sourcecode 1.64.0__py3-none-any.whl → 1.66.0__py3-none-any.whl

sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.64.0"
+__version__ = "1.66.0"

sourcecode/hibernate_strat.py

@@ -253,6 +253,75 @@ def _scan_build_dependency(root: Path) -> tuple[bool, list[str]]:
                     samples.append(snippet)
     return found, samples
 
+
+# ── BUG #1: effective Hibernate version resolution ─────────────────────────
+# A 5→6 rewrite verdict is only valid when the project is actually on Hibernate 5.
+# Resolve the effective major version from build descriptors, following Maven
+# ${properties} (incl. BOM-managed values declared as <hibernate*.version>) and
+# explicit hibernate-core / hibernate-orm coordinates. When the resolved major is
+# ≥ 6 the 5→6 axis does NOT apply (the migration is already done). When it cannot
+# be resolved the axis degrades to a low-confidence hypothesis (no headline).
+_HIB_VER = r"(\d+\.\d+(?:\.\d+)?(?:[.\-][\w]+)*)"  # 6.2.13.Final, 5.6.15, 6.2
+_HIB_PROP_RE = re.compile(
+    r"<((?:[\w.\-]*hibernate[\w.\-]*?)\.?version)>\s*" + _HIB_VER + r"\s*</\1>",
+    re.IGNORECASE,
+)
+_HIB_COORD_VERSION_RE = re.compile(
+    r"<artifactId>\s*hibernate-(?:core|orm)\s*</artifactId>\s*"
+    r"(?:<[^>]+>[^<]*</[^>]+>\s*)*?<version>\s*" + _HIB_VER,
+    re.IGNORECASE | re.DOTALL,
+)
+_HIB_GRADLE_VERSION_RE = re.compile(
+    r"org\.hibernate(?:\.orm)?:hibernate-(?:core|orm):" + _HIB_VER,
+    re.IGNORECASE,
+)
+
+
+def _ver_key(full: str) -> tuple[int, int]:
+    parts = full.split(".")
+    try:
+        major = int(parts[0])
+    except (ValueError, IndexError):
+        return (0, 0)
+    try:
+        minor = int(parts[1]) if len(parts) > 1 else 0
+    except ValueError:
+        minor = 0
+    return (major, minor)
+
+
+def _resolve_hibernate_version(root: Path) -> tuple[Optional[str], Optional[int], str]:
+    """Return (full_version_string, major, confidence) for the effective Hibernate.
+
+    confidence is "high" when a version was resolved from a build descriptor,
+    "none" when none could be determined (degrade to hypothesis). The newest
+    declared Hibernate wins in a multi-module build.
+    """
+    import os
+    best_full: Optional[str] = None
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [d for d in dirnames if d not in _SKIP_BUILD_SCAN_DIRS]
+        for fname in filenames:
+            if fname not in _BUILD_FILE_NAMES:
+                continue
+            try:
+                text = (Path(dirpath) / fname).read_text(encoding="utf-8", errors="replace")
+            except OSError:
+                continue
+            fulls: list[str] = []
+            for m in _HIB_PROP_RE.finditer(text):
+                fulls.append(m.group(2))
+            for m in _HIB_COORD_VERSION_RE.finditer(text):
+                fulls.append(m.group(1))
+            for m in _HIB_GRADLE_VERSION_RE.finditer(text):
+                fulls.append(m.group(1))
+            for full in fulls:
+                if best_full is None or _ver_key(full) > _ver_key(best_full):
+                    best_full = full
+    if best_full is None:
+        return None, None, "none"
+    return best_full, _ver_key(best_full)[0], "high"
+
 # Escalation markers — dynamic / reflection-based persistence construction.
 _ABSTRACTION_CLASS_RE = re.compile(
     r"\b(DynamicEntityDao|DynamicEntityDaoImpl|BasicPersistenceModule|"
@@ -406,12 +475,23 @@ class HibernateStratification:
     # when backed by a build dependency or a parsed org.hibernate import, "none"
     # when detection was vetoed for lack of evidence.
     evidence: dict = field(default_factory=dict)
+    # BUG #1: effective Hibernate version + whether the 5→6 axis applies at all.
+    # When the resolved major is ≥ 6 the migration is already done → not applicable
+    # (never a blocker). When unresolved, the axis is a low-confidence hypothesis.
+    effective_version: Optional[str] = None
+    version_major: Optional[int] = None
+    version_confidence: str = "none"
+    migration_applicable: bool = True
 
     def to_dict(self) -> dict:
         return {
             "schema_version": HIBERNATE_SCHEMA_VERSION,
             "detected": self.detected,
             "evidence": self.evidence,
+            "effective_version": self.effective_version,
+            "version_major": self.version_major,
+            "version_confidence": self.version_confidence,
+            "migration_applicable": self.migration_applicable,
             "classification": self.classification,
             "classification_label": self.classification_label,
             "stratified": True,
@@ -763,6 +843,7 @@ def analyze_hibernate(file_paths: list[str], root: Path) -> HibernateStratificat
         return strat
 
     dep_present, dep_samples = _scan_build_dependency(root)
+    eff_version, version_major, version_conf = _resolve_hibernate_version(root)
 
     has_evidence = dep_present or any_hibernate_import or any_jpa_import
     evidence: dict = {
@@ -771,6 +852,9 @@ def analyze_hibernate(file_paths: list[str], root: Path) -> HibernateStratificat
         "hibernate_import_present": any_hibernate_import,
         "hibernate_import_sample": hibernate_import_sample,
         "jpa_import_present": any_jpa_import,
+        "effective_version": eff_version,
+        "version_major": version_major,
+        "version_confidence": version_conf,
         "confidence": "high" if has_evidence else "none",
     }
 
@@ -959,6 +1043,12 @@ def analyze_hibernate(file_paths: list[str], root: Path) -> HibernateStratificat
     strat = HibernateStratification()
     strat.findings = findings
     strat.evidence = evidence
+    strat.effective_version = eff_version
+    strat.version_major = version_major
+    strat.version_confidence = version_conf
+    # BUG #1: the 5→6 axis only applies when NOT already on Hibernate 6+. A
+    # resolved major ≥ 6 means the migration is complete — never a blocker.
+    strat.migration_applicable = not (version_major is not None and version_major >= 6)
     strat.rewrite_targets = sorted(
         targets, key=lambda t: (t.source_file, t.line_start, t.layer, t.id)
     )
@@ -1126,13 +1216,23 @@ def analyze_hibernate(file_paths: list[str], root: Path) -> HibernateStratificat
         stops.append("SQL/HQL shape not statically inferable (string concatenation)")
     strat.stop_conditions_triggered = stops
 
-    if stops:
+    if not strat.migration_applicable:
+        # Already on Hibernate 6+ — the 5→6 stratification below is retained as an
+        # informational exposure map, but it is NOT a migration and NOT a blocker.
+        strat.classification = CLASS_NONE
+        strat.classification_label = (
+            f"ALREADY ON HIBERNATE {strat.version_major} "
+            f"({strat.effective_version}) — NO 5→6 MIGRATION PENDING"
+        )
+        strat.stop_conditions_triggered = []
+    elif stops:
         strat.classification = CLASS_REWRITE
     elif layer_files[LAYER_CRITERIA] or concat_query_global or jpa_deprecated_seen:
         strat.classification = CLASS_UPGRADE_CARE
     else:
         strat.classification = CLASS_UPGRADE
-    strat.classification_label = _CLASS_LABELS[strat.classification]
+    if strat.migration_applicable:
+        strat.classification_label = _CLASS_LABELS[strat.classification]
 
