Code Analysis Java Project Dependencies

Java declared direct project source routes

Snapshot:8November2026. Draft #1273, head196dd3569, extends #1272 as the twelfth layer of native stack#1262. Shared Labs stays bf0a29e7664f52973d06a8e6a608df2db1ecbd39; no approval, merge, release or installation.

One developer investigation

At fixed SLF4J9783320b6c4411a0b120cad9e32cd9a981b1dac2, SimpleLoggerMultithreadedInitializationTest.setup/tearDown stopped at LoggerFactoryFriend.reset(), lines53/58. Java4 withheld this inherited-context cross-module path after correcting the wrong reload4j→compatibility target.

Java5 follows both calls to slf4j-api/src/main/java/org/slf4j/LoggerFactoryFriend.java:43:5. The captured MultithreadedInitializationTest ancestor belongs to API test sources, so Simple needs its declared test-jar/test-scope route as well as the ordinary API jar for the main target. Four jumpable POM declaration points record child→named parent-pom.xml→root reactor plus API's project. Reactor co-location alone grants nothing. Runtime loading, argument applicability and complete callers remain unproved.

Source-first evidence

Fixed sources, scripts and receipts. Source/POM answers29f24d845 and baselineff8ef20ba preceded initial rule7f17c3857. The corpus was previously exposed; two bridge MDC calls were reserved only from initial dependency tuning and already resolved, not blind gains. Post-result implementation review bc26eaddf prevents unresolved explicit scope/type/classifier properties from silently becoming default visibility; final replay/ZIP repeated.

Four frozen questions: baseline2correct/0wrong/2missed → candidate4correct/0wrong/0missed. A source-known reload4j external call remains unknown, never the unrelated captured compatibility class. Exactly2new targets independently agree with javac17; all231old targets,4,856call ranges,1,608functions,260sources/imports and the existing jclcontent.java parse failure are preserved.62calls carry POM evidence, including60existing targets; this is not62accuracy gains.16usedPOMs/46,914UTF-8bytes.

Real upstream change and remaining interruption

Supplemental post-rule source-first freeze f2ab5a605 covers99e356974859a4cac2f5e533de2d8232d9d5dbe6→1c13755b2520e511bc41b5c6fdc8bd6c58e529c0. The real commit introduces shared API LoggerFactoryFriend.reset:19:5 and removes module-local helpers. Head references2→4 add Simple calls56/61, with target/source/POM evidence. The two existing Nop references are post-output preservation observations.

The API file is absent in base, so this is an added-definition migration, not a changed-body pair. The investigation remains partial/exit1: base not captured, POM settings differ, and unrelated parse errors remain.97changed files exceed the40-item list. No two-sided ready, complete impact or whole-project compilation claim. Historical Git traversal encountered an unavailable promisor object; pinned codeload archives were hash-verified instead, without rewriting the original sample.

Bounded model and reproducibility

Java5/adapter11 reads captured local parents, literal coordinates, inherited default properties/dependency management and shared literal reactor declarations. Only unique direct jar/test-jar project routes with conventional main/test sources can grant new inherited-context cross-root targets. Relevant profiles, unresolved/empty properties, unavailable parents, imported BOMs, duplicate coordinates, Gradle/custom layouts and transitive/external artifact resolution remain unknown. Existing same-root/no-parent global source candidates and historical models retain their scope; the global type index is not a complete per-module classpath.

languageScope records used POM text/hashes, modeled projects, profiles and unknown reasons. buildEvidence points to POM declarations. Saved and paired readers reuse shared source points/freshness; changed inputs disable navigation. XML/POM capture respects excludes and emits only used metadata. No Maven/Gradle/project code, plugins, extensions, annotation processors or emitted upstream classes are executed. Normal Java CLI needs Node/parser dependencies, not a JDK or Maven. The XML reader is pinned @xmldom/xmldom0.9.12; source/ZIP installer checks it.

Use run.py with fixed checkout/source CLI, then the unpacked ZIP CLI; baseline uses #1272 and --expect baseline. pair.py repeats fixed upstream migration with both roots. freshness.py checks stale POM and actual saved Java4 without rebinding. compiler.py/audit.py reproduce optional independent attribution; verify.py compares payloads and exits. Exact commands/pins/archive hashes and local timing observations are in the linked README; timings are not a controlled performance comparison.

Retained Temurin17.0.21 and pinned JUnit4.13.1/Hamcrest1.3 (427,732bytes, zero new downloads here) provide a77-source API/Simple graph with0errors. Full78-source graph has2real upstream errors: LoggerFactoryTest.TestingProvider.getRequesteApiVersion does not implement getRequestedApiVersion. Only that unrelated test is excluded from the optional oracle; analyzer capture stays260sources. Missing SDK gives explicit exit1 before downloads. Fresh SDK installation cost was not measured.

Separate validation states

• Local module407/407; extracted affected46/46, zero skips.
• Node26 package/release/community58pass/0fail/7environment skips; canonical Node22 package/release54pass/0fail/2skips (non-canonical rejection and Windows drive paths). Initial missing root parse5 was corrected with locked npm ci; original failure retained separately.
• Source/ZIP9CLIcommands per distribution: frozen-query six exit0, real upstream migration1, changed-POM1, actual saved Java4 task0. Raw calls/definitions/sources/imports/POM payloads, positions, coverage and exits agree. Distributions are not independent accuracy samples.
• Two canonical Node22.23.3/zlib1.3.1-e00f703 builds match;170module package files match source. ZIP SHA2562799913d91a133d9cace5699d4f64c3530d2ded2f67248a91395481b06d5798a.
• Final-head CI42436890903, attempt2 completed success at196dd3569. Actual independent analysis job128597593080 log records407tests/407pass/0fail/0skip. All executed full/browser/ZIP/WebM/website, three-platform package and Windows22/24 checks passed or were reused at this unchanged head; deployment jobs skipped.
• Attempt1 is retained as failure: full-regression2 nested module suite406/407 failed the self-import extraction, with null child status at20.16s and a20s helper deadline. Timeout is the supported inference; the original assertion omitted the exact child error. Same-head failed-job rerun passes its nested module-suite wrapper (root log: ok457, child success stdout not emitted). Focused local canonical-Node22 self tests2/2 also pass. No source/assertion/deadline changes and no proven flakiness fix; these are separate observations, not additional accuracy samples.
• Labs unchanged. Maintainers retain approval/merge/release/install decisions.