morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #7543] [Bug] A source-free bundle script becomes ambiguous with a module inside its own asset #4484

New issue

Closed

opened 2026-10-31 00:50:11 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:50:11 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 27, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7543

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

After analyzing a directory containing a single webpack bundle, node scripts/rea.mjs reconcile-javascript-runtime INPUT --json returns an ambiguous script correspondence when the runtime Evidence omits captured source bytes. The script URL maps to exactly one file, chunks/runtime.js, in the only static layer. The result lists that file's asset node and its embedded module registration as two competing candidates, both with that same path.

The command exits 0. The asset stays unknown, no script correspondence edge is produced, and summary.static_loaded is zero. The containing chunk receives not-observed-in-capture. Adding captured bytes for the same script, file, and mapping produces a successful asset correspondence and resident states for its contained code.

Reproduction

Use the baseline under REA version, its locked dependencies, the existing compiled runtime, and Node.js 24.22.1. The verification checkout was already built; dependency installation and rebuilding were not part of the observed run. From the checkout root, create an isolated working directory and save the following complete script. It creates all inputs inline, runs the real analysis and reconciliation CLIs, and constructs schema-validated synthetic passive browser Evidence. It does not connect to CDP or run the bundle.

case_root="$(mktemp -d)"
mkdir -p "$case_root/home"
export HOME="$case_root/home"
export XDG_CONFIG_HOME="$HOME/config" XDG_CACHE_HOME="$HOME/cache"
export XDG_DATA_HOME="$HOME/data" XDG_STATE_HOME="$HOME/state"
cat > "$case_root/reproduce.mjs" <<'JS'
import { mkdirSync, writeFileSync } from 'node:fs';
import { resolve, join } from 'node:path';
import { pathToFileURL } from 'node:url';
import { execFileSync } from 'node:child_process';
const repo = process.cwd();
const root = resolve(process.argv[2]);
const { createBrowserEvidence } = await import(pathToFileURL(join(repo, 'dist/application/BrowserEvidence.js')));
const { inspectWebPageInputSchema } = await import(pathToFileURL(join(repo, 'dist/domain/browserObservation.js')));
const { webPageInspectionSchema } = await import(pathToFileURL(join(repo, 'dist/domain/browserObservationSchemas.js')));
const { createWebTextArtifact } = await import(pathToFileURL(join(repo, 'dist/domain/webContentArtifact.js')));
const app = join(root, 'app');
mkdirSync(join(app, 'chunks'), { recursive: true });
const bundle = '(globalThis["webpackChunkfixture"] = globalThis["webpackChunkfixture"] || []).push([["main"],{1:(module)=>{module.exports=1;}},(__webpack_require__)=>{__webpack_require__(1);}]);\n';
writeFileSync(join(app, 'chunks/runtime.js'), bundle);
const run = (...args) => JSON.parse(execFileSync(process.execPath, ['scripts/rea.mjs', ...args, '--json'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }));
const analysis = run('analyze-javascript-application', app);
writeFileSync(join(root, 'analysis.json'), JSON.stringify(analysis));
const origin = 'https://bundle.example.test';
const timestamp = new Date(Number(execFileSync('/bin/date', ['+%s'], { encoding: 'utf8', env: {...process.env, TZ:'America/Los_Angeles'} }).trim()) * 1000).toISOString();
for (const included of [false, true]) {
  const input = inspectWebPageInputSchema.parse({ cdp_endpoint: 'http://127.0.0.1:9222', target_id:'page', allowed_origins:[origin], observation_ms:0, include_script_sources:included });
  const inspection = webPageInspectionSchema.parse({
    browser:{ product:'normalized-fixture',protocol_version:'1.3',revision:'fixture',user_agent:'fixture',js_version:'fixture' },
    target:{target_id:'page',type:'page',title:'Fixture',url:origin,origin,attached:false},
    capture_window:{started_at:timestamp,ended_at:timestamp,observation_ms:0},
    completeness:{status:'complete_within_window',conditions:['complete_within_window'],policy_filtered_sections:[],attach_limited_sections:[],truncated_sections:[],unavailable_sections:[],excluded:[],dropped_events:{scripts:0,network_requests:0,console_events:0,websocket_connections:0,websocket_frames:0,webmcp_tools:0,timeline_events:0,total:0}},
    network:{requests:[],websocket_connections:[],coverage_started_at:timestamp,prior_activity_available:false},
    frames:[{frame_id:'frame-main',parent_frame_id:null,url:origin,origin}],
    dom:{total_nodes:0,nodes:[]},
    accessibility:{total_nodes:0,nodes:[],text_capture:{status:'not_approved',retained_bytes:0,excluded_fields:0}},
    scripts:{total:1,items:[{script_key:'scr_'+'0'.repeat(64),frame_id:'frame-main',url:origin+'/assets/chunks/runtime.js',origin,cdp_hash:null,length:Buffer.byteLength(bundle),is_module:false,language:'JavaScript',source_map_url:null,resource_reconciliation:{status:'unmatched',reason:'no_exact_sanitized_url'},source:included?{included:true,artifact:createWebTextArtifact(bundle,'text/javascript')}:{included:false,reason:'not-requested'}}]},
    resources:[],workers:[],console:{events:[],coverage_started_at:timestamp,prior_activity_available:false},
    metadata:{responses:[],dom_urls:[],agent_hints:[],excluded_dom_urls:0,headers_allowlisted:true},
    storage:{origin,usage_bytes:null,quota_bytes:null,local_storage_keys:[],session_storage_keys:[],indexed_db_names:[],cache_names:[],values_redacted:true},
    limitations:['Synthetic offline fixture; no live browser was contacted.']
  });
  const runtime = createBrowserEvidence('inspect_web_page',input,inspection,{id:'rea-cdp-browser',name:'REA Chrome DevTools Protocol observation provider',version:'2'});
  const inputPath = join(root,`input-${included}.json`);
  writeFileSync(inputPath,JSON.stringify({static_layers:[{role:'application',analysis,runtime_mappings:[{kind:'url-prefix',prefix:origin+'/assets/',artifact_prefix:''}]}],runtime_observations:[runtime]}));
  const result = run('reconcile-javascript-runtime',inputPath);
  writeFileSync(join(root,`result-${included}.json`),JSON.stringify(result));
  const r=result.normalized_result;
  const script=r.reconciliations.find(x=>x.entity_kind==='script');
  const candidates=script.candidate_static_nodes.map(x=>r.graph.nodes.find(n=>n.node_id===x.static_node_id)).map(n=>({kind:n.kind,paths:[...new Set(n.observations.map(o=>o.properties.path).filter(Boolean))]}));
  console.log(JSON.stringify({included,script,candidates,load_states:r.static_load_states,summary:r.summary,coverage:r.coverage,graph_coverage:r.graph.coverage}));
}
JS
node "$case_root/reproduce.mjs" "$case_root"