     # ── Risk separation: observable vs inferred ─────────────────────────────
     observable: list[str] = []

sourcecode/integration_detector.py

@@ -35,10 +35,28 @@ _ATTR_NAME_RE = re.compile(r'(?:name|value)\s*=\s*"([^"]*)"')
 _FIRST_LITERAL_RE = re.compile(r'^\s*"([^"]*)"')
 
 # token -> (kind, client). Matched as whole-word usage outside imports/comments.
+# Covers Spring AND plain-Java/Jakarta stacks (Quarkus, Micronaut, Keycloak SPI):
+# the detector must not be Spring-centric, or a non-Spring repo with real LDAP /
+# SMTP / HTTP integrations falsely reports "0 integrations".
 _TOKEN_CLIENTS: "tuple[tuple[str, str, str], ...]" = (
+    # Spring HTTP clients
     ("RestTemplate", "http", "resttemplate"),
     ("WebClient", "http", "webclient"),
+    # Plain-Java / third-party HTTP clients
+    ("HttpClient", "http", "jdk-httpclient"),          # java.net.http.HttpClient
+    ("CloseableHttpClient", "http", "apache-httpclient"),
+    ("HttpClients", "http", "apache-httpclient"),
+    ("OkHttpClient", "http", "okhttp"),
+    # LDAP / directory (Spring + JNDI)
     ("LdapTemplate", "ldap", "ldaptemplate"),
+    ("InitialLdapContext", "ldap", "jndi-ldap"),
+    ("InitialDirContext", "ldap", "jndi-ldap"),
+    ("LdapContext", "ldap", "jndi-ldap"),
+    # Mail / SMTP (JavaMail / Jakarta Mail)
+    ("JavaMailSender", "smtp", "spring-mail"),
+    ("MimeMessage", "smtp", "javamail"),
+    ("Transport", "smtp", "javamail"),
+    # JMS / messaging
     ("JmsTemplate", "jms", "jmstemplate"),
     ("ActiveMQConnectionFactory", "jms", "activemq"),
 )
@@ -156,8 +174,21 @@ def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
     for r in records:
         by_kind[r["kind"]] = by_kind.get(r["kind"], 0) + 1
 
+    # BUG #9: honest confidence. A zero count means "no detectable client
+    # construct was found", NOT "this system has no integrations" — runtime-wired
+    # clients (DI, config-driven endpoints, JCA connectors) are invisible to static
+    # text matching. Report that explicitly instead of an authoritative "0".
+    confidence = "observed" if records else "not_analyzed"
     return {
         "integrations": records,
         "by_kind": {k: by_kind[k] for k in sorted(by_kind)},
         "count": len(records),
+        "confidence": confidence,
+        "coverage_note": (
+            "Detects HTTP (RestTemplate/WebClient/JDK/Apache/OkHttp), LDAP (Spring "
+            "+ JNDI), SMTP (JavaMail), and JMS client constructs by source-text "
+            "matching. A count of 0 means no such construct was found, not that the "
+            "system has no outbound integrations — runtime/DI-wired clients are not "
+            "statically visible."
+        ),
     }

sourcecode/migrate_check.py

@@ -22,6 +22,8 @@ from datetime import datetime, timezone
 from pathlib import Path
 from typing import Optional, TYPE_CHECKING
 
+from sourcecode.path_filters import is_test_or_fixture_path
+
 if TYPE_CHECKING:
     from sourcecode.hibernate_strat import HibernateStratification
 
@@ -582,6 +584,54 @@ def _is_no_migrate_javax(fqn: str) -> bool:
     """True if a javax FQN belongs to a JDK/permanent namespace (no jakarta move)."""
     return any(fqn.startswith(p) for p in _JAKARTA_NO_MIGRATE_PREFIXES)
 
+
+# BUG #8: autogenerated source markers — path fragments and the JSR-250 marker.
+_GENERATED_PATH_FRAGMENTS: tuple[str, ...] = (
+    "/generated-sources/", "/generated/", "/target/generated",
+    "/build/generated", "/.apt_generated/",
+)
+
+
+def _classify_code_context(finding: "MigrationFinding") -> str:
+    """Bucket a finding as main / test / generated for blocking-count segregation."""
+    path = finding.source_file
+    if is_test_or_fixture_path(path):
+        return "test"
+    norm = path.replace("\\", "/").lower()
+    if any(frag in norm for frag in _GENERATED_PATH_FRAGMENTS):
+        return "generated"
+    # javax.annotation.Generated is the marker emitted into autogenerated code.
+    if finding.rule_id == "MIG-006" and finding.imports_found and all(
+        imp.rsplit(".", 1)[-1] == "Generated" for imp in finding.imports_found
+    ):
+        return "generated"
+    return "main"
+
+
+# BUG #2: Spring presence signal. The Boot3 dimension only applies to repos that
+# actually use Spring — a Quarkus/Micronaut/Helidon/Jakarta-pure repo has no
+# Spring Boot 2→3 axis. Detected from build coordinates or framework imports.
+_SPRING_BUILD_RE: re.Pattern = re.compile(
+    r"org\.springframework(?:\.boot)?\b|spring-boot-starter", re.IGNORECASE
+)
+_SPRING_IMPORT_RE: re.Pattern = re.compile(
+    r"^[ \t]*import\s+org\.springframework\.", re.MULTILINE
+)
+
+
+def _detect_spring_present(root: Path, spring_import_seen: bool) -> bool:
+    """True when Spring is actually used (build coordinate or org.springframework import)."""
+    if spring_import_seen:
+        return True
+    for abs_path, _rel in _find_build_files(root):
+        try:
+            text = abs_path.read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            continue
+        if _SPRING_BUILD_RE.search(text):
+            return True
+    return False
+
 # G-1: cap on total readiness deduction from low-severity (advisory, non-blocking)
 # findings, so optional modernization cleanups cannot collapse the migration-readiness
 # headline on a repo with zero blockers. See MigrationReport.finalize.
@@ -594,6 +644,23 @@ _JAKARTA_TARGETS: frozenset[str] = frozenset({"jakarta"})
 _BOOT3_MIGRATION_TARGETS: frozenset[str] = frozenset(
     {"jakarta", "spring_boot_3", "spring_security_6"}
 )
+# BUG #6: best-practice hygiene (java.util.Date → java.time) blocks NO version
+# upgrade. It is advisory only and must never sink a readiness dimension to 0 —
+# reported as a separate hygiene metric, excluded from JDK-modernization scoring.
+_BEST_PRACTICE_TARGETS: frozenset[str] = frozenset({"java_8_best_practice"})
+
+# BUG #3: the migration dimensions that feed the readiness_score aggregate, in
+# order. jdk_modernization is deliberately NOT here — it is orthogonal upkeep debt
+# reported on its own axis, never folded into the migration headline.
+_MIGRATION_DIMENSIONS: tuple[str, ...] = ("jakarta", "boot3", "hibernate")
+
+
+def _parse_major(version: "Optional[str]") -> "Optional[int]":
+    """Leading integer of a version string ('4.0.3' → 4); None when not parseable."""
+    if not version:
+        return None
+    m = re.match(r"\s*(\d+)", version)
+    return int(m.group(1)) if m else None
 # Cap on total readiness deduction from JDK-modernization findings (medium/low),
 # so reflection/date cleanups cannot collapse a jakarta-ready repo's headline.
 _JDK_ADVISORY_DEDUCTION_CAP: int = 15
@@ -1013,6 +1080,10 @@ class MigrationFinding:
     fix_hint: str = ""
     migration_target: str = ""
     openrewrite_recipe: Optional[str] = None
+    # BUG #8: where the finding lives — "main" (product), "test" (test/fixture
+    # harness), or "generated" (autogenerated source). Only "main" counts toward
+    # blocking_count / readiness; test+generated are reported in a separate bucket.
+    code_context: str = "main"
 
