code-standards 8.142.3__tar.gz → 8.147.0__tar.gz

{code_standards-8.142.3 → code_standards-8.147.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code-standards
-Version: 8.142.3
+Version: 8.147.0
 Summary: One deterministic quality gate for Sarj Python, TypeScript, Swift, Kotlin, shell, SQL, IaC, and repository policy.
 Project-URL: Homepage, https://code-standards.sarj.ai/
 Project-URL: Documentation, https://code-standards.sarj.ai/cli/
@@ -28,10 +28,10 @@ Requires-Dist: pre-commit==4.7.0
 Requires-Dist: pydantic==2.14.1
 Requires-Dist: pyyaml==6.0.3
 Requires-Dist: referencing==0.37.0
-Requires-Dist: repo-standards==6.13.0
+Requires-Dist: repo-standards==6.14.0
 Requires-Dist: ruff==0.17.2
 Requires-Dist: sarj-iac-lint==0.30.3
-Requires-Dist: sarj-python-lint==1.83.1
+Requires-Dist: sarj-python-lint==1.84.0
 Requires-Dist: sarj-rule-contracts==0.4.2
 Requires-Dist: sarj-sql-lint==0.30.1
 Requires-Dist: shellcheck-py==0.11.0.1; (sys_platform == 'darwin' and platform_machine == 'arm64') or (sys_platform == 'darwin' and platform_machine == 'x86_64') or (sys_platform == 'linux' and platform_machine == 'x86_64') or (sys_platform == 'win32' and platform_machine == 'AMD64')
@@ -67,6 +67,8 @@ New ESLint setups use `eslint.config.ts` and the compiler-checked `eslint.strict
 
 Use repeatable `check --rule ENGINE:ID` selectors to select native rules, ESLint rules, or managed security audits. Exclusions, baselines, and severities still apply; Ruff selectors are not supported. Native linters and ESLint execute only selected rules. ESLint retains configured parsers, options, severities, and suppression directives.
 
+For a history-free initial import, set `SARJ_STANDARDS_INITIAL_IMPORT_SOURCE` only on the initial commit process to the full lowercase object ID of an available source commit with exactly one available parent. HEAD must be an unborn branch; the entire staged tree must equal that commit, tracked worktree files must match the index without hidden index flags, and nonignored files must be staged. Native staged checks compare the source commit with its parent, preserving the usual changed-line failures for findings introduced in that commit while allowing inherited diagnostic budgets. Validation runs before and after analysis; all analyzers and baseline limits still apply. The caller must qualify the source commit separately. Git replacement objects and lazy fetching are disabled; explicitly supplied temporary object alternates may provide the source history without copying it into the new repository. Remove the input and alternates before subsequent commits, pushes, and CI. Invalid or changed import context fails analysis, including clean reports; ordinary checks without this input retain their existing behavior.
+
 Selected ESLint checks apply live inline suppressions and validate selected bulk suppression counts. The complete lint gate owns unused inline-directive and inline-configuration checks: a partial run cannot establish whether an unselected rule's directive is needed.
 
 The complete Python and JavaScript/TypeScript source gate requires named, line-local exceptions with concrete reasons. SARJ523 rejects blanket Python waivers, scoped Ruff file/range disables and weakened Pyright source settings; SARJ419 also rejects missing explanations. Bare sarj-noqa markers cannot waive Python, SQL or IaC findings. Required Ruff blanket-ignore checks and an independent ESLint suppression-policy pass remain active despite source disables, consumer rule configuration, rule exclusions and diagnostic baselines. The ESLint pass bans file/range disables, ts-ignore and ts-nocheck while retaining described local ts-expect-error exceptions. Generated-source headers cannot authorize their own waiver; explicit whole-path exclusions retain that boundary. A reason is not proof that an exception is justified. Native parse/read/size failures make checks incomplete. Explicit tool delegation, partial and own-CI options retain their declared scope and coverage notices.

{code_standards-8.142.3 → code_standards-8.147.0}/README.md

@@ -27,6 +27,8 @@ New ESLint setups use `eslint.config.ts` and the compiler-checked `eslint.strict
 
 Use repeatable `check --rule ENGINE:ID` selectors to select native rules, ESLint rules, or managed security audits. Exclusions, baselines, and severities still apply; Ruff selectors are not supported. Native linters and ESLint execute only selected rules. ESLint retains configured parsers, options, severities, and suppression directives.
 
