sourcecode 1.64.0__tar.gz → 1.65.0__tar.gz

{sourcecode-1.64.0 → sourcecode-1.65.0}/CHANGELOG.md

@@ -1,5 +1,59 @@
 # Changelog
 
+## [1.65.0] — 2026-06-30
+
+### Fixed — non-Spring / already-modernized repos no longer fabricate blockers (`migrate-check`)
+
+A Pro audit of a real enterprise repo (**Keycloak**, Quarkus 3.33 / Jakarta EE /
+Hibernate ORM 6.2.13, Jakarta migration **complete**, 7,885 Java files / 186
+modules) exposed a cluster of false positives that produced `readiness 0/100`, a
+phantom `hibernate_rewrite` headline, and a `boot3` dimension marked applicable
+with **zero** Spring. A migration verdict shown to a CTO must never contradict its
+own evidence. Keycloak is now a golden regression fixture
+(`tests/test_migrate_check_keycloak_regression.py`).
+
+- **Hibernate version is resolved before any 5→6 verdict (BUG #1).** The effective
+  Hibernate version is parsed from build descriptors, following Maven
+  `${properties}` and BOM-managed `<hibernate*.version>` values plus explicit
+  `hibernate-core`/`hibernate-orm` coordinates. Major ≥ 6 → the 5→6 axis is **N/A**
+  (migration already done), never a blocker. Unresolved version → low-confidence
+  hypothesis, **no** `headline_blocker`. New `hibernate.effective_version`,
+  `version_major`, `version_confidence`, `migration_applicable`.
+- **Boot3 dimension auto-disables without Spring (BUG #2).** `boot3.applicable` is
+  now a function of real Spring usage (build coordinate or `org.springframework`
+  import). Quarkus / Micronaut / Jakarta-pure repos report `boot3` as N/A instead
+  of a contradictory `applicable: true`.
+- **Jakarta scorer ignores permanent `javax.*` (BUG #3).** The JDK/JSR allowlist
+  (`javax.xml.*`, `javax.crypto.*`, `javax.naming.*`, `javax.sql.*`,
+  `javax.management.*`, `javax.security.auth.*`, …) is honored end-to-end, so the
+  Keycloak's 1,065 permanent `javax.*` imports stop counting as jakarta debt.
+- **Readiness headline can no longer be a misleading 0 (BUG #4).** Framework
+  blockers (jakarta / Boot3 / Security) deduct uncapped; orthogonal JDK debt is
+  advisory-capped and best-practice hygiene is excluded — so an already-modernized
+  repo reads high (Keycloak 85/100), never 0. The headline cannot contradict its
+  own note.
+- **Effort excludes N/A axes (BUG #5).** `estimated_effort_days` is computed over
+  product (`main`) findings only; the phantom Hibernate 5→6 effort is gone.
+- **Best-practice hygiene no longer sinks a dimension (BUG #6).**
+  `java.util.Date`/`Calendar` (MIG-016, `java_8_best_practice`) is reported as a
+  separate `hygiene_findings` metric and excluded from JDK-modernization scoring.
+- **MIG-006 explanation matches the actual symbol (BUG #7).** The explanation now
+  names the detected `javax.annotation.*` symbol instead of a fixed
+  `@PostConstruct/@PreDestroy/@Resource` blurb. `javax.annotation.Generated` (JSR-250,
+  emitted into autogenerated SCIM/JAXB sources) is downgraded to **low** and bucketed
+  as `generated`.
+- **Test/fixture findings segregated from `blocking_count` (BUG #8).** Findings in
+  test harness modules (`testsuite/`, `test-framework/`, `integration-arquillian/`,
+  `*-test*`) and under `src/test/` are tagged `code_context: test`; autogenerated
+  sources `generated`. Only `main` counts toward `blocking_count`, readiness, and
+  effort. The other buckets surface in `non_blocking{}`. Keycloak's 10 test `web.xml`
+  + 14 test-framework `sun.*` no longer inflate the verdict (`blocking_count` 30 → 6).
+- **`export --integrations` is no longer Spring-centric (BUG #9).** Detection now
+  covers plain-Java/Jakarta HTTP clients (JDK `HttpClient`, Apache, OkHttp), JNDI
+  LDAP, and JavaMail/SMTP in addition to Spring templates, and emits an explicit
+  `confidence` (`observed` / `not_analyzed`) + `coverage_note` rather than an
+  authoritative `0`. Keycloak: 0 → 144 integrations (80 HTTP / 33 LDAP / 31 SMTP).
+
 ## [1.64.0] — 2026-06-30
 