     @staticmethod
     def make_id(rule_id: str, source_file: str) -> str:
@@ -1031,6 +1102,7 @@ class MigrationFinding:
             "fix_hint": self.fix_hint,
             "migration_target": self.migration_target,
             "auto_fix_available": bool(self.openrewrite_recipe),
+            "code_context": self.code_context,
         }
         if self.imports_found:
             d["imports_found"] = self.imports_found
@@ -1061,8 +1133,12 @@ def _dimension_score(
     low: set[str] = set()
     for f in findings:
         if targets is None:
+            # JDK-modernization axis: everything NOT a Boot 2→3 blocker, EXCEPT
+            # best-practice hygiene (BUG #6) which is advisory and scored separately.
             if f.migration_target in _BOOT3_MIGRATION_TARGETS:
                 continue
+            if f.migration_target in _BEST_PRACTICE_TARGETS:
+                continue
         elif f.migration_target not in targets:
             continue
         if f.severity == "critical":
@@ -1107,12 +1183,22 @@ class MigrationReport:
     # is excluded from the aggregate — it is never counted as 0. Maps dimension →
     # {"applicable": bool, "score": int|None, "reason": str}.
     applicable_dimensions: dict = field(default_factory=dict)
+    # BUG #3: how readiness_score was derived (method + the exact applicable
+    # dimension scores it aggregates) so the headline number is fully traceable.
+    readiness_aggregate: dict = field(default_factory=dict)
     blocking_count: int = 0
     estimated_effort_days: float = 0.0
     # Tri-state: True = Boot 2 confirmed, False = Boot 3+ confirmed,
     # None = could not determine. Absence of evidence is never reported as True.
     spring_boot_2_detected: Optional[bool] = None
     spring_boot_version_detected: Optional[str] = None
+    # BUG #2: whether Spring is used at all. The Boot3 dimension is N/A without it.
+    spring_present: bool = True
+    # BUG #6 / #8: findings that do NOT count toward blocking_count or readiness —
+    # best-practice hygiene (java.util.Date…) and test/fixture/generated buckets,
+    # surfaced separately so the headline reflects real product migration risk.
+    hygiene_findings: int = 0
+    non_blocking: dict = field(default_factory=dict)
 
     findings: list[MigrationFinding] = field(default_factory=list)
     limitations: list[str] = field(default_factory=list)
@@ -1138,82 +1224,148 @@ class MigrationReport:
             by_target[f.migration_target] = by_target.get(f.migration_target, 0) + 1
             affected_files.add(f.source_file)
 
-        self.blocking_count = by_severity["critical"] + by_severity["high"]
+        # BUG #8: only product ("main") code counts toward blocking_count, the
+        # readiness dimensions, and effort. Test harnesses/fixtures (deprecated
+        # web.xml descriptors, test-only sun.* HTTP servers) and autogenerated
+        # sources are reported in a separate non-blocking bucket — counting them
+        # as product blockers inflates the verdict.
+        main_findings = [f for f in self.findings if f.code_context == "main"]
+
+        def _files_by_sev(items: list["MigrationFinding"], sev: str,
+                          targets: "Optional[frozenset[str]]" = None,
+                          exclude: "Optional[frozenset[str]]" = None) -> set[str]:
+            out: set[str] = set()
+            for f in items:
+                if f.severity != sev:
+                    continue
+                if targets is not None and f.migration_target not in targets:
+                    continue
+                if exclude is not None and f.migration_target in exclude:
+                    continue
+                out.add(f.source_file)
+            return out
+
+        critical_files = _files_by_sev(main_findings, "critical")
+        high_files = _files_by_sev(main_findings, "high")
+        medium_files = _files_by_sev(main_findings, "medium")
+        low_files = _files_by_sev(main_findings, "low")
+
+        self.blocking_count = sum(
+            1 for f in main_findings if f.severity in ("critical", "high")
+        )
 
