fix(derive): SEP PART B / R6 — receiver-import guard (axios.get→GLOBAL::get unsoundness)

[Disentinel]

What

The runtime-globals derive pack (js_runtime_globals_edges.dl) resolved a dotted member call on a default/namespace-imported module — axios.get — onto the bare ecma-global get, stripping the receiver and minting an unsound CALLS → GLOBAL::get. Downstream effects-db lookup then saw a PURE stand-in, so side effects didn't propagate (the SEP gap in _ai/gaps.md).

This is PART B / R6 — the root fix. PART A (#460, merged) recovered the effect consumer-side; R5 (#463, merged) flags the unsoundness. This removes the bad edge at the source.

How

A negative guard suppresses win(C,S) on a stripped suffix when the receiver chain reaches an IMPORT_BINDING:

CALL -DERIVES_FROM-> PROPERTY_ACCESS -READS_FROM-> REFERENCE -READS_FROM-> IMPORT_BINDING

All three edges are analyzer-committed EDB (verified: no resolvedVia stamp; js_local_refs explicitly excludes IMPORT_BINDING as the import skip-set) — so there is no pack-ordering dependency.

Genuine ecma-globals are untouched:

• JSON.parse wins on the full name (not a stripped suffix) → kept
• process.exit keeps exit (process is not an IMPORT_BINDING) → kept
• False negatives degrade to prior behavior — sound, never a regression.

Verification

• e2e on the sep-test fixture (clean re-analyze with the rebuilt server): axios.get no longer mints GLOBAL::get; fetchUser recovers IO:HTTP:REQUEST via the unresolved-path effects-db lookup and is no longer suspected-unsound; loadConfig unchanged.
• Unit regression test js_runtime_globals_edges_receiver_import_guard (defect axios.get suppressed vs identical-suffix foo.get on a local receiver kept); existing ..._first_match_and_endpoint_pin still green.

Note

Touches the resolver pack zone (normally vm's). Done with explicit owner sign-off to close SEP. Release note: rfdb-server source changed → rfdb prebuilt binaries must be rebuilt at next release.

🤖 Generated with Claude Code