Compare the two JSON lines. For included: false, the script has status ambiguous, basis operator-url-mapping, reason ambiguous-static-candidates, and two candidates at chunks/runtime.js. For included: true, it has status matched, basis content-and-location, and one candidate: the asset. The script retains the full analysis, inputs, and outputs beneath the chosen directory.
Replay the source-free input directly:

node scripts/rea.mjs reconcile-javascript-runtime "$case_root/input-false.json" --json

The source-free result reproduced twice, including the direct replay. The replay's normalized result was exactly equal to the first source-free result. The captured-source control ran once and matched successfully.

Expected behavior

The reconciliation guide permits a medium-confidence location match when source bytes are absent and one unique mapped artifact path identifies the script. Its load-state contract distinguishes an observed containing asset from resident code inside that asset.

This fixture has one addressable file at the mapped location. Its embedded module should not make that file compete with itself. The asset should receive the location correspondence and become loaded; contained code should receive resident-in-loaded-asset. These states should retain their documented limits: they establish presence, without proving that a module initialized or a feature executed. Genuine competing artifacts or layers must still remain ambiguous.

Impact and scope

Impact level: P2. Assessment status: supported. A valid, bounded reconciliation input misses a positive script-to-file correspondence and produces misleading load-state information even though both static and derived graph coverage are complete. Source-free inspection is supported and is the default browser source-capture mode. The retained source Evidence is not modified.

Workaround status: available. In the executed control, including the exact bundle source bytes produced the correct asset match and resident classifications. For an existing capture without those bytes, callers can inspect the returned candidate paths and graph containment rather than interpreting the chunk's absence state as an established absence. Capturing source bytes later requires another authorized capture; the control does not reconstruct bytes missing from an earlier observation.

Verified scope is one small webpack fixture, one application directory layer, one URL-prefix mapping, and synthetic browser inspection Evidence. Rspack, larger bundles, multiple static layers, and live browser capture were not tested. The finding does not depend on incomplete capture coverage.