-        critical_files: set[str] = set()
-        high_files: set[str] = set()
-        medium_files: set[str] = set()
-        low_files: set[str] = set()
-        for f in self.findings:
-            if f.severity == "critical":
-                critical_files.add(f.source_file)
-            elif f.severity == "high":
-                high_files.add(f.source_file)
-            elif f.severity == "medium":
-                medium_files.add(f.source_file)
+        # Per-dimension readiness — independent severity-weighted scores (MAIN only).
+        self.jakarta_readiness = _dimension_score(main_findings, _JAKARTA_TARGETS)
+        self.boot3_readiness = _dimension_score(main_findings, _BOOT3_MIGRATION_TARGETS)
+        self.jdk_modernization = _dimension_score(main_findings, None)
+        if not self.spring_present:
+            self.boot3_readiness = 100
+
+        # ── BUG #2: Hibernate applicability — version-driven, never heuristic ────
+        # The 5→6 axis is applicable ONLY when the repo is actually on Hibernate < 6.
+        #   resolved < 6        → applicable (rewrite score is a measurement)
+        #   resolved ≥ 6        → N/A (already migrated)
+        #   unresolved, Boot≥3  → N/A (Boot 3/4 BOM manages Hibernate ORM ≥6)
+        #   unresolved, Boot==2 → applicable (Boot 2 BOM manages Hibernate 5.x)
+        #   unresolved, no BOM  → N/A, status "unresolved" (NEVER a heuristic number
+        #                          that looks like a measurement on absent data)
+        hib = self.hibernate
+        hib_detected = hib is not None and hib.detected
+        boot_major = _parse_major(self.spring_boot_version_detected)
+        _hibernate_applies = False
+        _hib_score: Optional[int] = None
+        hib_status = "not_detected"
+        _hib_reason = "N/A — no Hibernate dependency or import detected"
+        if hib_detected:
+            if hib.version_confidence == "high":
+                if hib.migration_applicable:              # resolved major < 6
+                    _hibernate_applies, _hib_score = True, hib.readiness
+                    hib_status = "resolved_h5"
+                    _hib_reason = f"Hibernate 5→6 rewrite axis (resolved {hib.effective_version})"
+                else:                                     # resolved major ≥ 6
+                    hib_status = "managed_ge6"
+                    _hib_reason = (f"N/A — resolved Hibernate {hib.effective_version} (≥6); "
+                                   f"no 5→6 migration pending")
+            elif boot_major is not None and boot_major >= 3:
+                hib_status = "managed_ge6"
+                _hib_reason = (f"N/A — Hibernate version managed by Spring Boot "
+                               f"{self.spring_boot_version_detected} BOM (Hibernate ORM ≥6); "
+                               f"5→6 axis inapplicable")
+            elif boot_major == 2:
+                _hibernate_applies, _hib_score = True, hib.readiness
+                hib_status = "managed_h5"
+                _hib_reason = (f"Hibernate 5→6 rewrite axis (Hibernate 5.x managed by Spring "
+                               f"Boot {self.spring_boot_version_detected} BOM)")
             else:
-                low_files.add(f.source_file)
-
-        # BUG-2: aggregate readiness no longer collapses on raw JDK-modernization
-        # volume. Blockers (critical/high, any target) stay uncapped so a genuinely
-        # blocked repo floors at 0 (shopizer: 301 blocking → 0). Medium/low are
-        # split by target: migration-blocking (jakarta/boot3/security) count in
-        # full (low capped, G-1); orthogonal JDK debt (Date/reflection) is capped
-        # so it cannot sink a jakarta-ready repo (Broadleaf: 144 Date + 25 reflection
-        # no longer force 0/100).
-        mig_med = {f.source_file for f in self.findings
-                   if f.severity == "medium" and f.migration_target in _BOOT3_MIGRATION_TARGETS}
-        mig_low = {f.source_file for f in self.findings
-                   if f.severity == "low" and f.migration_target in _BOOT3_MIGRATION_TARGETS}
-        jdk_med = {f.source_file for f in self.findings
-                   if f.severity == "medium" and f.migration_target not in _BOOT3_MIGRATION_TARGETS}
-        jdk_low = {f.source_file for f in self.findings
-                   if f.severity == "low" and f.migration_target not in _BOOT3_MIGRATION_TARGETS}
-
-        deduction = (
-            len(critical_files) * 15
-            + len(high_files) * 8
-            + len(mig_med) * 3
-            + min(len(mig_low) * 1, _LOW_SEVERITY_DEDUCTION_CAP)
-            + min(len(jdk_med) * 3 + len(jdk_low) * 1, _JDK_ADVISORY_DEDUCTION_CAP)
-        )
-        self.readiness_score = max(0, 100 - deduction)
-
-        # Per-dimension readiness — independent severity-weighted scores so the
-        # output reveals that jakarta/Boot3 may be complete even with JDK debt.
-        self.jakarta_readiness = _dimension_score(self.findings, _JAKARTA_TARGETS)
-        self.boot3_readiness = _dimension_score(self.findings, _BOOT3_MIGRATION_TARGETS)
-        self.jdk_modernization = _dimension_score(self.findings, None)
-
-        # Hibernate is its own rewrite axis (orthogonal to jakarta/Boot3); it does
-        # NOT sink the headline readiness_score, but is surfaced as a dimension and,
-        # in a rewrite zone, as the headline_blocker so 62/100 is not read as "easy".
-        _hibernate_applies = self.hibernate is not None and self.hibernate.detected
-        if _hibernate_applies:
-            self.hibernate_readiness = self.hibernate.readiness
-            if self.hibernate.classification == "rewrite_zone":
-                self.headline_blocker = "hibernate_rewrite"
-
-        # BUG #3: declare which dimensions apply. jakarta/boot3/jdk are always
-        # applicable to a Java/Spring repo; hibernate applies only when a real
-        # Hibernate dependency/import was found. An inapplicable dimension is N/A
-        # (score=None) and is excluded from the aggregate — never scored as 0.
+                hib_status = "unresolved"
+                _hib_reason = ("N/A — Hibernate version unresolved (not declared and no Spring "
+                               "Boot BOM to infer from); not penalized on absent data")
+        # Top-level scalar: the rewrite score only when applicable; else 100 (nothing
+        # pending) — never a heuristic penalty on an inapplicable/unresolved axis.
+        self.hibernate_readiness = _hib_score if _hibernate_applies else 100
+        # Headline blocker only on a DIRECTLY-resolved Hibernate-5 rewrite zone.
+        if _hibernate_applies and hib is not None and hib.classification == "rewrite_zone" \
+                and hib.version_confidence == "high":
+            self.headline_blocker = "hibernate_rewrite"
+
+        # BUG #3: declare which dimensions apply, then derive readiness_score as a
+        # DOCUMENTED aggregate over the applicable MIGRATION dimensions only. jakarta
+        # is always applicable; boot3 only with Spring; hibernate only for a real
+        # Hibernate < 6. jdk_modernization is an orthogonal upkeep axis (SecurityManager,
+        # reflection, java.time) — reported but EXCLUDED from the headline so JDK debt
+        # cannot sink a framework-complete repo. N/A dimensions carry score=None and
+        # never enter the aggregate.
         self.applicable_dimensions = {
             "jakarta": {"applicable": True, "score": self.jakarta_readiness,
                         "reason": "javax→jakarta namespace migration"},
-            "boot3": {"applicable": True, "score": self.boot3_readiness,
-                      "reason": "Spring Boot 2→3 / Security 6 migration"},
+            "boot3": {
+                "applicable": self.spring_present,
+                "score": self.boot3_readiness if self.spring_present else None,
+                "reason": ("Spring Boot 2→3 / Security 6 migration"
+                           if self.spring_present
+                           else "N/A — no Spring usage detected (non-Spring stack)"),
+            },
             "jdk_modernization": {"applicable": True, "score": self.jdk_modernization,
-                                  "reason": "orthogonal JDK modernization debt"},
+                                  "reason": "orthogonal JDK modernization debt (excluded from "
+                                            "the readiness_score aggregate)",
+                                  "in_aggregate": False},
             "hibernate": {
                 "applicable": _hibernate_applies,
                 "score": self.hibernate_readiness if _hibernate_applies else None,
-                "reason": ("Hibernate 5→6 rewrite axis"
-                           if _hibernate_applies
-                           else "N/A — no Hibernate dependency or import detected"),
+                "reason": _hib_reason,
+                "status": hib_status,
             },
         }
 
+        # ── BUG #3: aggregate invariant ─────────────────────────────────────────
+        # readiness_score == min(score of every applicable migration dimension).
+        # MIN (not mean): a migration is only as ready as its weakest applicable
+        # axis. _MIGRATION_DIMENSIONS lists exactly which dimensions feed it; the
+        # consistency invariant is asserted in finalize and covered by a unit test.
+        agg_inputs = {
+            name: self.applicable_dimensions[name]["score"]
+            for name in _MIGRATION_DIMENSIONS
+            if self.applicable_dimensions[name]["applicable"]
+        }
+        self.readiness_score = min(agg_inputs.values()) if agg_inputs else 100
+        self.readiness_aggregate = {
+            "method": "min",
+            "inputs": agg_inputs,
+            "excluded": ["jdk_modernization"],
+            "note": ("readiness_score = min over applicable migration dimensions "
+                     "(jakarta / boot3 / hibernate). jdk_modernization is an orthogonal "
+                     "upkeep axis and is intentionally excluded."),
+        }
+        # Internal consistency guard — the headline cannot diverge from the dimensions
+        # it claims to summarize (catches a future scorer change that breaks the model).
+        if agg_inputs:
+            assert self.readiness_score == min(agg_inputs.values()), (
+                "readiness_score must equal min(applicable migration dimensions); "
+                f"got {self.readiness_score} vs inputs {agg_inputs}"
+            )
+
+        # BUG #5: effort over MAIN findings only — N/A axes (Hibernate-6 phantom,
+        # test fixtures) no longer pad the estimate.
         self.estimated_effort_days = round(
             len(critical_files) * 0.5
             + len(high_files) * 0.25
@@ -1222,12 +1374,34 @@ class MigrationReport:
             1,
         )
 