+For a history-free initial import, set `SARJ_STANDARDS_INITIAL_IMPORT_SOURCE` only on the initial commit process to the full lowercase object ID of an available source commit with exactly one available parent. HEAD must be an unborn branch; the entire staged tree must equal that commit, tracked worktree files must match the index without hidden index flags, and nonignored files must be staged. Native staged checks compare the source commit with its parent, preserving the usual changed-line failures for findings introduced in that commit while allowing inherited diagnostic budgets. Validation runs before and after analysis; all analyzers and baseline limits still apply. The caller must qualify the source commit separately. Git replacement objects and lazy fetching are disabled; explicitly supplied temporary object alternates may provide the source history without copying it into the new repository. Remove the input and alternates before subsequent commits, pushes, and CI. Invalid or changed import context fails analysis, including clean reports; ordinary checks without this input retain their existing behavior.
+
 Selected ESLint checks apply live inline suppressions and validate selected bulk suppression counts. The complete lint gate owns unused inline-directive and inline-configuration checks: a partial run cannot establish whether an unselected rule's directive is needed.
 
 The complete Python and JavaScript/TypeScript source gate requires named, line-local exceptions with concrete reasons. SARJ523 rejects blanket Python waivers, scoped Ruff file/range disables and weakened Pyright source settings; SARJ419 also rejects missing explanations. Bare sarj-noqa markers cannot waive Python, SQL or IaC findings. Required Ruff blanket-ignore checks and an independent ESLint suppression-policy pass remain active despite source disables, consumer rule configuration, rule exclusions and diagnostic baselines. The ESLint pass bans file/range disables, ts-ignore and ts-nocheck while retaining described local ts-expect-error exceptions. Generated-source headers cannot authorize their own waiver; explicit whole-path exclusions retain that boundary. A reason is not proof that an exception is justified. Native parse/read/size failures make checks incomplete. Explicit tool delegation, partial and own-CI options retain their declared scope and coverage notices.

{code_standards-8.142.3 → code_standards-8.147.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "code-standards"
-version = "8.142.3"
+version = "8.147.0"
 description = "One deterministic quality gate for Sarj Python, TypeScript, Swift, Kotlin, shell, SQL, IaC, and repository policy."
 readme = "README.md"
 requires-python = ">=3.14"
@@ -28,11 +28,11 @@ dependencies = [
   "PyYAML==6.0.3",
   "jsonschema==4.26.0",
   "referencing==0.37.0",
-  "repo-standards==6.13.0",
+  "repo-standards==6.14.0",
   "ruff==0.17.2",
   "shellcheck-py==0.11.0.1; (sys_platform == 'darwin' and platform_machine == 'arm64') or (sys_platform == 'darwin' and platform_machine == 'x86_64') or (sys_platform == 'linux' and platform_machine == 'x86_64') or (sys_platform == 'win32' and platform_machine == 'AMD64')",
   "sarj-iac-lint==0.30.3",
-  "sarj-python-lint==1.83.1",
+  "sarj-python-lint==1.84.0",
   "sarj-sql-lint==0.30.1",
   "typer==0.27.3",
 ]

{code_standards-8.142.3 → code_standards-8.147.0}/src/sarj_standards/__main__.py

@@ -6,7 +6,8 @@ from sarj_standards import __version__
 
 
 def main(argv: list[str] | None = None) -> int:
-    arguments = sys.argv[1:] if argv is None else argv
+    # The launcher probes the exact version before typed Typer dispatch.
+    arguments = sys.argv[1:] if argv is None else argv  # sarj-noqa: SARJ533 -- typed CLI forwarding
     if arguments == ["--version"]:
         sys.stdout.write(f"code-standards {__version__}\n")
         return 0

