Code Analysis ESM Forwarding

Explicit JS/TS ESM forwarding investigations

Snapshot:8 November2026. Draft #1271, 0e41f1e7fef84e19776305cfc8630311ff01e814, is the tenth native stack #1262 layer above Rust #1270. All nine lower heads, original commits/authors and PR ownership remain unchanged. Not in Labs; not approved, merged, released or installed.

One developer investigation gained

In Redux c9e06506, test/combineReducers.spec.ts:17:23 previously stopped at the public API module. Now the normal CLI follows redux -> src/index.ts -> its import at3 -> src/combineReducers.ts:123:1, the implementation body rather than overload signature114. createStore at test/createStore.spec.ts:26:19 reaches src/createStore.ts:86:1, not signatures41/75. Factory-returned reducer() flow remains a separate investigation gap.

Fixed source answers, source/ZIP runners, full audit and limits. Source freeze09745753a and v4 baseline2ae4a65a8 preceded implementation1dc65d74a; two calls were reserved from initial rule tuning. Redux was previously exposed, not a blind repository. The selected4calls move from4missed/0wrong to4correct/0wrong/0missed; external vi.fn remains unknown. Frozen AST spans are authoritative; the initial prose export-line offset is explicitly corrected without changing import/body answers.

Model and coverage

JS/TS v5 / adapter22 follows explicit local/imported function exports and explicit reexports over captured module-acyclic value paths, emitting every forwarding statement in calls[].via. A unique measured implementation body is required. Observed binding writes/direct eval, including parentheses and erased TS wrappers, block imported implementation attribution. Current navigation requires forwarding-file freshness. The existing captured resolver/checker/effects traversal is reused; no new SDK/resolver or upstream execution is added.

All201files/30,241call ranges/7,549functions/imports/3,594old targets are preserved. The205new targets all agree with an independent full-resolution TypeScript5.9.3 Program's unique implementation bodies:0different/0unavailable. The selected4are included in205. Its488diagnostics remain: this is definition agreement, not successful compilation, total recall or whole-project accuracy. A substituted wrong target is rejected, exit1.

Authored reassignment and parenthesized direct-eval controls returned replacement functions before the guard while old targets pointed at original bodies. They now remain unknown; these are controls, not natural project usage or extra accuracy samples. Star/type-only/dynamic/CommonJS/cyclic routes, arbitrary function-value aliases, factory returns and runtime initialization remain unproved. Same-file lexical declarations retain their prior contract. Historical v1–v4 captures are not rebound; actual saved v4 was replayed through source and ZIP readers.

Real changed-definition investigation

Redux cbde7c9b ->456cc345 changes nested combination's action annotation from AnyAction to Action. This changes outer and nested captured source text, not a claimed runtime effect. The supplemental version pair was chosen after implementation and is not a holdout. Before-version test callers are18/33, after17/32; the initial shared after-version coordinates were corrected by source AST after first paired observation and explicitly disclosed. No rule retuning followed.

Baseline captures0known references to either changed definition. Candidate captures51direct references to outer combineReducers per side, displays40and discloses11omitted. Only two selected test callers per side are independently source-verified here;51is not a graded correct-target count. Nested returned combination still has0known references because function-value flow is missing. Zero does not establish no callers. Paired status ready/exit0 means usable source orientation, not complete impact.

Reproduce and verification states

Use run.py --cli archify/bin/archify.mjs --sample /fixed/redux --out /runs/forwarded-exports-accepted-source, and real-change.py --cli archify/bin/archify.mjs --samples-root /fixed/samples --out /runs/forwarded-exports-pair-accepted-source from the linked benchmark. Pin manifest revisions, create clean redux-forward-before/after worktrees, and preserve hashes. Repeat with the unpacked ZIP CLI; use #1270's CLI and --expect baseline for v4. audit.mjs compares all new targets using a full-resolution Program without emitting/executing code; verify.py checks exact captures and normalized orientation parity.

• Local module397/397, zero skips; extracted calls/imported/question/paired62/62, zero skips. Scoped test-value and focused simplification reviews cover source-body identity, malformed routes, stale intermediates, mutable exports and changed callers without adding a second resolver.
• Source/ZIP three raw capture instances(two distinct payloads) byte-equal; five orientation payloads agree after only installation/output paths, including actual historical v4 and the real pair. Eight CLI commands per distribution all exit0. Repeated/overlapping observations are not independent samples.
• Two canonical Node22.23.3/zlib1.3.1-e00f703 builds agree;168module files match source. ZIP SHA256bb68b249ea7a64ac2dcf7238ae1664db44de12f6833155888ec060f6b20914bd. Node26.12.0 and existing TypeScript5.9.3 reused. Dependencies installed into the unpacked package, not a live Skill installation. No extra SDK or upstream project/config/test execution.
• Remote final-head CI42427971892 completed success at0e41f1e7f. Actual module job128570395955 executed397tests/397pass/0fail/0skip. All executed full-regression, browser, ZIP/WebM, website, three-platform package and both Windows portability jobs passed; deployment jobs were skipped. Other-language real-project evidence retains its original commit attribution.
• No approval, merge, release or installation. Continue source-backed wrong targets, misses and investigation interruptions across all six languages.

Historical CI: run42427586703 at28d5fe467 ended cancelled after ZIP freshness and website distribution failures because the verified archive was not committed. Artifact-only2eb69c7b5 committed the exact verified ZIP; intermediate run42427849058 was superseded/cancelled by final benchmark-only0e41f1e7f. Final-head results above are separate. Local website distribution1/1, root CLI routing1/1 and release identity pass; an initial identity invocation lacked parse5 until existing root dev dependencies were installed. Older alias recipe source/ZIP7correct/0wrong/0missed/1reasonable-unknown overlaps this cohort and retains the original v4 miss when replayed.