+        # BUG #6 / #8: hygiene + non-blocking buckets, surfaced separately.
+        self.hygiene_findings = sum(
+            1 for f in main_findings if f.migration_target in _BEST_PRACTICE_TARGETS
+        )
+        _nb_by_ctx: dict[str, int] = {}
+        _nb_by_rule: dict[str, int] = {}
+        for f in self.findings:
+            if f.code_context == "main":
+                continue
+            _nb_by_ctx[f.code_context] = _nb_by_ctx.get(f.code_context, 0) + 1
+            _nb_by_rule[f.rule_id] = _nb_by_rule.get(f.rule_id, 0) + 1
+        self.non_blocking = {
+            "count": sum(_nb_by_ctx.values()),
+            "by_context": _nb_by_ctx,
+            "by_rule": _nb_by_rule,
+            "note": ("Findings in test/fixture harnesses or autogenerated sources. "
+                     "Excluded from blocking_count, readiness, and effort."),
+        }
+
         self.summary = {
             "total_findings": len(self.findings),
             "affected_files": len(affected_files),
             "by_severity": by_severity,
             "by_rule": by_rule,
             "by_migration_target": by_target,
+            "main_findings": len(main_findings),
+            "non_blocking_findings": self.non_blocking["count"],
+            "hygiene_findings": self.hygiene_findings,
         }
         return self
 
@@ -1243,14 +1417,20 @@ class MigrationReport:
             "jdk_modernization": self.jdk_modernization,
             "hibernate_readiness": self.hibernate_readiness,
             "applicable_dimensions": self.applicable_dimensions,
+            "readiness_aggregate": self.readiness_aggregate,
             "readiness_note": (
-                "readiness_score is a DERIVED aggregate over applicable dimensions only "
-                "(N/A dimensions excluded, never counted as 0). For migration decisions read "
-                "the per-dimension breakdown + blocking_count, not the single number."
+                "readiness_score = min over applicable MIGRATION dimensions "
+                "(jakarta / boot3 / hibernate); see readiness_aggregate for the exact "
+                "inputs. N/A dimensions are excluded (never counted as 0); "
+                "jdk_modernization is orthogonal upkeep and is NOT in the aggregate. "
+                "For decisions read the per-dimension breakdown + blocking_count."
             ),
             "headline_blocker": self.headline_blocker,
             "blocking_count": self.blocking_count,
             "estimated_effort_days": self.estimated_effort_days,
+            "hygiene_findings": self.hygiene_findings,
+            "non_blocking": self.non_blocking,
+            "spring_present": self.spring_present,
             "spring_boot_2_detected": self.spring_boot_2_detected,
             "spring_boot_version_detected": self.spring_boot_version_detected,
             "summary": self.summary,
@@ -1270,19 +1450,31 @@ class MigrationReport:
             _boot = f"Boot {self.spring_boot_version_detected or '3+'} detected"
         else:
             _boot = "unknown"
+
+        def _dim(name: str) -> str:
+            d = self.applicable_dimensions.get(name, {})
+            if not d.get("applicable", True):
+                return f"{name}: N/A"
+            return f"{name}: {d.get('score')}/100"
+
+        # Blocking parenthetical reflects MAIN (product) findings only — matching
+        # blocking_count — so the text headline cannot contradict the JSON.
+        main_crit = sum(1 for f in self.findings
+                        if f.code_context == "main" and f.severity == "critical")
+        main_high = sum(1 for f in self.findings
+                        if f.code_context == "main" and f.severity == "high")
+        nb = self.non_blocking.get("count", 0)
         lines: list[str] = [
             f"Migration Readiness: {self.readiness_score}/100",
-            f"  jakarta: {self.jakarta_readiness}/100  "
-            f"boot3: {self.boot3_readiness}/100  "
-            f"jdk-modernization: {self.jdk_modernization}/100  "
-            f"hibernate: {self.hibernate_readiness}/100",
+            f"  {_dim('jakarta')}  {_dim('boot3')}  "
+            f"{_dim('jdk_modernization')}  {_dim('hibernate')}",
             *([f"  ⚠ Headline blocker: {self.headline_blocker} "
                f"(readiness_score reflects jakarta/Boot3 only — Hibernate is a separate rewrite axis)"]
               if self.headline_blocker else []),
-            f"Spring Boot 2 detected: {_boot}",
-            f"Blocking issues: {self.blocking_count}  "
-            f"(critical: {self.summary.get('by_severity', {}).get('critical', 0)}, "
-            f"high: {self.summary.get('by_severity', {}).get('high', 0)})",
+            f"Spring present: {self.spring_present}    Spring Boot 2 detected: {_boot}",
+            f"Blocking issues (product code): {self.blocking_count}  "
+            f"(critical: {main_crit}, high: {main_high})"
+            + (f"   [+{nb} in test/generated, non-blocking]" if nb else ""),
             f"Affected files: {self.summary.get('affected_files', 0)}",
             f"Estimated effort: {self.estimated_effort_days}d",
             "",
@@ -1314,6 +1506,42 @@ class MigrationReport:
 # Java source scanner
 # ---------------------------------------------------------------------------
 
+# BUG #7: javax.annotation.Generated is the JSR-250 marker emitted into
+# AUTOGENERATED sources (SCIM, JAXB, MapStruct…). It maps mechanically to
+# jakarta.annotation.Generated and carries low migration value — it must not be
+# described with the generic "@PostConstruct/@PreDestroy/@Resource" blurb, nor
+# rated medium alongside real CDI lifecycle annotations.
+_MIG006_LIFECYCLE = ("PostConstruct", "PreDestroy", "Resource",
+                     "ManagedBean", "Priority", "Resources")
+
+
+def _refine_mig006(matched_imports: list[str]) -> tuple[str, str]:
+    """Return (severity, explanation) tailored to the actual javax.annotation symbols.
+
+    Explanation names the concrete symbols detected, not a fixed list. When the
+    only symbol is `Generated`, severity degrades to low (mechanical, generated
+    code); otherwise the CDI lifecycle annotations keep medium severity.
+    """
+    symbols = [imp.rsplit(".", 1)[-1] for imp in matched_imports]
+    lifecycle = [s for s in symbols if s in _MIG006_LIFECYCLE]
+    only_generated = bool(symbols) and all(s == "Generated" for s in symbols)
+    sym_list = ", ".join(f"@{s}" for s in dict.fromkeys(symbols)) or "javax.annotation"
+    if only_generated:
+        return (
+            "low",
+            "javax.annotation.Generated (JSR-250) maps mechanically to "
+            "jakarta.annotation.Generated. It is emitted into autogenerated sources "
+            "and carries low migration value — re-run the generator on the Jakarta "
+            "toolchain rather than hand-editing.",
+        )
+    affected = ", ".join(f"@{s}" for s in dict.fromkeys(lifecycle)) or sym_list
+    return (
+        "medium",
+        f"jakarta.annotation replaces javax.annotation in Jakarta EE 9+. "
+        f"Detected symbol(s): {sym_list}. {affected} are affected.",
+    )
+
+
 def _scan_file(
     source: str,
     rel_path: str,
@@ -1360,16 +1588,21 @@ def _scan_file(
         first_line = min(candidate_lines)
         all_matches = matched_imports + code_snippets
 