REA version

Exact output from node scripts/rea.mjs --version:

6.8.0

Baseline confirmed with git rev-parse HEAD: 65f1c447344a423fa2785847dbcea1e9a9e2454a.

Runtime and platform

Node.js v24.22.1; macOS 27.0.1; arm64. The analysis CLI used its normal supervised subprocess path. No process-command substitution or in-process analysis workaround was used.

Target and artifact context

One generated webpack chunk registration with one module factory in chunks/runtime.js. The runtime input describes one classic browser script with a declared URL-prefix mapping into that directory. Browser metadata, inventory, and source inclusion are synthetic offline fixtures; no browser provider was launched or contacted.

Interface

CLI

Earliest failure stage

Transport or result projection

Relevant output or evidence

Selected fields from the real CLI outputs created by the reproduction:

source omitted:
  script.status: ambiguous
  script.basis: operator-url-mapping
  script.confidence: unknown
  script.reason: ambiguous-static-candidates
  script.candidate_static_count: 2
  candidate paths: javascript-asset chunks/runtime.js
                   javascript-module chunks/runtime.js
  asset load state: unknown / ambiguous-runtime-candidate
  chunk load state: not-observed-in-capture / not-observed-in-bounded-capture
  summary.static_loaded: 0
  summary.static_resident: 0
  summary.static_not_observed: 2

source included:
  script.status: matched
  script.basis: content-and-location
  script.reason: content-and-location-match
  script.candidate_static_count: 1
  asset load state: loaded / runtime-script-correspondence
  chunk load state: resident-in-loaded-asset / containing-asset-was-loaded
  summary.static_loaded: 1
  summary.static_resident: 3
  summary.static_not_observed: 0

both results:
  coverage.status: complete-within-inputs
  graph.coverage.status: complete

The source-free output has zero observed_as edges to the runtime script. Besides the asset and registered module candidates, the graph contains semantic source-module nodes: one contained source module is also reported absent in the source-free case and resident in the captured-source control. The selected rows above are not an exhaustive inventory.

Expected contract: docs/javascript-runtime-reconciliation.md:101-107 describes source-free location correspondence and qualified ambiguity; lines 130-139 define loaded, resident, and unresolved states. Input default: src/domain/browserObservation.ts:223 defaults include_script_sources to false for the source-free inspection variant.

Typed outcome or recovery expected

For the source-free fixture, return the asset's accepted medium-confidence location match, with a corresponding inferred edge and resident classifications for contained code. Preserve candidate ambiguity when it concerns independently plausible script artifacts, and preserve the captured-source control's successful match.

Analysis or suspected cause

Source-derived explanation at the stated baseline: src/application/javascript/JavaScriptArtifactGraphBundlers.ts:119-155 records the containing file's path on each recovered bundle module. src/domain/javascript/javascriptRuntimeStaticCandidates.ts:154-171 includes both assets and non-source-module JavaScript modules in the same candidate category; its path extraction at lines 202-235 retains that shared file path. src/domain/javascript/javascriptRuntimeReconciliationMatching.ts:91-109 selects ambiguity whenever the location candidate count exceeds one. Its locateEntity implementation at lines 208-250 keeps separate node-qualified candidates even when the candidates describe a file and code contained within that file.

The load-state projection can only classify contained nodes as resident after the asset receives a positive match. This explains why the captured-source control restores both the asset correspondence and the contained-node states. A fix needs to distinguish whole-file location identity from contained factory identity while retaining supported module-source digest matching.

Additional context

Searched open and closed issues, issue comments, and all PR states. Related closed issue #3192 intentionally retains ambiguity between two separate static layers and fixes their candidate load states to unknown. That fix is visible here: both competing candidate nodes are already unknown. This report concerns the earlier decision to manufacture competition between a file and a module inside that same file; its closure signal is successful source-free asset correspondence.

Other inspected reports concern mapped digest mismatch (#3316), encoded URL separators (#5878), unavailable worker inventory (#5884), missing mappings (#6061), reused bundler module IDs (#1576), and POSIX path case semantics on Windows (#2524). None describes this single-file location ambiguity. No security boundary was crossed in the reproduction.

