fix(javascript): preserve runtime path bytes and Electron ownership (#4941)

* fix(javascript): preserve literal percent runtime paths

* fix(javascript): ignore resolve prefixes before the final anchor

* fix(electron): retain application roots for loadFile declarations

* fix(electron): resolve loadFile from enclosing application package

* fix(electron): retain outer application root across package scopes

* fix(electron): derive application ownership from inventoried packages

* fix(electron): retain resolved package entrypoint ownership

* fix(electron): preserve competing application ownership

* fix(electron): retain invalid and omitted runtime ownership

* fix(electron): preserve omitted module ownership and runtime paths

* fix(electron): preserve proven roots before confining page paths

* fix(electron): retain possible owners behind missing imports

* fix(electron): distinguish absent imports and owned page candidates

* fix(electron): keep unavailable JSON out of owner gaps

* fix(electron): retain exact loader formats and default entry status

* fix(electron): retain unavailable entrypoint ownership candidates

* test(ghidra): preserve Windows Node probe prerequisites

* test(ghidra): assert cancellation during profile shutdown

* fix(electron): separate examined imports from frontend ownership

* fix(electron): retain unavailable directory entrypoint owners

* test(jeb): retain Linux ownership prerequisite in isolation

* fix(javascript): retain unchecked loader ownership and literal main paths

* fix(javascript): preserve runtime paths and call-site module aliases

* fix(javascript): bound module alias traversal and preserve projections

* fix(javascript): retain host module and nested artifact path boundaries

* fix(javascript): preserve ESM and archive module loader provenance

* test(javascript): distinguish unmapped containers from missing exports

* fix: retain default module aliases and Electron builtin imports

* fix: preserve host file URL and inward ASAR ownership

* fix: preserve CommonJS file URL classification in CI fixtures

* fix: retain bound module loaders and Windows entrypoint uncertainty

* fix: retain ASAR uncertainty and invalidate changed Electron app roots

* fix(javascript): retain ownership uncertainty across loader boundaries

* fix(javascript): preserve loader sources and bound alias queries

* fix(javascript): retain destructured loader sources

* fix(javascript): preserve loader uncertainty at resolution boundaries

* fix(javascript): preserve callable and package launch ownership

* fix(javascript): preserve captured values across member reads

* test(process): assert tagged filesystem cancellation failures

* fix(javascript): preserve inventory bases and invocation read timing

* fix(javascript): preserve ownership across indirect and unread loads

* test(javascript): order fixture directory creation on Windows

* test(javascript): share ordered filesystem fixture writer

* fix(javascript): unify loader provenance and package validation

* fix(javascript): preserve captured Node require loader values

* fix(javascript): preserve loader invocation authority

* fix(javascript): verify generic loader invocation authority

* fix(javascript): preserve conditional loader method alternatives

* fix(javascript): require proven factories for source association

* fix(javascript): honor replaced Electron app path setters

* fix(javascript): prove path and assignment source ownership

* fix(javascript): retain native delegate eligibility through shared writes

* fix(process): settle stale baseline errors after confirmed absence

* fix(javascript): preserve assignment and path boundary evidence

* fix(javascript): prove source-directory resolve anchors

* fix: preserve application path provenance and portable schemas

* fix(javascript): retain CommonJS exported setter effects

* fix: isolate Linux identity observations and retain native module exports

* fix(javascript): preserve published app and helper provenance

* fix(javascript): normalize typed stores and native path fixtures

src/domain/javascript/javascriptSemanticDataEffectHelpers.ts

@@ -161,22 +161,31 @@ export const builtinDataEffectMethod = (
   state: JavaScriptSemanticAnalysisState,
   specifiers: readonly string[],
 ): string | null => {
+  const path = builtinDataEffectCallablePath(callee, state, specifiers);
+  return path?.length === 1 ? (path[0] ?? null) : null;
+};
+
+/** Recover the complete callable export path using the shared mutation proof. */
+export const builtinDataEffectCallablePath = (
+  callee: t.Node,
+  state: JavaScriptSemanticAnalysisState,
+  specifiers: readonly string[],
+): readonly string[] | null => {
   const expression = unwrapJavaScriptExpression(callee).node;
   if (expression !== callee)