+        severity = rule.severity
+        explanation = rule.explanation
+        if rule.id == "MIG-006" and matched_imports:
+            severity, explanation = _refine_mig006(matched_imports)
+
         findings.append(
             MigrationFinding(
                 id=MigrationFinding.make_id(rule.id, rel_path),
                 rule_id=rule.id,
-                severity=rule.severity,
+                severity=severity,
                 title=rule.title,
                 source_file=rel_path,
                 first_line=first_line,
                 imports_found=all_matches,
-                explanation=rule.explanation,
+                explanation=explanation,
                 fix_hint=rule.fix_hint,
                 migration_target=rule.migration_target,
                 openrewrite_recipe=rule.openrewrite_recipe,
@@ -1410,6 +1643,7 @@ def run_migrate_check(
     limitations: list[str] = []
     read_errors = 0
     jakarta_import_count = 0
+    spring_import_seen = False
 
     # ── Java source scan ────────────────────────────────────────────────────
     for rel_path in file_paths:
@@ -1422,6 +1656,8 @@ def run_migrate_check(
 
         # Jakarta EE 9+ namespace adoption signal (vetoes a false Boot-2 verdict).
         jakarta_import_count += len(_JAKARTA_IMPORT_RE.findall(source))
+        if not spring_import_seen and _SPRING_IMPORT_RE.search(source):
+            spring_import_seen = True
 
         file_findings = _scan_file(source, rel_path, _ALL_RULES)
         filtered = [f for f in file_findings if SEVERITY_ORDER.get(f.severity, 3) <= min_order]
@@ -1477,6 +1713,12 @@ def run_migrate_check(
     limitations.extend(_STATIC_LIMITATIONS)
 
     spring_boot_2, spring_boot_version = _detect_spring_boot(root, jakarta_import_count)
+    spring_present = _detect_spring_present(root, spring_import_seen)
+
+    # BUG #8: classify each finding's code context (main / test / generated) so the
+    # report can keep test fixtures and autogenerated sources out of blocking_count.
+    for f in all_findings:
+        f.code_context = _classify_code_context(f)
 
     # Hibernate 5→6 stratification (independent of min_severity — it is its own
     # risk model, not a severity-filtered finding stream).
@@ -1486,6 +1728,7 @@ def run_migrate_check(
     report = MigrationReport(
         spring_boot_2_detected=spring_boot_2,
         spring_boot_version_detected=spring_boot_version,
+        spring_present=spring_present,
         findings=all_findings,
         hibernate=hibernate_strat,
         limitations=limitations,

sourcecode/path_filters.py

@@ -12,6 +12,16 @@ _TEST_SEGMENTS = frozenset({
     "integrationtest", "integrationtests",
 })
 
+# Whole-module directories that are test harness / fixtures even though their
+# code lives under src/main (e.g. a Maven module that ships a test framework).
+# A finding under one of these modules is test infrastructure, not the product.
+_TEST_MODULE_SEGMENTS = frozenset({
+    "testsuite", "test-framework", "testframework",
+    "integration-arquillian", "arquillian",
+    "test-utils", "test-util", "testutils",
+    "test-support", "testsupport",
+})
+
 _VENDOR_SEGMENTS = frozenset({
     "vendor", "vendors",
     "third_party", "thirdparty",
@@ -86,6 +96,29 @@ def is_test_path(path: str) -> bool:
     return False
 
 
+def is_test_or_fixture_path(path: str) -> bool:
+    """Return True when *path* is test code OR test-harness/fixture infrastructure.
+
+    Broader than is_test_path: also catches whole modules that are test frameworks
+    or integration-test harnesses (testsuite/, test-framework/, integration-arquillian/,
+    *-test*, *-it modules) even when their sources sit under src/main. Migration
+    tooling uses this to keep test fixtures (deprecated web.xml deployment
+    descriptors, test-only sun.* HTTP servers) out of the product's blocking count.
+    """
+    if is_test_path(path):
+        return True
+    norm = path.replace("\\", "/").lower()
+    parts = norm.split("/")
+    for part in parts[:-1]:  # skip the filename
+        bare = part.rstrip("/")
+        if bare in _TEST_MODULE_SEGMENTS:
+            return True
+        # module dirs like "adapter-test", "foo-tests", "bar-itests"
+        if bare.endswith(("-test", "-tests", "-it", "-itest", "-itests")):
+            return True
+    return False
+
+
 def is_vendor_path(path: str) -> bool:
     """Return True when *path* is inside a vendored / third-party directory.
 

sourcecode/serializer.py

@@ -291,17 +291,65 @@ _JAKARTA_RENAMED_NAMESPACES: tuple[str, ...] = (
 )
 
 
+# Permanent JDK / JSR javax.* namespaces. These are part of the Java SE platform
+# (or standalone JCP specs) and were NEVER renamed to jakarta.* — Spring Boot 3/4
+# still uses them under javax.*. They must be excluded from EVERY javax→jakarta
+# detection rule (dependency coordinates AND import scanning). This is the single
+# source of truth for the allowlist — do NOT re-implement prefix checks elsewhere.
+# Counterpart in migrate_check._JAKARTA_NO_MIGRATE_PREFIXES (import side); keep both
+# in sync. NOTE: `javax.annotation.processing` is permanent (JSR-269, compiler API)
+# but bare `javax.annotation` (JSR-250 EE subset) DID move — handled below.
+_JAVAX_PERMANENT_NAMESPACES: tuple[str, ...] = (
+    "javax.cache",              # JSR-107 (JCache) — never renamed
+    "javax.sql",                # JDBC standard extension (Java SE)
+    "javax.xml",                # JAXP (parsers/transform/xpath/stream/namespace…)
+    "javax.naming",             # JNDI (Java SE)
+    "javax.management",         # JMX (Java SE)
+    "javax.crypto",             # JCE (Java SE)
+    "javax.net",                # incl. javax.net.ssl (Java SE)
+    "javax.security.auth",      # JAAS (Java SE)
+    "javax.security.cert",      # Java SE
+    "javax.security.sasl",      # Java SE
+    "javax.annotation.processing",  # JSR-269 compiler API (NOT the JSR-250 subset)
+    "javax.tools",              # Java SE compiler API
+    "javax.lang.model",         # Java SE annotation-processing model
+    "javax.sound",              # Java SE
+    "javax.imageio",            # Java SE
+    "javax.print",              # Java SE
+    "javax.accessibility",      # Java SE
+    "javax.swing",              # Java SE
+    "javax.smartcardio",        # Java SE
+)
+
+
+def _longest_namespace_match(nl: str, namespaces: "tuple[str, ...]") -> int:
+    """Length of the longest namespace in *namespaces* that is a prefix of *nl*.
+
+    Matches an exact namespace or a dotted sub-package (javax.xml → javax.xml.bind);
+    returns 0 when none match.
+    """
+    best = 0
+    for ns in namespaces:
+        if (nl == ns or nl.startswith(ns + ".")) and len(ns) > best:
+            best = len(ns)
+    return best
+
+
 def _is_jakarta_renamed_namespace(nl: str) -> bool:
     """True only for javax.* namespaces actually renamed to jakarta.* in Jakarta EE 9.
 