Originally created by @coygeek on GitHub (Oct 27, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7543 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior After analyzing a directory containing a single webpack bundle, `node scripts/rea.mjs reconcile-javascript-runtime INPUT --json` returns an ambiguous script correspondence when the runtime Evidence omits captured source bytes. The script URL maps to exactly one file, `chunks/runtime.js`, in the only static layer. The result lists that file's asset node and its embedded module registration as two competing candidates, both with that same path. The command exits 0. The asset stays `unknown`, no script correspondence edge is produced, and `summary.static_loaded` is zero. The containing chunk receives `not-observed-in-capture`. Adding captured bytes for the same script, file, and mapping produces a successful asset correspondence and resident states for its contained code. ### Reproduction 1. Use the baseline under REA version, its locked dependencies, the existing compiled runtime, and Node.js 24.22.1. The verification checkout was already built; dependency installation and rebuilding were not part of the observed run. From the checkout root, create an isolated working directory and save the following complete script. It creates all inputs inline, runs the real analysis and reconciliation CLIs, and constructs schema-validated synthetic passive browser Evidence. It does not connect to CDP or run the bundle. ```sh case_root="$(mktemp -d)" mkdir -p "$case_root/home" export HOME="$case_root/home" export XDG_CONFIG_HOME="$HOME/config" XDG_CACHE_HOME="$HOME/cache" export XDG_DATA_HOME="$HOME/data" XDG_STATE_HOME="$HOME/state" cat > "$case_root/reproduce.mjs" <<'JS' import { mkdirSync, writeFileSync } from 'node:fs'; import { resolve, join } from 'node:path'; import { pathToFileURL } from 'node:url'; import { execFileSync } from 'node:child_process'; const repo = process.cwd(); const root = resolve(process.argv[2]); const { createBrowserEvidence } = await import(pathToFileURL(join(repo, 'dist/application/BrowserEvidence.js'))); const { inspectWebPageInputSchema } = await import(pathToFileURL(join(repo, 'dist/domain/browserObservation.js'))); const { webPageInspectionSchema } = await import(pathToFileURL(join(repo, 'dist/domain/browserObservationSchemas.js'))); const { createWebTextArtifact } = await import(pathToFileURL(join(repo, 'dist/domain/webContentArtifact.js'))); const app = join(root, 'app'); mkdirSync(join(app, 'chunks'), { recursive: true }); const bundle = '(globalThis["webpackChunkfixture"] = globalThis["webpackChunkfixture"] || []).push([["main"],{1:(module)=>{module.exports=1;}},(__webpack_require__)=>{__webpack_require__(1);}]);\n'; writeFileSync(join(app, 'chunks/runtime.js'), bundle); const run = (...args) => JSON.parse(execFileSync(process.execPath, ['scripts/rea.mjs', ...args, '--json'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] })); const analysis = run('analyze-javascript-application', app); writeFileSync(join(root, 'analysis.json'), JSON.stringify(analysis)); const origin = 'https://bundle.example.test'; const timestamp = new Date(Number(execFileSync('/bin/date', ['+%s'], { encoding: 'utf8', env: {...process.env, TZ:'America/Los_Angeles'} }).trim()) * 1000).toISOString(); for (const included of [false, true]) { const input = inspectWebPageInputSchema.parse({ cdp_endpoint: 'http://127.0.0.1:9222', target_id:'page', allowed_origins:[origin], observation_ms:0, include_script_sources:included }); const inspection = webPageInspectionSchema.parse({ browser:{ product:'normalized-fixture',protocol_version:'1.3',revision:'fixture',user_agent:'fixture',js_version:'fixture' }, target:{target_id:'page',type:'page',title:'Fixture',url:origin,origin,attached:false}, capture_window:{started_at:timestamp,ended_at:timestamp,observation_ms:0}, completeness:{status:'complete_within_window',conditions:['complete_within_window'],policy_filtered_sections:[],attach_limited_sections:[],truncated_sections:[],unavailable_sections:[],excluded:[],dropped_events:{scripts:0,network_requests:0,console_events:0,websocket_connections:0,websocket_frames:0,webmcp_tools:0,timeline_events:0,total:0}}, network:{requests:[],websocket_connections:[],coverage_started_at:timestamp,prior_activity_available:false}, frames:[{frame_id:'frame-main',parent_frame_id:null,url:origin,origin}], dom:{total_nodes:0,nodes:[]}, accessibility:{total_nodes:0,nodes:[],text_capture:{status:'not_approved',retained_bytes:0,excluded_fields:0}}, scripts:{total:1,items:[{script_key:'scr_'+'0'.repeat(64),frame_id:'frame-main',url:origin+'/assets/chunks/runtime.js',origin,cdp_hash:null,length:Buffer.byteLength(bundle),is_module:false,language:'JavaScript',source_map_url:null,resource_reconciliation:{status:'unmatched',reason:'no_exact_sanitized_url'},source:included?