{code_standards-8.142.3 → code_standards-8.147.0}/src/sarj_standards/api.py

@@ -47,6 +47,7 @@ from .libs.diagnostics import (
     ToolReport as ToolReport,
     TrustMode as TrustMode,
     baseline as diagnostic_baseline,
+    initial_import,
     to_github as to_github,
     to_json as to_json,
     to_sarif as to_sarif,
@@ -266,6 +267,10 @@ class Standards:
         python_type_check: bool = True,
         eslint: bool = True,
     ) -> AnalysisReport:
+        try:
+            import_context = initial_import.load(self.root, staged=staged)
+        except ValueError as exc:
+            return _failed_analysis(self.root, "invalid-input", str(exc))
         if jobs not in {1, 2}:
             return _failed_analysis(self.root, "invalid-input", "analysis jobs must be 1 or 2")
         external = external or bool(upstream_rules.ids)
@@ -279,8 +284,18 @@ class Standards:
         except (OSError, TypeError, ValueError) as exc:
             return _failed_analysis(self.root, "invalid-input", str(exc))
         if prepared_only:
-            return _prepared_only_analysis(
-                self.root, adopted, prepared_devops, prepared_targets, paths=paths, rules=rules, trust=normalized_trust
+            return _validated_initial_import(
+                _prepared_only_analysis(
+                    self.root,
+                    adopted,
+                    prepared_devops,
+                    prepared_targets,
+                    paths=paths,
+                    rules=rules,
+                    trust=normalized_trust,
+                ),
+                import_context,
+                staged=staged,
             )
         try:
             selection_policy = _selection_policy(self.root, adopted, normalized_mode)
@@ -321,16 +336,24 @@ class Standards:
         )
         coverage.extend(_prepared_coverage(adopted, prepared_devops))
         if not external:
-            native = report_from_tools(self.root, native_analysis())
-            changed_scope = _analysis_changed_scope(self.root, native, baseline_budget, staged=staged)
+            combined = report_from_tools(self.root, native_analysis())
+            changed_scope = _analysis_changed_scope(self.root, combined, baseline_budget, staged=staged)
             _native_typescript_coverage(selected_groups, adopted, rule_selection, coverage)
             if normalized_mode in {AnalysisMode.POLICY, AnalysisMode.OBSERVE}:
-                native = _with_warning_severity(native, _warning_rule_keys(normalized_mode, rule_selection))
-            return _with_coverage(
-                _without_baselined_diagnostics(
-                    native, baseline_budget.counts, changed_scope=changed_scope, provenance=baseline_budget.provenance
+                combined = _with_warning_severity(combined, _warning_rule_keys(normalized_mode, rule_selection))
+            return _validated_initial_import(
+                _with_coverage(
+                    _without_baselined_diagnostics(
+                        combined,
+                        baseline_budget.counts,
+                        changed_scope=changed_scope,
+                        provenance=baseline_budget.provenance,
+                    ),
+                    coverage,
                 ),
-                coverage,
+                import_context,
+                staged=staged,
+                changed_scope=changed_scope,
             )
         coverage.extend(
             _source_analyzer_coverage(
@@ -375,11 +398,16 @@ class Standards:
             else frozenset(),
             upstream_rules=upstream_rules,
         )
-        return _with_coverage(
-            _without_baselined_diagnostics(
-                combined, baseline_budget.counts, changed_scope=changed_scope, provenance=baseline_budget.provenance
+        return _validated_initial_import(
+            _with_coverage(
+                _without_baselined_diagnostics(
+                    combined, baseline_budget.counts, changed_scope=changed_scope, provenance=baseline_budget.provenance
+                ),
+                coverage,
             ),
-            coverage,
+            import_context,
+            staged=staged,
+            changed_scope=changed_scope,
         )
 
     def run(
@@ -670,6 +698,28 @@ def _failed_analysis(root: Path, kind: str, message: str) -> AnalysisReport:
     return AnalysisReport(root, Completion.FAILED, Conclusion.INCONCLUSIVE, (tool,))
 
 
+def _validated_initial_import(
+    report: AnalysisReport,
+    context: initial_import.InitialImport | None,
+    *,
+    staged: bool,
+    changed_scope: diagnostic_baseline.ChangedLineScope | None = None,
+) -> AnalysisReport:
+    failure: str | None = None
+    try:
+        initial_import.validate(report.root, context, staged=staged)
+    except ValueError as exc:
+        failure = str(exc)
+    if failure is None and context is not None and changed_scope is not None and changed_scope.failed:
+        failure = "initial-import changed-line comparison failed"
+    if failure is None:
+        return report
+    return _with_coverage(
+        report_from_tools(report.root, (*report.tools, *_failed_analysis(report.root, "invalid-input", failure).tools)),
+        report.coverage,
+    )
+
+
 def _analysis_changed_scope(
     root: Path,
     report: AnalysisReport,