-    Matches exact namespace or a sub-package (e.g. javax.servlet → javax.servlet.http).
+    Decided by LONGEST-prefix match across the renamed list and the permanent
+    JDK/JSR allowlist — the more specific namespace wins. This keeps both nuanced
+    cases correct simultaneously:
+      - javax.xml.bind (renamed, len 14) beats javax.xml (permanent, len 9) → flag.
+      - javax.annotation.processing (permanent, len 27) beats javax.annotation
+        (renamed, len 16) → no flag.
     JDK/JSR namespaces that keep javax.* forever (javax.cache, javax.sql, javax.xml
-    JAXP, javax.naming, …) return False.
+    JAXP, javax.naming, …) never flag. A bare javax.* with no match also never flags.
     """
-    for ns in _JAKARTA_RENAMED_NAMESPACES:
-        if nl == ns or nl.startswith(ns + "."):
-            return True
-    return False
+    renamed = _longest_namespace_match(nl, _JAKARTA_RENAMED_NAMESPACES)
+    permanent = _longest_namespace_match(nl, _JAVAX_PERMANENT_NAMESPACES)
+    return renamed > 0 and renamed >= permanent
 
 
 def _dep_risk_flags(name: str, version: "Optional[str]") -> list[str]:

{sourcecode-1.64.0.dist-info → sourcecode-1.66.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.64.0
+Version: 1.66.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -411,7 +411,7 @@ Emits **structured, tool-agnostic** codebase views as plain JSON/YAML — the ki
 |------|--------|
 | `--by-directory` | One group per source directory, each symbol with a `source_file:line` reference. |
 | `--module-graph` | `{nodes, edges, summary}` — directories as modules, inter-module dependencies rolled up from class-level relation edges with hit counts + edge types. |
-| `--integrations` | Outbound integrations (`RestTemplate`, `WebClient`, `@FeignClient`, `LdapTemplate`, `JmsTemplate`, ActiveMQ) with `file:line` evidence and a literal `target` URL/name when present. |
+| `--integrations` | Outbound integrations across Spring **and** plain-Java/Jakarta stacks: HTTP (`RestTemplate`, `WebClient`, `@FeignClient`, JDK `HttpClient`, Apache, OkHttp), LDAP (`LdapTemplate`, JNDI `InitialDirContext`/`LdapContext`), SMTP (`JavaMailSender`, JavaMail `Transport`/`MimeMessage`), and JMS — with `file:line` evidence and a literal `target` when present. Emits an explicit `confidence` (`observed` / `not_analyzed`) + `coverage_note`: a count of `0` means "no client construct found", **not** "no integrations" (runtime/DI-wired clients are not statically visible). |
 | `--c4` | Unified document: `c4.{context, containers, components, code}` + `api_surface` + a `manifest` with per-directory content hashes for **incremental** consumers (skip directories whose hash is unchanged). `components.module_roots` rolls leaf source dirs up to architectural module roots and classifies each `layered` (DDD: ≥2 of `domain`/`application`/`infrastructure`) vs `flat` (legacy/flat package), with a verifiable `module_count` — so a consumer enumerates real modules instead of inferring boundaries from leaf directories. |
 
 The section flags compose (pass several for one multi-section document); `--c4` assembles the full export on its own. URLs assembled at runtime yield `target: null` (honest absence, never a guess); containers are derived from build files (Maven/Gradle) and reported as a limitation when none are found.
@@ -610,7 +610,7 @@ Detects migration blockers across Java source files, Spring XML config files, an
 | `MIG-002` | high | `javax.servlet` import — Servlet API changed |
 | `MIG-003` | high | `javax.validation` import — Bean Validation changed |
 | `MIG-004` | high | `javax.transaction` import — TX API changed |
-| `MIG-006` | medium | `javax.annotation` import — CDI annotations changed |
+| `MIG-006` | medium¹ | `javax.annotation` import — CDI annotations changed (¹`javax.annotation.Generated` in autogenerated code → **low**, bucketed `generated`; explanation names the actual symbol) |
 | `MIG-007` | medium | `javax.inject` import — DI annotations changed |
 | `MIG-008` | medium | `javax.ws.rs` import — JAX-RS changed |
 | `MIG-009` | medium | `javax.jms` import — JMS API changed |
@@ -722,9 +722,51 @@ reported as **N/A** (`score: null`), never as `0`. The top-level
 states that `readiness_score` is a derived aggregate over applicable dimensions
 only — for decisions, read the per-dimension breakdown + `blocking_count`.
 
+#### Reliability guarantees (no version, no verdict)
+
+A migration verdict shown to a decision-maker must never contradict its own
+evidence. `migrate-check` enforces:
+
+- **Version-gated framework axes.** The Hibernate 5→6 axis applies only when the
+  effective Hibernate version (resolved from `pom.xml`/Gradle, following Maven
+  `${properties}` and BOM-managed `<hibernate*.version>`) is `< 6`. A resolved
+  Hibernate **6+** repo is reported `migration_applicable: false` (N/A) — no
+  `hibernate_rewrite` headline. An **unresolved** version degrades to a
+  low-confidence hypothesis with no headline blocker. See
+  `hibernate.effective_version` / `version_major` / `version_confidence`.
+- **Boot3 auto-disables without Spring.** `boot3.applicable` tracks real Spring
+  usage; Quarkus / Micronaut / Helidon / Jakarta-pure repos report `boot3` as N/A
+  (`spring_present: false`), not a contradictory `applicable: true`.
+- **Permanent `javax.*` are never jakarta debt.** JDK/JSR namespaces
+  (`javax.cache`, `javax.sql`, `javax.xml` JAXP, `javax.crypto`, `javax.naming`,
+  `javax.management`, `javax.security.auth`, `javax.annotation.processing`, …) are
+  allowlisted across every jakarta scorer (single source of truth:
+  `serializer._JAVAX_PERMANENT_NAMESPACES` + `migrate_check._JAKARTA_NO_MIGRATE_PREFIXES`).
+  The `javax→jakarta` dependency flag decides via **longest-prefix match**, so
+  `javax.xml.bind` (JAXB — moved) flags while `javax.xml` (JAXP) does not, and
+  `javax.annotation` (JSR-250 — moved) flags while `javax.annotation.processing`
+  (JSR-269) does not. The allowlist never silences a real migration.
+- **`readiness_score` is a traceable aggregate.** It is `min` over the applicable
+  **migration** dimensions (`jakarta` / `boot3` / `hibernate`); `jdk_modernization`
+  is orthogonal upkeep and is excluded. The exact inputs are in `readiness_aggregate{}`
+  and an invariant (`readiness_score == min(applicable migration dims)`) is asserted in
+  code. When the Hibernate version is undeclared it is inferred from the Spring Boot
+  BOM (Boot ≥3 → Hibernate ≥6 → N/A; Boot 2 → Hibernate 5 → applicable; no BOM →
+  `status: unresolved`, never a heuristic score).
+- **Three buckets: blocker ≠ hygiene ≠ test.** Only product (`main`) code counts
+  toward `blocking_count`, readiness, and effort. Test harnesses
+  (`testsuite/`, `test-framework/`, `integration-arquillian/`, `*-test*`,
+  `src/test/`) and autogenerated sources are tagged `code_context` and surfaced in
+  `non_blocking{}`. Best-practice hygiene (`java.util.Date`) is reported as
+  `hygiene_findings` and never sinks a dimension. Each finding carries
+  `code_context: main | test | generated`.
+
 ```bash
 # inspect only the Hibernate rewrite targets
 sourcecode migrate-check . --format json | jq '.hibernate.rewrite_targets[]'
+
+# product blockers only (excludes test/fixtures + hygiene)
+sourcecode migrate-check . --format json | jq '.blocking_count, .non_blocking, .hygiene_findings'
 ```
 
