[hoklims]

Summary

Second slice of the R0 edge-case oracles (#84): the JavaScript scanner, module specifier discovery and the test closure, which E7 (#116) and R5a (#92) move to Rust. The first slice, canonical JSON and digests, is #128.

Three fixtures in tests/edge-oracles/ freeze each input with the exact output the TypeScript implementation produces, or its refusal code:

• javascript-tokens.json, 18 cases. Each token is [kind, start, end, text], plus value for identifier and literal kinds, the only ones consumers read. The cases cover:
  • UTF-16 positions;
  • a BOM that is skipped while a shebang after it is not;
  • conflict markers, whose second side is skipped too;
  • Unicode spaces;
  • regex slashes read as division, so a quote inside a regex opens a string;
  • the empty # token being skipped;
  • normalized numeric values (0x1F → 31, 0xFFn → 0xffn, 017 → 15);
  • decoded and invalid escapes;
  • nested templates.
• module-specifiers.json, 16 cases. Every static and dynamic form, require, Bun's mock.module, computed specifiers, escapes, from across lines, a semicolon ending the search, and an import hidden behind a regex quote.
• test-closure.json, 12 scenarios. Each describes an in-memory repository:
  • the order of resolution candidates (an exact c.js wins over c.ts);
  • path keys lowercased with final-sigma context (ΑΣ/x.js reaches ας/x.ts, while a per-character lowercase misses it);
  • the inventory spelling kept;
  • UTF-16 path order;
  • unbounded edges sorted by file, then reason;
  • packages, JSX runtime and runner modules;
  • links, both stopped and followed;
  • tsconfig paths with comments, a bunfig preload, package imports, a workspace package;
  • two refusals, TEST_CLOSURE_PACKAGE_IMPORT_UNSUPPORTED and TEST_CLOSURE_TSCONFIG_EXTENDS_UNSUPPORTED.

tests/scanner-closure-oracles.test.ts replays every case and checks:

• that each token text equals the source slice its UTF-16 offsets delimit;
• that the required divergence traps of each fixture are still present.

Kinds are recorded by name, not by the numeric value of the TypeScript enum. Refusals are recorded by their product code.

Proof

Ten negative witnesses run in a disposable worktree at 721330a. Each one turns red on ERR_ASSERTION in the designated test, then green after restore:

Witness	Mutant	Red test
utf8-byte-positions	token offsets in UTF-8 bytes	utf16-astral-positions
numeric-value-raw	numeric value = raw text	numeric-literal-values
template-not-rescanned	no template tail rescan	template-nesting
any-module-call	any x.module(...) is an edge	mock-module
concatenated-import-literal	import("a" + x) keeps "a"	dynamic-concatenation
per-character-lowercase	path key lowercased per character	path-keys-and-order
utf8-path-order	closure files sorted by UTF-8 bytes	path-keys-and-order
ts-source-before-exact	.ts source tried before the exact .js	resolution-candidates
runner-modules-resolved	runner modules resolved to packages	packages-and-runner-modules
trap-case-dropped	fixture: regex-hides-import removed	keep every divergence trap…

• pnpm check: green at 721330a: format, lint, schemas, conformance, typecheck, 1044/1044 tests (run alone)
• Proof epoch: base 7c623ae, candidate 721330a, subject digest sha256:8955fbb6…, classifier category test_oracles (4 paths).

Limits

• Expected values are the current TypeScript output. Several of them freeze known limits of a context-free scanner rather than desirable behavior: regex, JSX, and HTML-like comments. A Rust scanner has to reproduce them, or a later decision has to change both implementations.
• Not frozen: a specifier that is not in NFC (./café.js) makes computeTestClosure throw TypeError: Ambiguous Unicode path segment must use NFC instead of a TEST_CLOSURE_* refusal. It is left out until [Bug] closure : un specifier non-NFC lève un TypeError brut au lieu d'un refus TEST_CLOSURE_* #130 decides the intended behavior.
• The node: builtin list comes from the running Node version. These cases only use builtins that are stable across versions.
• No independent proof auditor ran.

Test plan

• pnpm check
• Ten negative witnesses red then green
• CI green

Refs #84, #116, #92

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T20:35:14.176364Z	427f1d4	New commits
🔒 Security Review	✅ Completed 2026-10-27T20:35:43.728548Z	427f1d4	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.