{code_standards-8.142.3 → code_standards-8.147.0}/src/sarj_standards/cli/main.py

@@ -2825,7 +2825,10 @@ def cmd_commit_message(args: _Args) -> int:
 
 
 def main(argv: list[str] | None = None) -> int:
-    raw_argv = _root_option_first(sys.argv[1:] if argv is None else argv)
+    # Compatibility ordering preserves the complete argv for typed Typer.
+    raw_argv = _root_option_first(
+        sys.argv[1:] if argv is None else argv  # sarj-noqa: SARJ533 -- typed CLI forwarding
+    )
     status: int | None = None
 
     def dispatch(args: _Args) -> int:

{code_standards-8.142.3 → code_standards-8.147.0}/src/sarj_standards/configs/cli-reference.v1.json

@@ -3316,6 +3316,6 @@
   },
   "program": "code-standards",
   "schemaVersion": 1,
-  "summary": "Adopt, check, fix, diagnose, and update sarj-ai standards (v8.142.3).",
-  "version": "8.142.3"
+  "summary": "Adopt, check, fix, diagnose, and update sarj-ai standards (v8.147.0).",
+  "version": "8.147.0"
 }

{code_standards-8.142.3 → code_standards-8.147.0}/src/sarj_standards/configs/rule-calibration-campaign.v1.json

