mirror of
https://github.com/abhigyanpatwari/GitNexus.git
synced 2026-10-28 06:22:22 +00:00
d5e9c8e650
Addresses every finding from the multi-engine review of this PR.
P0 — THE FOLD FABRICATED A CALLS EDGE.
`foldReceiverChain` resolved its base through `resolveCompoundReceiverClass`,
whose bare-identifier branch falls through to a plain class-name lookup EVEN
WHEN a receiver typeBinding exists but names no class. The dotted-chain head
is deliberately narrower — it consults the class namespace only when there is
no binding at all. So a local that merely SHADOWS a class name was typed as
that class:
const Config = make(1); // a number
Config.db.query(); // emitted entry -> Database.query
A/B, reverting only the fold wiring:
with fold: ["entry -> query", "entry -> make", "Config -> Database"]
without fold: ["entry -> make", "Config -> Database"]
A confident wrong edge, and a direct violation of R4 — the one outcome this
whole line of work exists to prevent. Fixed with an opt-in `strictBaseBinding`
that makes the fold's base obey the same rule as the cascade's head. The flag
is OFF for the cascade, so no existing edge moves; measured, every shape that
resolved before still resolves and no other language's drop count changed.
P0 — `impact()` INTERPOLATED A FUNCTION INTO USER-FACING TEXT.
`summary?.counts?.[symName]` walks `Object.prototype`, so `constructor`,
`toString`, `valueOf`, `hasOwnProperty` and friends returned a Function rather
than `undefined` — and `NaN <= 0` is false, so the `<= 0` guard let it through:
impact({target: "constructor"})
-> "function Object() { [native code] } call sites invoking `constructor`…"
plus a bogus `epistemic: 'lower-bound'`. `constructor` is an ordinary member
name in a code graph, so this was reachable in normal use. The lookup is now one
exported, prototype-safe helper (`lookupUnresolvedCallCount`) that both the
backend and its test use, instead of an inline index expression.
P1 — BOTH SCHEMA CONSTANTS WERE BUMPED BEFORE THE FINAL DIVERGENCE.
`SCHEMA_BUMP` 32 landed at the TypeScript-only commit and `INCREMENTAL_SCHEMA_VERSION`
26 before the fold's semantics were final, but the rollout to the other 13
languages then changed captures AND edges under the same numbers. An index or
cache stamped by an intermediate build was therefore treated as current at HEAD
while serving pre-rollout captures for 13 languages and the fabricated edges
above. Re-bumped to 33 / 27 so each number tracks the FINAL state rather than
the first divergence, with the reuse-gate ladder updated to match.
P2 — the summary counted property reads and writes as "call sites". It now
filters on the `siteKind` this series added for exactly that purpose. On the
fixture corpus that is 25 of 124 drops, so names whose CALL count was never
short no longer report `lower-bound`, and the consumer's "N call sites invoking
X" is now literally true.
P2 — two tests did not test what they claimed. The negative assertion named a
member (`noSuchMember`) that appeared nowhere else in the repo, so it could not
fail; it now uses a chain with a genuinely broken middle step and asserts the
tail does not bind while the head still does. And "resolves a mixed call/field
chain through the fold" used a shape the pre-existing cascade already handled —
it now uses an optional-chained spelling, verified to FAIL with the fold
reverted.
P3s: stale "NOT WIRED" JSDoc removed (it was wired 71 lines below); the
zero-width character class added to `isEncodableSegment` (`\s` misses U+200B-F
and U+FEFF, a trojan-source vector that would encode, persist, then silently
match nothing); the unreachable `?? ''` replaced; the store sanitizer's doc no
longer claims parity with `sanitizeCallableFlowSites` it does not have; the
truncation marker documented as a reserved forward-compatible contract rather
than live; `--check`'s scope stated plainly so a green run is not read as a
performance guard; and the orphaned "current stamp passes the gate" comment and
its duplicate assertion removed.
Test gaps closed: behavioural proof for a SECOND language (`cpp-receiver-chain-arrow`,
the `->` base the rollout actually fixed, with the value-dot control that shows
why `cpp-chain-call/` could never catch it); the `hoistTypeBindingsToModule: false`
branch that six wired languages run; adversarial payloads through
`decodeReceiverChain`; the MAX_CHAIN_DEPTH boundary that must still WORK; and
per-field sanitation proven to leave a VALID sibling's chain intact.
Every regression test was verified to fail without its fix.
4412 tests green, tsc clean in both packages, all bench gates pass.
|
||
|---|---|---|
| .. | ||
| fixtures | ||
| helpers | ||
| integration | ||
| unit | ||
| utils | ||