleRelationships.ts#L180-L192) consume the same export-return projection. The probe supplied supported decoded module text and recovered an exact exported-callable link, without parser errors or source exclusions. This establishes normal-path applicability under successful worker/resource admission; it does not claim an executed isolated worker or transport. ## Typed outcome or recovery expected The three tag-return mutation cases should stop publishing literal `1`; conservative unknown is an acceptable restored result. Preserve the no-invocation control's literal `1` and the ordinary-call control's uncertainty. This is a proposed restoration check; no fix was implemented. ## Analysis or suspected cause Source-derived: the [member-mutation traversal](https://github.com/morluto/rea/blob/99a5ffae3bf3d73f11bca3d9b8893347964b10b9/src/domain/javascript/javascriptSemanticMemberMutations.ts#L891-L923) exposes references returned by ordinary calls, optional calls and constructors. Its tagged-template branch exposes the method receiver and interpolated expressions but omits references handed back by the tag function. The tag in this fixture is a bare local arrow and has no interpolation or method receiver, so those branches do not invalidate `state`. The [reference branch expansion](https://github.com/morluto/rea/blob/99a5ffae3bf3d73f11bca3d9b8893347964b10b9/src/domain/javascript/javascriptSemanticMemberMutations.ts#L1187-L1214) also has no tagged-result case. These source observations explain the discriminating control without claiming a repair was tested or requiring target execution. ## Additional context The supplied open-issue corpus was searched before probing. Live open and closed searches covered `tagged template`, `tagged-template`, `template tag`, and tagged/reference/stale-literal combinations. Historical closed [#1449](https://github.com/morluto/rea/issues/1449) concerns ordinary function-return references; this report's ordinary-call control already becomes unknown at the tested baseline, while the tagged invocation still retains the stale literal. [#6670](https://github.com/morluto/rea/issues/6670) concerns implicit primitive coercion, which the reproducer does not use. No matching tagged-result report was found. NOT_ENOUGH_INFO: introducing revision, last known good release, released-package behavior, CLI/MCP execution and downstream comparison reproduction. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: Three bounded valid source forms produce an obsolete literal in exported return evidence, contradicted by native controls; no severe downstream incident was demonstrated. - Workaround status: unverified - Workaround basis: Replacing a tag with an ordinary call changes the original artifact and is only a control. No practical route preserving the original artifact was verified.

bsakaguchi closed this issue

2026-10-31 00:46:23 +00:00

bsakaguchi referenced this issue

2026-10-31 01:11:15 +00:00

[PR #4052] [MERGED] fix(kuna): keep the run slot of an unproven stop until close proves it #6022

bsakaguchi referenced this issue

2026-10-31 01:11:20 +00:00

[PR #4071] [MERGED] feat(kuna): add bounded call relationships and exact xrefs #6035