{included:true,artifact:createWebTextArtifact(bundle,'text/javascript')}:{included:false,reason:'not-requested'}}]}, resources:[],workers:[],console:{events:[],coverage_started_at:timestamp,prior_activity_available:false}, metadata:{responses:[],dom_urls:[],agent_hints:[],excluded_dom_urls:0,headers_allowlisted:true}, storage:{origin,usage_bytes:null,quota_bytes:null,local_storage_keys:[],session_storage_keys:[],indexed_db_names:[],cache_names:[],values_redacted:true}, limitations:['Synthetic offline fixture; no live browser was contacted.'] }); const runtime = createBrowserEvidence('inspect_web_page',input,inspection,{id:'rea-cdp-browser',name:'REA Chrome DevTools Protocol observation provider',version:'2'}); const inputPath = join(root,`input-${included}.json`); writeFileSync(inputPath,JSON.stringify({static_layers:[{role:'application',analysis,runtime_mappings:[{kind:'url-prefix',prefix:origin+'/assets/',artifact_prefix:''}]}],runtime_observations:[runtime]})); const result = run('reconcile-javascript-runtime',inputPath); writeFileSync(join(root,`result-${included}.json`),JSON.stringify(result)); const r=result.normalized_result; const script=r.reconciliations.find(x=>x.entity_kind==='script'); const candidates=script.candidate_static_nodes.map(x=>r.graph.nodes.find(n=>n.node_id===x.static_node_id)).map(n=>({kind:n.kind,paths:[...new Set(n.observations.map(o=>o.properties.path).filter(Boolean))]})); console.log(JSON.stringify({included,script,candidates,load_states:r.static_load_states,summary:r.summary,coverage:r.coverage,graph_coverage:r.graph.coverage})); } JS node "$case_root/reproduce.mjs" "$case_root" ``` 2. Compare the two JSON lines. For `included: false`, the script has status `ambiguous`, basis `operator-url-mapping`, reason `ambiguous-static-candidates`, and two candidates at `chunks/runtime.js`. For `included: true`, it has status `matched`, basis `content-and-location`, and one candidate: the asset. The script retains the full analysis, inputs, and outputs beneath the chosen directory. 3. Replay the source-free input directly: ```sh node scripts/rea.mjs reconcile-javascript-runtime "$case_root/input-false.json" --json ``` The source-free result reproduced twice, including the direct replay. The replay's normalized result was exactly equal to the first source-free result. The captured-source control ran once and matched successfully. ### Expected behavior The reconciliation guide permits a medium-confidence location match when source bytes are absent and one unique mapped artifact path identifies the script. Its load-state contract distinguishes an observed containing asset from resident code inside that asset. This fixture has one addressable file at the mapped location. Its embedded module should not make that file compete with itself. The asset should receive the location correspondence and become `loaded`; contained code should receive `resident-in-loaded-asset`. These states should retain their documented limits: they establish presence, without proving that a module initialized or a feature executed. Genuine competing artifacts or layers must still remain ambiguous. ### Impact and scope Impact level: P2. Assessment status: supported. A valid, bounded reconciliation input misses a positive script-to-file correspondence and produces misleading load-state information even though both static and derived graph coverage are complete. Source-free inspection is supported and is the default browser source-capture mode. The retained source Evidence is not modified. Workaround status: available. In the executed control, including the exact bundle source bytes produced the correct asset match and resident classifications. For an existing capture without those bytes, callers can inspect the returned candidate paths and graph containment rather than interpreting the chunk's absence state as an established absence. Capturing source bytes later requires another authorized capture; the control does not reconstruct bytes missing from an earlier observation. Verified scope is one small webpack fixture, one application directory layer, one URL-prefix mapping, and synthetic browser inspection Evidence. Rspack, larger bundles, multiple static layers, and live browser capture were not tested. The finding does not depend on incomplete capture coverage. ### REA version Exact output from `node scripts/rea.mjs --version`: ```text 6.8.0 ``` Baseline confirmed with `git rev-parse HEAD`: `65f1c447344a423fa2785847dbcea1e9a9e2454a`. ### Runtime and platform Node.js v24.22.1; macOS 27.0.1; arm64. The analysis CLI used its normal supervised subprocess path. No process-command substitution or in-process analysis workaround was used. ### Target and artifact context One generated webpack chunk registration with one module factory in `chunks/runtime.js`. The runtime input describes one classic browser script with a