 ### Fixed — zero false-positive blockers (`migrate-check` / `endpoints`)

{sourcecode-1.64.0 → sourcecode-1.65.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.64.0
+Version: 1.65.0
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -411,7 +411,7 @@ Emits **structured, tool-agnostic** codebase views as plain JSON/YAML — the ki
 |------|--------|
 | `--by-directory` | One group per source directory, each symbol with a `source_file:line` reference. |
 | `--module-graph` | `{nodes, edges, summary}` — directories as modules, inter-module dependencies rolled up from class-level relation edges with hit counts + edge types. |
-| `--integrations` | Outbound integrations (`RestTemplate`, `WebClient`, `@FeignClient`, `LdapTemplate`, `JmsTemplate`, ActiveMQ) with `file:line` evidence and a literal `target` URL/name when present. |
+| `--integrations` | Outbound integrations across Spring **and** plain-Java/Jakarta stacks: HTTP (`RestTemplate`, `WebClient`, `@FeignClient`, JDK `HttpClient`, Apache, OkHttp), LDAP (`LdapTemplate`, JNDI `InitialDirContext`/`LdapContext`), SMTP (`JavaMailSender`, JavaMail `Transport`/`MimeMessage`), and JMS — with `file:line` evidence and a literal `target` when present. Emits an explicit `confidence` (`observed` / `not_analyzed`) + `coverage_note`: a count of `0` means "no client construct found", **not** "no integrations" (runtime/DI-wired clients are not statically visible). |
 | `--c4` | Unified document: `c4.{context, containers, components, code}` + `api_surface` + a `manifest` with per-directory content hashes for **incremental** consumers (skip directories whose hash is unchanged). `components.module_roots` rolls leaf source dirs up to architectural module roots and classifies each `layered` (DDD: ≥2 of `domain`/`application`/`infrastructure`) vs `flat` (legacy/flat package), with a verifiable `module_count` — so a consumer enumerates real modules instead of inferring boundaries from leaf directories. |
 
 The section flags compose (pass several for one multi-section document); `--c4` assembles the full export on its own. URLs assembled at runtime yield `target: null` (honest absence, never a guess); containers are derived from build files (Maven/Gradle) and reported as a limitation when none are found.
@@ -610,7 +610,7 @@ Detects migration blockers across Java source files, Spring XML config files, an
 | `MIG-002` | high | `javax.servlet` import — Servlet API changed |
 | `MIG-003` | high | `javax.validation` import — Bean Validation changed |
 | `MIG-004` | high | `javax.transaction` import — TX API changed |
-| `MIG-006` | medium | `javax.annotation` import — CDI annotations changed |
+| `MIG-006` | medium¹ | `javax.annotation` import — CDI annotations changed (¹`javax.annotation.Generated` in autogenerated code → **low**, bucketed `generated`; explanation names the actual symbol) |
 | `MIG-007` | medium | `javax.inject` import — DI annotations changed |
 | `MIG-008` | medium | `javax.ws.rs` import — JAX-RS changed |
 | `MIG-009` | medium | `javax.jms` import — JMS API changed |
@@ -722,9 +722,39 @@ reported as **N/A** (`score: null`), never as `0`. The top-level
 states that `readiness_score` is a derived aggregate over applicable dimensions
 only — for decisions, read the per-dimension breakdown + `blocking_count`.
 