 ### `rename-class` — Java class rename

{sourcecode-1.64.0.dist-info → sourcecode-1.66.0.dist-info}/RECORD

@@ -1,4 +1,4 @@
-sourcecode/__init__.py,sha256=icvkhugNj_JqAoF4YlHhszmsFC7whNNmc8xxgqsJUcI,103
+sourcecode/__init__.py,sha256=_rKEwisXr1IeFjMbYXGSfdRcelQmOHaAB0XR84P9tsk,103
 sourcecode/adaptive_scanner.py,sha256=XffluXKzJUXrMtjEiAOnSNPZnztdIcts17T9ouHeID0,10521
 sourcecode/architecture_analyzer.py,sha256=liCwQmLgb5vplohy8arjYxs_HOIv5C9MjLh_gY6bc5Q,44115
 sourcecode/architecture_summary.py,sha256=z34_6v7cSwy98cof2UVciGho7SCrZ93tiqMmq5WNzRQ,20405
@@ -28,15 +28,15 @@ sourcecode/format_contract.py,sha256=1cTNqwP8geA2hbQoBHUPgX3_vSh3l8guJT_jmgEnFF8
 sourcecode/fqn_utils.py,sha256=XLU7zDkNBXz_RZkIUNfpPmp1nekWtqP-fxV92tDV1vg,2158
 sourcecode/git_analyzer.py,sha256=JStxTQXNjBWi_wLdwhsZs9mT-v50cSJIz4Agzn6Kh9I,13362
 sourcecode/graph_analyzer.py,sha256=DHR8fY69oU_Pi4SYaWboX6EoEFrctQKB9dsjpqwGMzw,62403
-sourcecode/hibernate_strat.py,sha256=4OKDnfdiJ38_XJIFKBXwZa4ai-Vgb54_FDlo27HgFfE,53147
-sourcecode/integration_detector.py,sha256=ZJqrGwvZ4ee2JTGhlazKk67aZi173HxkhNpl8Yntpd8,6503
+sourcecode/hibernate_strat.py,sha256=ZyI0sikxh7IemU8uqn1Z73z-tHeFeCJuYhJnyQL8pzU,57765
+sourcecode/integration_detector.py,sha256=mQulsXN1P-4V_3ueh3xy_N9x3Aqlvm7GQ-3YGqlBEYM,8223
 sourcecode/license.py,sha256=wckiLuiwaE35KMCStUf1gYzleJuFe6qsSyxUQJvit3s,23500
 sourcecode/mcp_nudge.py,sha256=5ELU_ixzh6uA83NXLOZT8h00OhL53okfQdji3jyKOjg,2917
 sourcecode/metrics_analyzer.py,sha256=m0ENgtqKeBL17kUIK3fmGkgo7UfXBNHxCMj0H_Y5K7c,22750
-sourcecode/migrate_check.py,sha256=iHQou8w8hAjSrHmiYpcz2NMyHSatdu-6vbHbyf-kFrs,70268
+sourcecode/migrate_check.py,sha256=daZLA7KaeoWoUPSMN8cYqHYD6HBflzc-z_N4bCGVPak,82993
 sourcecode/openapi_surface.py,sha256=BTt0K-woZbkbWTN77IkqeBm_Okag9owR0848fmot8sk,16207
 sourcecode/output_budget.py,sha256=Js9yUlfQtPhqBl9R6wn_9UHVjjJc3GtLcqyfjf5t50Q,9869
-sourcecode/path_filters.py,sha256=EN1RGZRvLq5EcPgpjYV_IyCKVlAQQn2bbpEisQ5LpGg,3780
+sourcecode/path_filters.py,sha256=DMea0KIlmj2pzTkuy-3YYFF4ktP0q5zP9mH4v4uXh84,5237
 sourcecode/pr_comment_renderer.py,sha256=smHslxiG14lrytCkq5nFrFu-qTHgA-t-LFYfdrfjz2o,14423
 sourcecode/pr_impact.py,sha256=dCDVw83EDbyVf6F9ZmEQmsFz8ruVH7d4mpeKQCIZHM0,16805
 sourcecode/prepare_context.py,sha256=PsRaKeABMh964niCS578WRgcccW9bajnm2yHS9zcKuM,222655
@@ -53,7 +53,7 @@ sourcecode/scanner.py,sha256=WdOQ78mMzjR1NjmKTlbxdgwinnCTfAhxCVLBEFQiFHU,8899
 sourcecode/schema.py,sha256=aHNXDf8LGyUC8ZDE_VS9kiskC2-Oswhi_WnpdGy6HDw,24897
 sourcecode/security_config.py,sha256=_m8oQAy2gP7Ho2I-IIMTFFjFVWbJIGlLEOiAWK2TDjs,3503
 sourcecode/semantic_analyzer.py,sha256=4OdG6tTSnTvq3_dSWMbQu8Ad1ndSCKeG-b9qM4hIxkw,89176
-sourcecode/serializer.py,sha256=6YoGyRqkjtp34ELwgRGCZ1r1b6zu6SqiAWT8ySjs-M8,126516
+sourcecode/serializer.py,sha256=MSxYZ-_UYDPKMvg-hVk-MnKN-TfrmxXL202siCssa9U,129110
 sourcecode/spring_event_topology.py,sha256=5_ON_21Le5zbG-1GRc5GLIi5HJfy_QjcXLVPC5WeUGQ,18055
 sourcecode/spring_findings.py,sha256=G7Or2lKBUQbcTDqudLvSs9XvNg_YoAa-_lBOG_ULs8E,5457
 sourcecode/spring_impact.py,sha256=qLwLfItX_o9LU-k_qjhD2hFpTX3PpEQ85TsYTAArzvg,56016
@@ -103,8 +103,8 @@ sourcecode/telemetry/consent.py,sha256=H5z2Wu63pZqbaKucRPoJQJ0zCo4cke9ZlBrJC-MaW
 sourcecode/telemetry/events.py,sha256=LtzYfaX9Ilckj5PTvAcTpDa9mLqDsYPDUiDkRa58piY,2580
 sourcecode/telemetry/filters.py,sha256=NHa5T-6DaZduQPFuC34jOqHWQgSizM-Ygq8aZ4j19ng,5834
 sourcecode/telemetry/transport.py,sha256=4gGHsq0WeY9VywEZXA3vUxykfiYnw9uuqfjAAec7F8o,1681
-sourcecode-1.64.0.dist-info/METADATA,sha256=qYsbbDRRWaCjq-T81IN2j3-u0i29R6XmvuSHT0s70FE,43969
-sourcecode-1.64.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-1.64.0.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
-sourcecode-1.64.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-1.64.0.dist-info/RECORD,,
+sourcecode-1.66.0.dist-info/METADATA,sha256=PVY4maYclqHt2AKj_bcGmDzF7xmKhD0i7k2MrQepPKo,47341
+sourcecode-1.66.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-1.66.0.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
+sourcecode-1.66.0.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-1.66.0.dist-info/RECORD,,