-    return builtinDataEffectMethod(expression, state, specifiers);
+    return builtinDataEffectCallablePath(expression, state, specifiers);
   if (t.isSequenceExpression(expression)) {
     const final = expression.expressions.at(-1);
     return final === undefined
       ? null
-      : builtinDataEffectMethod(final, state, specifiers);
+      : builtinDataEffectCallablePath(final, state, specifiers);
   }
   const required = semanticRequireOrigin(callee, state);
   if (required !== undefined) {
     const origin = builtinNamespaceOrigin(required.origin);
-    return origin.importedPath.length === 1 &&
-      specifiers.some(
-        (specifier) => specifier.replace(/^node:/u, "") === origin.specifier,
-      ) &&
+    return specifiers.some(
+      (specifier) => specifier.replace(/^node:/u, "") === origin.specifier,
+    ) &&
       !requiredModuleChanged(
         required.origin.specifier,
         required.origin.importedPath,
@@ -184,7 +193,7 @@ export const builtinDataEffectMethod = (
         state,
         true,
       )
-      ? (origin.importedPath[0] ?? null)
+      ? origin.importedPath
       : null;
   }
   if (t.isIdentifier(callee)) {
@@ -197,7 +206,7 @@ export const builtinDataEffectMethod = (
       [],
       true,
     );
-    return path?.length === 1 ? (path[0] ?? null) : null;
+    return path;
   }
   if (!t.isMemberExpression(callee) && !t.isOptionalMemberExpression(callee))
     return null;
@@ -227,27 +236,26 @@ export const builtinDataEffectMethod = (
             callee,
             [...receiver.path, method],
             true,
-          )?.length === 0
-            ? method
+          ) !== null
+            ? [...origin.importedPath, method]
             : null;
       }
     }
     const source = semanticExpressionModuleOrigin(callee.object, state);
     if (method === null || source === undefined) return null;
     const origin = builtinNamespaceOrigin(source);
-    return origin.importedPath.length === 0 &&
-      specifiers.some(
-        (specifier) => specifier.replace(/^node:/u, "") === origin.specifier,
-      ) &&
+    return specifiers.some(
+      (specifier) => specifier.replace(/^node:/u, "") === origin.specifier,
+    ) &&
       !requiredModuleChanged(
         origin.specifier,
-        [...origin.importedPath, method],
+        [...source.importedPath, method],
         callee,
         state,
         true,
         callee.object,
       )
-      ? method
+      ? [...origin.importedPath, method]
       : null;
   }
   const binding = resolveSemanticBindingState(
@@ -265,7 +273,7 @@ export const builtinDataEffectMethod = (
     [method],
     true,
   );
-  if (resolvedPath?.length === 0) return method;
+  if (resolvedPath !== null) return [...resolvedPath, method];
   const initializer = binding?.initializers[0];
   if (
     initializer === undefined ||
@@ -298,7 +306,7 @@ export const builtinDataEffectMethod = (
       true,
       initializer.node,
     )
-    ? method
+    ? [method]
     : null;
 };
 
@@ -588,6 +596,9 @@ const affectsBuiltinPath = (
 
 const BUILTIN_RECEIVER_METHODS: Readonly<Record<string, ReadonlySet<string>>> =
   {
+    path: new Set(["resolve", "join", "dirname"]),
+    "path/posix": new Set(["resolve", "join", "dirname"]),
+    url: new Set(["fileURLToPath"]),
     fs: new Set([
       "readFile",
       "readFileSync",
@@ -762,7 +773,7 @@ const computeOriginalBuiltinReceiver = (
 ): boolean => {
   if (!t.isCallExpression(node) && !t.isOptionalCallExpression(node))
     return false;
-  const callee = node.callee;
+  const callee = unwrapJavaScriptExpression(node.callee).node;
   if (!t.isMemberExpression(callee) && !t.isOptionalMemberExpression(callee))
     return false;
   const receiver = t.isIdentifier(callee.object)
@@ -780,14 +791,21 @@ const computeOriginalBuiltinReceiver = (
         semanticGlobalProcessOrigin(callee.object, state));
   if (sourceOrigin === undefined) return false;
   const origin = builtinNamespaceOrigin(sourceOrigin);
-  if (origin.importedPath.length !== 0) return false;
+  const posixReceiver =
+    origin.specifier === "path" &&
+    origin.importedPath.length === 1 &&
+    origin.importedPath[0] === "posix";
+  if (origin.importedPath.length !== 0 && !posixReceiver) return false;
   const method = semanticStaticPropertyKey(callee.property, callee.computed);
   const identity = semanticRequireExportsIdentity(origin.specifier, [
+    ...origin.importedPath,
     method ?? "",
   ]);
   if (
     method === null ||
-    !BUILTIN_RECEIVER_METHODS[origin.specifier]?.has(method) ||
+    !BUILTIN_RECEIVER_METHODS[
+      posixReceiver ? "path/posix" : origin.specifier
+    ]?.has(method) ||
     receiver?.memberWrites.some(
       ({ path, node: write }) =>
         affectsBuiltinPath(path, [method]) &&