Found during round-7 review of #2612 (issue-2088's implementation plan).
Problem
docs/plans/issue-2088.md's escape-analysis design (isTrackedReferencePosition, WU-2) now tracks a reference to an ARRAY-OWNED site's container (const RESOLVERS = [{ matches: isFoo }]) only through a for...of head over the container — round 7 found that the previous draft's member/subscript-call branch also accepted RESOLVERS.forEach(...), RESOLVERS.map(...), etc. as tracked, which is unsound: buildArrayCallbackConstraints (src/domain/graph/resolver/points-to.ts:225) only seeds a points-to fact for Array.from(source, cb)'s callback parameter, never for .forEach/.map/.find/.filter/.some, so the callback parameter (r above) carries no points-to fact tying it back to the site — collectInvokedPropertySites can never produce correlated evidence for r.matches(...) regardless of how the container is referenced.
Round 7 closes this soundly by requiring the site's owner key to equal its bindingName (i.e. a direct binding, not an array element) before accepting a member/subscript call as tracked at all — so an array-owned site's container can now escape (be treated as tracked) only through for...of.
Impact
Recall-only: RESOLVERS.forEach((r) => r.matches('foo')) is a real, correct invocation of isFoo in actual program semantics, but codegraph has no channel that can currently prove it via T1. The site correctly falls back to T2 (today's bare-name predicate), so nothing regresses relative to pre-#2088 behavior — this is strictly a missed recall opportunity, not a soundness risk.
Fix sketch
Extend buildArrayCallbackConstraints (or add a sibling) to also seed pts(calleeCallback::param0) ⊇ pts(arrayName[*]) for .forEach/.map/.find/.filter/.some/.findIndex/.findLast callback arguments, mirroring what it already does for Array.from. Once the solver models this flow, isTrackedReferencePosition could extend the member/subscript-call branch to array-owned sites for exactly these callee names — the same kind of fixed callee set this file already uses elsewhere for a related purpose (CALLBACK_ACCEPTING_CALLEES).
Not attempted in #2612 — that PR is a docs-only plan revision; this is a design extension for whichever PR implements the plan.
Found during round-7 review of #2612 (issue-2088's implementation plan).
Problem
docs/plans/issue-2088.md's escape-analysis design (isTrackedReferencePosition, WU-2) now tracks a reference to an ARRAY-OWNED site's container (const RESOLVERS = [{ matches: isFoo }]) only through afor...ofhead over the container — round 7 found that the previous draft's member/subscript-call branch also acceptedRESOLVERS.forEach(...),RESOLVERS.map(...), etc. as tracked, which is unsound:buildArrayCallbackConstraints(src/domain/graph/resolver/points-to.ts:225) only seeds a points-to fact forArray.from(source, cb)'s callback parameter, never for.forEach/.map/.find/.filter/.some, so the callback parameter (rabove) carries no points-to fact tying it back to the site —collectInvokedPropertySitescan never produce correlated evidence forr.matches(...)regardless of how the container is referenced.Round 7 closes this soundly by requiring the site's owner
keyto equal itsbindingName(i.e. a direct binding, not an array element) before accepting a member/subscript call as tracked at all — so an array-owned site's container can now escape (be treated as tracked) only throughfor...of.Impact
Recall-only:
RESOLVERS.forEach((r) => r.matches('foo'))is a real, correct invocation ofisFooin actual program semantics, but codegraph has no channel that can currently prove it via T1. The site correctly falls back to T2 (today's bare-name predicate), so nothing regresses relative to pre-#2088 behavior — this is strictly a missed recall opportunity, not a soundness risk.Fix sketch
Extend
buildArrayCallbackConstraints(or add a sibling) to also seedpts(calleeCallback::param0) ⊇ pts(arrayName[*])for.forEach/.map/.find/.filter/.some/.findIndex/.findLastcallback arguments, mirroring what it already does forArray.from. Once the solver models this flow,isTrackedReferencePositioncould extend the member/subscript-call branch to array-owned sites for exactly these callee names — the same kind of fixed callee set this file already uses elsewhere for a related purpose (CALLBACK_ACCEPTING_CALLEES).Not attempted in #2612 — that PR is a docs-only plan revision; this is a design extension for whichever PR implements the plan.