@@ -836,9 +836,9 @@
       "task": "rule-audit/python/prefer-match-type-dispatch",
       "family": "python",
       "ruleId": "prefer-match-type-dispatch",
-      "state": "complete",
-      "evidence": "226 focused type-dispatch/container cases pass, with three exclusions for decorated or explicit/unpacked-metaclass bindings. A runtime counterexample showed isinstance succeeding while the advised class pattern raised TypeError.",
-      "outcome": "Keep class-pattern advice only when the binding is proven to be a class. Exclude decorated classes and explicit/unpacked metaclass construction; preserve existing type/value dispatch positives."
+      "state": "pending",
+      "evidence": "226 focused type-dispatch/container cases pass, with three exclusions for decorated or explicit/unpacked-metaclass bindings. A runtime counterexample showed isinstance succeeding while the advised class pattern raised TypeError. The typed-boundary extension covers two-arm ladders and repeated same-subject OR checks while preserving the earlier metaclass, mutation and target-version safeguards. The pinned pre-integration record packages/python/benchmarks/typed-python-boundaries.json covers five affected rules with 111 valid labeled cases (51 TP, 60 TN, zero inspected FP/FN) and three explicit malformed-source rejections. Its repeated cold/warm measurements retain their historical source frame; they are not fleet-recall or combined-current-engine performance claims. Private source and identifying pins remain private. Broader field calibration remains pending.",
+      "outcome": "Retain SARJ080 at ERROR for the expanded proven runtime type dispatch policy. Preserve the prior binding-safety restrictions and narrow safe-autofix profile; the added two-arm/OR field calibration remains pending."
     },
     {
       "task": "rule-audit/python/prefer-module-level-constant",
@@ -2805,8 +2805,8 @@
       "family": "python",
       "ruleId": "prefer-precise-object-contract",
       "state": "pending",
-      "evidence": "Fifty labeled cases:21 expected advisories and29 valid controls. Raw Pydantic callbacks, model_validate boundaries, framework hooks, quoted aliases, sentinels and alias recursion are covered; the bounded traversal removes demonstrated exponential alias expansion. The frozen replay contains52 object-contract findings, including legitimate generic opaque contracts; these are not a zero-false-positive result. The unchanged calibration corpus contains 50 content-pinned files / 639,913 bytes across repository, Pydantic, pytest and private linked-source samples, replayed in fresh processes capped at 250 files. Initial paired measurements against a control with the eight affected rules disabled showed about 17% warm overhead and 2% peak-RSS overhead; prior warm measurements varied 8\u201326%. These are historical control measurements, not an unchanged shipped-registry comparison. The PR records refreshed complete-base-versus-candidate measurements after cohort integration. Private source, paths and identifying pins remain outside public artifacts. This finite sample does not establish whole-project recall or fleet performance.",
-      "outcome": "Ship SARJ528 at WARNING without autofix and keep calibration pending. Prefer domain models, Protocols, TypeVars, JsonValue and ModuleType while explicitly reviewing genuinely opaque library boundaries. Do not promote this broad advisory to ERROR on the present evidence."
+      "evidence": "Fifty labeled cases:21 expected advisories and29 valid controls. Raw Pydantic callbacks, model_validate boundaries, framework hooks, quoted aliases, sentinels and alias recursion are covered; the bounded traversal removes demonstrated exponential alias expansion. The frozen replay contains52 object-contract findings, including legitimate generic opaque contracts; these are not a zero-false-positive result. The unchanged calibration corpus contains 50 content-pinned files / 639,913 bytes across repository, Pydantic, pytest and private linked-source samples, replayed in fresh processes capped at 250 files. Initial paired measurements against a control with the eight affected rules disabled showed about 17% warm overhead and 2% peak-RSS overhead; prior warm measurements varied 8\u201326%. These are historical control measurements, not an unchanged shipped-registry comparison. The PR records refreshed complete-base-versus-candidate measurements after cohort integration. Private source, paths and identifying pins remain outside public artifacts. This finite sample does not establish whole-project recall or fleet performance. The warning-first observations above are historical. Current main already treats SARJ528 as ERROR, and the typed-boundary request explicitly retains that policy; no new severity promotion is claimed. The typed-boundary record preserves separate labeled qualification and historical timing frames.",
+      "outcome": "Retain the existing SARJ528 ERROR policy as explicitly requested. Prefer precise domain models, Protocols, TypeVars, JsonValue and ModuleType while reviewing genuinely opaque library boundaries. Historical broad-advisory observations are not a zero-false-positive field result; calibration remains pending."
     },
     {
       "task": "rule-audit/python/prefer-direct-import-module",
@@ -2925,6 +2925,30 @@
       "state": "pending",
       "evidence": "Locally owned asyncio children need cancellation settlement under the application policy. Standalone warning owner SARJ537 preserves the byte-identical synchronous SARJ464 ERROR owner and its native public-example contract. The corpus contains no legacy synchronous finding; preservation also relies on the separate native controls. There is no automatic termination or pipe-handling rewrite. Fresh revision 4 matched full-registry qualification after the upstream Python/SQL runtime integration of the six new owners has 14 inspected true-positive findings, six labeled true-negative cases and two unsupported numeric positives. There are no inspected false positives, unclassified target findings, returned duplicate tuples, non-target changes or legacy-owner changes. Fifty hash-ranked Python files, ten workflows and nine retained historical self-source controls have no target hits and remain unlabeled, not negatives or recall proof. All 34 workers and 68 analyses complete. Native preflight passes 1,729 Python metadata/new/legacy cases and 584 text cases including 91 Slack cases, with clean strict types and no blocking lint findings. All timing pairs and available process/child RSS are retained; shared-VM variation supplies no causal speedup or general overhead