declared URL-prefix mapping into that directory. Browser metadata, inventory, and source inclusion are synthetic offline fixtures; no browser provider was launched or contacted. ### Interface CLI ### Earliest failure stage Transport or result projection ### Relevant output or evidence Selected fields from the real CLI outputs created by the reproduction: ```text source omitted: script.status: ambiguous script.basis: operator-url-mapping script.confidence: unknown script.reason: ambiguous-static-candidates script.candidate_static_count: 2 candidate paths: javascript-asset chunks/runtime.js javascript-module chunks/runtime.js asset load state: unknown / ambiguous-runtime-candidate chunk load state: not-observed-in-capture / not-observed-in-bounded-capture summary.static_loaded: 0 summary.static_resident: 0 summary.static_not_observed: 2 source included: script.status: matched script.basis: content-and-location script.reason: content-and-location-match script.candidate_static_count: 1 asset load state: loaded / runtime-script-correspondence chunk load state: resident-in-loaded-asset / containing-asset-was-loaded summary.static_loaded: 1 summary.static_resident: 3 summary.static_not_observed: 0 both results: coverage.status: complete-within-inputs graph.coverage.status: complete ``` The source-free output has zero `observed_as` edges to the runtime script. Besides the asset and registered module candidates, the graph contains semantic source-module nodes: one contained source module is also reported absent in the source-free case and resident in the captured-source control. The selected rows above are not an exhaustive inventory. Expected contract: `docs/javascript-runtime-reconciliation.md:101-107` describes source-free location correspondence and qualified ambiguity; lines 130-139 define loaded, resident, and unresolved states. Input default: `src/domain/browserObservation.ts:223` defaults `include_script_sources` to false for the source-free inspection variant. ### Typed outcome or recovery expected For the source-free fixture, return the asset's accepted medium-confidence location match, with a corresponding inferred edge and resident classifications for contained code. Preserve candidate ambiguity when it concerns independently plausible script artifacts, and preserve the captured-source control's successful match. ### Analysis or suspected cause Source-derived explanation at the stated baseline: `src/application/javascript/JavaScriptArtifactGraphBundlers.ts:119-155` records the containing file's path on each recovered bundle module. `src/domain/javascript/javascriptRuntimeStaticCandidates.ts:154-171` includes both assets and non-source-module JavaScript modules in the same candidate category; its path extraction at lines 202-235 retains that shared file path. `src/domain/javascript/javascriptRuntimeReconciliationMatching.ts:91-109` selects ambiguity whenever the location candidate count exceeds one. Its `locateEntity` implementation at lines 208-250 keeps separate node-qualified candidates even when the candidates describe a file and code contained within that file. The load-state projection can only classify contained nodes as resident after the asset receives a positive match. This explains why the captured-source control restores both the asset correspondence and the contained-node states. A fix needs to distinguish whole-file location identity from contained factory identity while retaining supported module-source digest matching. ### Additional context Searched open and closed issues, issue comments, and all PR states. Related closed issue [#3192](https://github.com/morluto/rea/issues/3192) intentionally retains ambiguity between two separate static layers and fixes their candidate load states to unknown. That fix is visible here: both competing candidate nodes are already unknown. This report concerns the earlier decision to manufacture competition between a file and a module inside that same file; its closure signal is successful source-free asset correspondence. Other inspected reports concern mapped digest mismatch ([#3316](https://github.com/morluto/rea/issues/3316)), encoded URL separators ([#5878](https://github.com/morluto/rea/issues/5878)), unavailable worker inventory ([#5884](https://github.com/morluto/rea/issues/5884)), missing mappings ([#6061](https://github.com/morluto/rea/issues/6061)), reused bundler module IDs ([#1576](https://github.com/morluto/rea/issues/1576)), and POSIX path case semantics on Windows ([#2524](https://github.com/morluto/rea/issues/2524)). None describes this single-file location ambiguity. No security boundary was crossed in the reproduction.

bsakaguchi closed this issue

2026-10-31 00:50:11 +00:00

bsakaguchi referenced this issue

2026-10-31 01:13:09 +00:00

[PR #4484] test(inspector): keep Node discovery fixtures out of underscored temp dirs #6269