+#### Reliability guarantees (no version, no verdict)
+
+A migration verdict shown to a decision-maker must never contradict its own
+evidence. `migrate-check` enforces:
+
+- **Version-gated framework axes.** The Hibernate 5→6 axis applies only when the
+  effective Hibernate version (resolved from `pom.xml`/Gradle, following Maven
+  `${properties}` and BOM-managed `<hibernate*.version>`) is `< 6`. A resolved
+  Hibernate **6+** repo is reported `migration_applicable: false` (N/A) — no
+  `hibernate_rewrite` headline. An **unresolved** version degrades to a
+  low-confidence hypothesis with no headline blocker. See
+  `hibernate.effective_version` / `version_major` / `version_confidence`.
+- **Boot3 auto-disables without Spring.** `boot3.applicable` tracks real Spring
+  usage; Quarkus / Micronaut / Helidon / Jakarta-pure repos report `boot3` as N/A
+  (`spring_present: false`), not a contradictory `applicable: true`.
+- **Permanent `javax.*` are never jakarta debt.** JDK/JSR namespaces
+  (`javax.xml.*`, `javax.crypto.*`, `javax.naming.*`, `javax.sql.*`,
+  `javax.management.*`, `javax.security.auth.*`, …) are allowlisted across every
+  jakarta scorer.
+- **Three buckets: blocker ≠ hygiene ≠ test.** Only product (`main`) code counts
+  toward `blocking_count`, readiness, and effort. Test harnesses
+  (`testsuite/`, `test-framework/`, `integration-arquillian/`, `*-test*`,
+  `src/test/`) and autogenerated sources are tagged `code_context` and surfaced in
+  `non_blocking{}`. Best-practice hygiene (`java.util.Date`) is reported as
+  `hygiene_findings` and never sinks a dimension. Each finding carries
+  `code_context: main | test | generated`.
+
 ```bash
 # inspect only the Hibernate rewrite targets
 sourcecode migrate-check . --format json | jq '.hibernate.rewrite_targets[]'
+
+# product blockers only (excludes test/fixtures + hygiene)
+sourcecode migrate-check . --format json | jq '.blocking_count, .non_blocking, .hygiene_findings'
 ```
 
 ### `rename-class` — Java class rename

{sourcecode-1.64.0 → sourcecode-1.65.0}/README.md

@@ -373,7 +373,7 @@ Emits **structured, tool-agnostic** codebase views as plain JSON/YAML — the ki
 |------|--------|
 | `--by-directory` | One group per source directory, each symbol with a `source_file:line` reference. |
 | `--module-graph` | `{nodes, edges, summary}` — directories as modules, inter-module dependencies rolled up from class-level relation edges with hit counts + edge types. |
-| `--integrations` | Outbound integrations (`RestTemplate`, `WebClient`, `@FeignClient`, `LdapTemplate`, `JmsTemplate`, ActiveMQ) with `file:line` evidence and a literal `target` URL/name when present. |
+| `--integrations` | Outbound integrations across Spring **and** plain-Java/Jakarta stacks: HTTP (`RestTemplate`, `WebClient`, `@FeignClient`, JDK `HttpClient`, Apache, OkHttp), LDAP (`LdapTemplate`, JNDI `InitialDirContext`/`LdapContext`), SMTP (`JavaMailSender`, JavaMail `Transport`/`MimeMessage`), and JMS — with `file:line` evidence and a literal `target` when present. Emits an explicit `confidence` (`observed` / `not_analyzed`) + `coverage_note`: a count of `0` means "no client construct found", **not** "no integrations" (runtime/DI-wired clients are not statically visible). |
 | `--c4` | Unified document: `c4.{context, containers, components, code}` + `api_surface` + a `manifest` with per-directory content hashes for **incremental** consumers (skip directories whose hash is unchanged). `components.module_roots` rolls leaf source dirs up to architectural module roots and classifies each `layered` (DDD: ≥2 of `domain`/`application`/`infrastructure`) vs `flat` (legacy/flat package), with a verifiable `module_count` — so a consumer enumerates real modules instead of inferring boundaries from leaf directories. |
 
 The section flags compose (pass several for one multi-section document); `--c4` assembles the full export on its own. URLs assembled at runtime yield `target: null` (honest absence, never a guess); containers are derived from build files (Maven/Gradle) and reported as a limitation when none are found.
@@ -572,7 +572,7 @@ Detects migration blockers across Java source files, Spring XML config files, an
 | `MIG-002` | high | `javax.servlet` import — Servlet API changed |
 | `MIG-003` | high | `javax.validation` import — Bean Validation changed |
 | `MIG-004` | high | `javax.transaction` import — TX API changed |
-| `MIG-006` | medium | `javax.annotation` import — CDI annotations changed |
+| `MIG-006` | medium¹ | `javax.annotation` import — CDI annotations changed (¹`javax.annotation.Generated` in autogenerated code → **low**, bucketed `generated`; explanation names the actual symbol) |
 | `MIG-007` | medium | `javax.inject` import — DI annotations changed |
 | `MIG-008` | medium | `javax.ws.rs` import — JAX-RS changed |
 | `MIG-009` | medium | `javax.jms` import — JMS API changed |
@@ -684,9 +684,39 @@ reported as **N/A** (`score: null`), never as `0`. The top-level
 states that `readiness_score` is a derived aggregate over applicable dimensions
 only — for decisions, read the per-dimension breakdown + `blocking_count`.
 