bound. See packages/standards/benchmarks/source-audit-python-slack-qualification-20261026.json. Canonical verification, independent commit review and required head CI remain separate delivery gates; field calibration stays pending. Earlier revision 3 raw observations remain historical. Bytecode caches are not normalized, so first-analysis and cold-total timings do not establish cold-start costs or causal speedups. A later incoming scoped-React parser change is qualified by a separate fresh workflow-only revision5 against its exact new baseline. All10workers/20analyses complete with the same originalSlack1/repair0,1TP/1TN,ten unlabeled sample zeroes and no inspectedFP/non-target changes/unknown/parser failures/duplicate tuples/repeat drift. These confirm existing cases and do not increase combined14TP/6TN totals. Three paired workflow rounds retain all timing/RSS observations; shared-VM and unnormalized caches prevent causal speedup or a worst-case bound. Original Pythonv4/TSv3 and the original full report retain their exact historical timing frames; old Python startup timers also hash changed Standards source, so whole-worker current equivalence is not claimed. Incoming complete native2file lint/types and364React tests pass; full direct canonical verification, normal hooks, immutable-commit review and exact-head requiredCI remain separate. A subsequent two-path verification-only Makefile/mise integration preserves every measured runtime/fixture/worker byte and actualnpm12.2.1 identity. Workflowrevision5 retains its d4d baseline/timestamps; no second benchmark or timing repin is claimed. Qualification preserves the original make's three successful native phases, six completed test groups, exit code 2 and failed fourth phase at their original tree. An exact upstream input comparison carries forward only source-compatible completed checks; fresh affected preflights, Standards tests, TypeScript configuration and repository/privacy/shell checks complete under the current final shared native lease. Every test group was actually executed; an older TypeScript result was not substituted. Inputs outside the reviewed transition remain unchanged. PYTEST_ARGS and PYTEST_ADDOPTS remain empty. The earlier evidence-only tree is linked by an exact scalar transition and fresh metadata checks. A subsequent authored-ESLint hook helper and regression-test repair suppresses only native file-ignored notices; real rule warnings and errors remain blocking. Exact input comparisons and fresh targeted native checks qualify that verification-only repair and these evidence clarifications without repeating unchanged engine tests. No earlier make is claimed to have executed these later changes. Earlier qualification counts and measurements remain historical; see post_a5_reconciliation in source-audit-rule-admission-20261026.json for the integrated source scope and separate verification requirements.",
       "outcome": "Stage SARJ537 at WARNING without autofix. Prove exclusive ownership, preserve all cancellation/provenance exclusions, verify registry/ledger/public examples, and require native qualification, canonical checks, independent exact-commit review and exact-head CI. Field calibration remains pending."
+    },
+    {
+      "task": "rule-audit/python/prefer-typed-cli",
+      "family": "python",
+      "ruleId": "prefer-typed-cli",
+      "state": "pending",
+      "evidence": "Import-proven raw argv/parser construction and missing or erased local Typer parameter annotations have paired positive/negative controls; shadowing, stable aliases and native forwarding boundaries are covered. The pinned pre-integration record packages/python/benchmarks/typed-python-boundaries.json covers five affected rules with 111 valid labeled cases (51 TP, 60 TN, zero inspected FP/FN) and three explicit malformed-source rejections. Its repeated cold/warm measurements retain their historical source frame; they are not fleet-recall or combined-current-engine performance claims. Private source and identifying pins remain private. Broader field calibration remains pending.",
+      "outcome": "Ship SARJ533 at ERROR under the explicit user-approved typed Typer CLI policy. Preserve five explained exact-code native forwarding exceptions; review argument compatibility manually. No automatic rewrite; field calibration remains pending."
+    },
+    {
+      "task": "rule-audit/python/prefer-runtime-validation",
+      "family": "python",
+      "ruleId": "prefer-runtime-validation",
+      "state": "pending",
+      "evidence": "Import-proven TypeGuard returns, quoted annotations, module aliases and shadowing boundaries have paired controls. The warning is an architecture preference even for a correctly implemented guard. The pinned pre-integration record packages/python/benchmarks/typed-python-boundaries.json covers five affected rules with 111 valid labeled cases (51 TP, 60 TN, zero inspected FP/FN) and three explicit malformed-source rejections. Its repeated cold/warm measurements retain their historical source frame; they are not fleet-recall or combined-current-engine performance claims. Private source and identifying pins remain private. Broader field calibration remains pending.",
+      "outcome": "Ship SARJ534 at WARNING without autofix. Prefer returning actually validated domain values; do not merely rename TypeGuard to TypeIs or insert casts. Preserve indispensable low-level refinements with an explained exact-code exception."
+    },
+    {
+      "task": "rule-audit/python/prefer-typed-mapping-get",
+      "family": "python",
+      "ruleId": "prefer-typed-mapping-get",
+      "state": "pending",
+      "evidence": "Known Any/object/JsonValue string mappings, unchecked JSON, local returns, aliases and chained reads have paired controls. Precise maps, TypedDicts, raw normalization callbacks and unproven receivers retain their documented boundaries. The pinned pre-integration record packages/python/benchmarks/typed-python-boundaries.json covers five affected rules with 111 valid labeled cases (51 TP, 60 TN, zero inspected FP/FN) and three explicit malformed-source rejections. Its repeated cold/warm measurements retain their historical source frame; they are not fleet-recall or combined-current-engine performance claims. Private source and identifying pins remain private. Broader field calibration remains pending.",
+      "outcome": "Ship SARJ535 at WARNING without autofix. Validate external data into named models and use precise trusted internal contracts. Preserve typed get calls and review missing-field/default behavior manually; field calibration remains pending."
     }
   ]
 }