The ESM loader discards a valid traceStrCmp rewrite for branch-free code, while the CJS path preserves it despite both paths having zero coverage edges

[MicroMilo]

Summary

For identical branch-free module bytes globalThis.f=x=>x==="s";, CJS instrumentation preserves the traceStrCmp rewrite, while the direct ESM loader discards it because the expression-bodied arrow allocates zero coverage edges. Invoking globalThis.f(data.toString()) therefore supplies comparison feedback in CJS but not ESM, contradicting the documented same-feedback contract.

Validation source commit: 4c14e1bf63d82475ea057d6208e6f2eac87fa680.

Code path

• docs/fuzz-targets.md:112-115: Explicit ESM/CJS same-feedback contract.
• docs/architecture.md:31-37: Architecture states both loading paths insert coverage and comparison hooks.
• packages/instrumentor/instrument.ts:111-197: CJS instrumentation installs compareHooks and returns the Babel result without an edge-count gate.
• packages/instrumentor/instrument.ts:294-395: CJS require-hook and direct ESM loader product-path registration.
• packages/instrumentor/esm-loader.mts:96-181: Direct ESM loader installs compareHooks but returns null for the entire transform when coverage edge count is zero, causing load() to restore the original source.
• packages/instrumentor/plugins/compareHooks.ts:29-86: String-literal equality is eligible for traceStrCmp replacement.
• packages/instrumentor/plugins/coverageVisitor.ts:43-119: Coverage visitor adds a function edge only for block-bodied functions and has no BinaryExpression handler.
• packages/instrumentor/plugins/compareHooks.test.ts:30-61: Test establishes the expected transformed output and feedback calls for branch-free equality expressions.
• packages/instrumentor/plugins/esmCodeCoverage.test.ts:100-133: Neighboring tests separately establish that branch-free code has zero ESM edges and that ESM comparisons should be rewritten.
• Repository-local validation artifact: Executable bounded differential proof and minimized shared input.

Steps to reproduce

This report is based on a source-control-flow validation against the commit above.

1. Check out the source commit listed in this report.
2. Inspect the code path and contract anchors listed above.
3. Exercise the described boundary/state path: The ESM loader discards a valid traceStrCmp rewrite for branch-free code, while the CJS path preserves it despite both paths having zero coverage edges.
4. Compare the observed behavior with the expected contract below.

Validation note: Shared input: globalThis.f=x=>x==="s";; ordinary invocation: globalThis.f(data.toString()). CJS observation: zero coverage edges, normalized adapter output globalThis.f = x => Fuzzer.tracer.traceStrCmp(x, "s", "===", <fakePC>);, comparison feedback present. Direct ESM observation: zero coverage edges, instrumentModule returns null, load output remains the original source, comparison feedback absent. The validation exits 0 only after checking the frozen claim, plugin eligibility, visitor domain, and both adapter return predicates.

Expected behavior

The implementation should preserve the repository contract described by the documentation, public type, parser, serializer, or sibling implementation anchors above.

Actual behavior

For identical branch-free module bytes globalThis.f=x=>x==="s";, CJS instrumentation preserves the traceStrCmp rewrite, while the direct ESM loader discards it because the expression-bodied arrow allocates zero coverage edges. Invoking globalThis.f(data.toString()) therefore supplies comparison feedback in CJS but not ESM, contradicting the documented same-feedback contract.

Existing coverage

I did not find an existing issue or PR title that appears to cover this exact root cause in the pre-submission check.

Suggested fix

Make the direct ESM loader retain comparison-hook transformations even when the coverage visitor allocates zero edges.

Suggested tests

• Add a regression test for: The ESM loader discards a valid traceStrCmp rewrite for branch-free code, while the CJS path preserves it despite both paths having zero coverage edges.
• Include the boundary value or state transition described above so the old behavior fails before the fix.

---

Submitted with Codex.