fix(§12.1): a branch-declared function is routed BEFORE it is collected — closing the client half alone leaked a server fn body into client.js

[bryanmaclee]

Closes g-collect-functions-branch-decl-vs-server-boundary-routing (HIGH, SECURITY-GATED).

The trap, and why the order is the fix

A function declared inside an if=/else branch was never defined while its call sites still emitted unmangled — a ReferenceError at exit 0 (PA-reproduced on merged main: 0 definitions, 2 bare calls). The obvious fix — teach collect.ts's collectFunctions to descend the if-chain — is wrong alone: it emits a server fn body into client.js with no server.js at all, trading a loud ReferenceError for a silent server-code-in-client leak.

Root, and it explains the trap: the server and client emitters read one collector. The client emitter omits a server fn body only because route-inference already claimed it. So RI must see the declaration first.

1. route-inference.ts — collectFileFunctions + collectWorkerBodyFunctionIds descend branch bodies. The file had zero occurrences of if-chain before this. collectWorkerBodyFunctionIds was not in the brief: left blind it goes out of lockstep and false-fires E-ROUTE-001 — blast radius the fix itself would have created.
2. collect.ts — collectFunctions, second.

Phase 1 — three-way security control

variant	body in client.js	server.js
base	0	none
codegen half ALONE	1	none ← positive control reproduced
RI half alone	0	none
both halves	0	present
lone-if= oracle	0	present

PA-reproduced independently on the merged baseline: base produces no server.js at all; the fix puts the body in server.js and zero of it in client.js.

Phases 3–4 — measured, and the zero is explained

7408 artifacts byte-identical, 0 differing, 0 server-bundle deltas. Not assumed: an AST census over the same 1914 sources finds 17 containing a collapsed if-chain and zero declaring a function inside a branch. ⛑ The agent's first differential said 1021 differed and it threw that out itself — it had built the base tree by deleting .git, a project-root marker, so every chunk token hashed an absolute path.

R26 across r25/r27/r28 (r26 does not exist): 104 artifacts byte-identical; a source-anchored placement checker over 1928 sources / 237 server-fn declarations reports 0 violations. ⛑ The agent tested its own sweep, found it did not bite on this bug — the leak shape is body in client AND no server.js, so there is nothing to overlap — and wrote a second checker rather than accept a clean result from an unproven instrument.

The leak guard is hardened — four defects, not three

Whitespace-normalized body check; a structural check that every client-side zzload definition must be a fetch stub; real server-only markers replacing the vacuous not.toContain("server fn") (emitted JS never contains a scrml source keyword, so it could not fail for any input); and a positive limb the agent found itself — the guard was absence-only, so the base column satisfied it by making the function vanish. Bite-proved: codegen-half-alone 2 fail, pristine base 3 fail, both halves 6 pass.

PA fix round on the S239 findings (1 MED + 4 LOW, none blocking)

• The route-inference.ts comment named endpointClientSkipIds as the mechanism keeping a server body out of the client. It isn't — that set is built solely from <endpoint> private-arm reachability; the real mechanism is route.boundary === "server". A future engineer chasing this leak class would have followed it to a dead end.
• The ROUTING PARITY test could silently become a tautology: String.replace no-ops if the template is reflowed, so loneSrc === SERVER_FN_SRC, the test compiles the same source twice, and every assertion passes with the discriminator gone. Added expect(loneSrc).not.toBe(SERVER_FN_SRC).
• Dropped a byte-length equality assertion between two different sources; it passes today only because no node id reaches server.js.

Comment- and test-only, inert to the runtime surface → re-review judged nil-blast-radius. Guard 6 pass, conformance 894 pass / 0 fail after.

Not fixed, filed — both verified pre-existing

• Same-named declarations in sibling branches bind to the last definition, no diagnostic. PA-verified pre-existing language-wide: two lone if= divs on base mis-bind identically. The fix brings the chain to parity with that oracle, which is its goal. No server body leaked in any duplicate-name shape tested.
• types:check grows 9 → 10 TS7016 for ast-if-chain.js (baseline never refreshed when that module landed). Relayed, not PA-measured — tsc isn't installed in this checkout and the gate correctly refuses to pass without running, so I did not land an unverified .d.ts on someone else's number.

⛑ Landing note — base-drift filtered

The agent's branch was cut before the maps refresh merged, so the range diff showed .claude/maps/* at −1020 lines. Stale views, not edits (absent from its files-touched list). A wholesale file-delta pull would have silently reverted the wrap-6c refresh landed earlier this session — the lost-update the OCC discipline exists to prevent. Excluded; verified 0 map paths staged.

provenance: spec:§12.1 — "The compiler SHALL decide where each function executes" (unqualified by declaration site), reinforced by §12.4 "No function SHALL be split across client and server without the analysis completing" — precisely what the landing order enforces. Conformance restoration, not a widening.

🤖 Generated with Claude Code

https://claude.ai/code/session_019eHiNS6uvnGPFz55fzinNJ