+#### Reliability guarantees (no version, no verdict)
+
+A migration verdict shown to a decision-maker must never contradict its own
+evidence. `migrate-check` enforces:
+
+- **Version-gated framework axes.** The Hibernate 5→6 axis applies only when the
+  effective Hibernate version (resolved from `pom.xml`/Gradle, following Maven
+  `${properties}` and BOM-managed `<hibernate*.version>`) is `< 6`. A resolved
+  Hibernate **6+** repo is reported `migration_applicable: false` (N/A) — no
+  `hibernate_rewrite` headline. An **unresolved** version degrades to a
+  low-confidence hypothesis with no headline blocker. See
+  `hibernate.effective_version` / `version_major` / `version_confidence`.
+- **Boot3 auto-disables without Spring.** `boot3.applicable` tracks real Spring
+  usage; Quarkus / Micronaut / Helidon / Jakarta-pure repos report `boot3` as N/A
+  (`spring_present: false`), not a contradictory `applicable: true`.
+- **Permanent `javax.*` are never jakarta debt.** JDK/JSR namespaces
+  (`javax.xml.*`, `javax.crypto.*`, `javax.naming.*`, `javax.sql.*`,
+  `javax.management.*`, `javax.security.auth.*`, …) are allowlisted across every
+  jakarta scorer.
+- **Three buckets: blocker ≠ hygiene ≠ test.** Only product (`main`) code counts
+  toward `blocking_count`, readiness, and effort. Test harnesses
+  (`testsuite/`, `test-framework/`, `integration-arquillian/`, `*-test*`,
+  `src/test/`) and autogenerated sources are tagged `code_context` and surfaced in
+  `non_blocking{}`. Best-practice hygiene (`java.util.Date`) is reported as
+  `hygiene_findings` and never sinks a dimension. Each finding carries
+  `code_context: main | test | generated`.
+
 ```bash
 # inspect only the Hibernate rewrite targets
 sourcecode migrate-check . --format json | jq '.hibernate.rewrite_targets[]'
+
+# product blockers only (excludes test/fixtures + hygiene)
+sourcecode migrate-check . --format json | jq '.blocking_count, .non_blocking, .hygiene_findings'
 ```
 
 ### `rename-class` — Java class rename

{sourcecode-1.64.0 → sourcecode-1.65.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.64.0"
+version = "1.65.0"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.64.0 → sourcecode-1.65.0}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.64.0"
+__version__ = "1.65.0"

{sourcecode-1.64.0 → sourcecode-1.65.0}/src/sourcecode/hibernate_strat.py

@@ -253,6 +253,75 @@ def _scan_build_dependency(root: Path) -> tuple[bool, list[str]]:
                     samples.append(snippet)
     return found, samples
 
+
+# ── BUG #1: effective Hibernate version resolution ─────────────────────────
+# A 5→6 rewrite verdict is only valid when the project is actually on Hibernate 5.
+# Resolve the effective major version from build descriptors, following Maven
+# ${properties} (incl. BOM-managed values declared as <hibernate*.version>) and
+# explicit hibernate-core / hibernate-orm coordinates. When the resolved major is
+# ≥ 6 the 5→6 axis does NOT apply (the migration is already done). When it cannot
+# be resolved the axis degrades to a low-confidence hypothesis (no headline).
+_HIB_VER = r"(\d+\.\d+(?:\.\d+)?(?:[.\-][\w]+)*)"  # 6.2.13.Final, 5.6.15, 6.2
+_HIB_PROP_RE = re.compile(
+    r"<((?:[\w.\-]*hibernate[\w.\-]*?)\.?version)>\s*" + _HIB_VER + r"\s*</\1>",
+    re.IGNORECASE,
+)
+_HIB_COORD_VERSION_RE = re.compile(
+    r"<artifactId>\s*hibernate-(?:core|orm)\s*</artifactId>\s*"
+    r"(?:<[^>]+>[^<]*</[^>]+>\s*)*?<version>\s*" + _HIB_VER,
+    re.IGNORECASE | re.DOTALL,
+)
+_HIB_GRADLE_VERSION_RE = re.compile(
+    r"org\.hibernate(?:\.orm)?:hibernate-(?:core|orm):" + _HIB_VER,
+    re.IGNORECASE,
+)
+
+
+def _ver_key(full: str) -> tuple[int, int]:
+    parts = full.split(".")
+    try:
+        major = int(parts[0])
+    except (ValueError, IndexError):
+        return (0, 0)
+    try:
+        minor = int(parts[1]) if len(parts) > 1 else 0
+    except ValueError:
+        minor = 0
+    return (major, minor)
+
+
+def _resolve_hibernate_version(root: Path) -> tuple[Optional[str], Optional[int], str]:
+    """Return (full_version_string, major, confidence) for the effective Hibernate.
+
+    confidence is "high" when a version was resolved from a build descriptor,
+    "none" when none could be determined (degrade to hypothesis). The newest
+    declared Hibernate wins in a multi-module build.
+    """
+    import os
+    best_full: Optional[str] = None
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [d for d in dirnames if d not in _SKIP_BUILD_SCAN_DIRS]
+        for fname in filenames:
+            if fname not in _BUILD_FILE_NAMES:
+                continue
+            try:
+                text = (Path(dirpath) / fname).read_text(encoding="utf-8", errors="replace")
+            except OSError:
+                continue
+            fulls: list[str] = []
+            for m in _HIB_PROP_RE.finditer(text):
+                fulls.append(m.group(2))
+            for m in _HIB_COORD_VERSION_RE.finditer(text):
+                fulls.append(m.group(1))
+            for m in _HIB_GRADLE_VERSION_RE.finditer(text):
+                fulls.append(m.group(1))
+            for full in fulls:
+                if best_full is None or _ver_key(full) > _ver_key(best_full):
+                    best_full = full
+    if best_full is None:
+        return None, None, "none"
+    return best_full, _ver_key(best_full)[0], "high"
+
 # Escalation markers — dynamic / reflection-based persistence construction.
 _ABSTRACTION_CLASS_RE = re.compile(
     r"\b(DynamicEntityDao|DynamicEntityDaoImpl|BasicPersistenceModule|"
@@ -406,12 +475,23 @@ class HibernateStratification:
     # when backed by a build dependency or a parsed org.hibernate import, "none"
     # when detection was vetoed for lack of evidence.
     evidence: dict = field(default_factory=dict)
+    # BUG #1: effective Hibernate version + whether the 5→6 axis applies at all.
+    # When the resolved major is ≥ 6 the migration is already done → not applicable
+    # (never a blocker). When unresolved, the axis is a low-confidence hypothesis.
+    effective_version: Optional[str] = None
+    version_major: Optional[int] = None
+    version_confidence: str = "none"
+    migration_applicable: bool = True
 
     def to_dict(self) -> dict:
         return {
             "schema_version": HIBERNATE_SCHEMA_VERSION,
             "detected": self.detected,
             "evidence": self.evidence,
+            "effective_version": self.effective_version,
+            "version_major": self.version_major,
+            "version_confidence": self.version_confidence,
+            "migration_applicable": self.migration_applicable,
             "classification": self.classification,
             "classification_label": self.classification_label,
             "stratified": True,
@@ -763,6 +843,7 @@ def analyze_hibernate(file_paths: list[str], root: Path) -> HibernateStratificat
         return strat
 
     dep_present, dep_samples = _scan_build_dependency(root)
+    eff_version, version_major, version_conf = _resolve_hibernate_version(root)
 
     has_evidence = dep_present or any_hibernate_import or any_jpa_import
     evidence: dict = {
@@ -771,6 +852,9 @@ def analyze_hibernate(file_paths: list[str], root: Path) -> HibernateStratificat
         "hibernate_import_present": any_hibernate_import,
         "hibernate_import_sample": hibernate_import_sample,
         "jpa_import_present": any_jpa_import,
+        "effective_version": eff_version,
+        "version_major": version_major,
+        "version_confidence": version_conf,
         "confidence": "high" if has_evidence else "none",
     }
 
@@ -959,6 +1043,12 @@ def analyze_hibernate(file_paths: list[str], root: Path) -> HibernateStratificat
     strat = HibernateStratification()
     strat.findings = findings
     strat.evidence = evidence
+    strat.effective_version = eff_version
+    strat.version_major = version_major
+    strat.version_confidence = version_conf
+    # BUG #1: the 5→6 axis only applies when NOT already on Hibernate 6+. A
+    # resolved major ≥ 6 means the migration is complete — never a blocker.
+    strat.migration_applicable = not (version_major is not None and version_major >= 6)
     strat.rewrite_targets = sorted(
         targets, key=lambda t: (t.source_file, t.line_start, t.layer, t.id)
     )
@@ -1126,13 +1216,23 @@ def analyze_hibernate(file_paths: list[str], root: Path) -> HibernateStratificat
         stops.append("SQL/HQL shape not statically inferable (string concatenation)")
     strat.stop_conditions_triggered = stops
 
-    if stops:
+    if not strat.migration_applicable:
+        # Already on Hibernate 6+ — the 5→6 stratification below is retained as an
+        # informational exposure map, but it is NOT a migration and NOT a blocker.
+        strat.classification = CLASS_NONE
+        strat.classification_label = (
+            f"ALREADY ON HIBERNATE {strat.version_major} "
+            f"({strat.effective_version}) — NO 5→6 MIGRATION PENDING"
+        )
+        strat.stop_conditions_triggered = []
+    elif stops:
         strat.classification = CLASS_REWRITE
     elif layer_files[LAYER_CRITERIA] or concat_query_global or jpa_deprecated_seen:
         strat.classification = CLASS_UPGRADE_CARE
     else:
         strat.classification = CLASS_UPGRADE
-    strat.classification_label = _CLASS_LABELS[strat.classification]
+    if strat.migration_applicable:
+        strat.classification_label = _CLASS_LABELS[strat.classification]
 
     # ── Risk separation: observable vs inferred ─────────────────────────────
     observable: list[str] = []

{sourcecode-1.64.0 → sourcecode-1.65.0}/src/sourcecode/integration_detector.py

@@ -35,10 +35,28 @@ _ATTR_NAME_RE = re.compile(r'(?:name|value)\s*=\s*"([^"]*)"')
 _FIRST_LITERAL_RE = re.compile(r'^\s*"([^"]*)"')
 
 # token -> (kind, client). Matched as whole-word usage outside imports/comments.
+# Covers Spring AND plain-Java/Jakarta stacks (Quarkus, Micronaut, Keycloak SPI):
+# the detector must not be Spring-centric, or a non-Spring repo with real LDAP /
+# SMTP / HTTP integrations falsely reports "0 integrations".
 _TOKEN_CLIENTS: "tuple[tuple[str, str, str], ...]" = (
+    # Spring HTTP clients
     ("RestTemplate", "http", "resttemplate"),
     ("WebClient", "http", "webclient"),
+    # Plain-Java / third-party HTTP clients
+    ("HttpClient", "http", "jdk-httpclient"),          # java.net.http.HttpClient
+    ("CloseableHttpClient", "http", "apache-httpclient"),
+    ("HttpClients", "http", "apache-httpclient"),
+    ("OkHttpClient", "http", "okhttp"),
+    # LDAP / directory (Spring + JNDI)
     ("LdapTemplate", "ldap", "ldaptemplate"),
+    ("InitialLdapContext", "ldap", "jndi-ldap"),
+    ("InitialDirContext", "ldap", "jndi-ldap"),
+    ("LdapContext", "ldap", "jndi-ldap"),
+    # Mail / SMTP (JavaMail / Jakarta Mail)
+    ("JavaMailSender", "smtp", "spring-mail"),
+    ("MimeMessage", "smtp", "javamail"),
+    ("Transport", "smtp", "javamail"),
+    # JMS / messaging
     ("JmsTemplate", "jms", "jmstemplate"),
     ("ActiveMQConnectionFactory", "jms", "activemq"),
 )
@@ -156,8 +174,21 @@ def detect_integrations(file_paths: "list[str]", root: Path) -> dict:
     for r in records:
         by_kind[r["kind"]] = by_kind.get(r["kind"], 0) + 1
 
+    # BUG #9: honest confidence. A zero count means "no detectable client
+    # construct was found", NOT "this system has no integrations" — runtime-wired
+    # clients (DI, config-driven endpoints, JCA connectors) are invisible to static
+    # text matching. Report that explicitly instead of an authoritative "0".
+    confidence = "observed" if records else "not_analyzed"
     return {
         "integrations": records,
         "by_kind": {k: by_kind[k] for k in sorted(by_kind)},
         "count": len(records),
+        "confidence": confidence,
+        "coverage_note": (
+            "Detects HTTP (RestTemplate/WebClient/JDK/Apache/OkHttp), LDAP (Spring "
+            "+ JNDI), SMTP (JavaMail), and JMS client constructs by source-text "
+            "matching. A count of 0 means no such construct was found, not that the "
+            "system has no outbound integrations — runtime/DI-wired clients are not "
+            "statically visible."
+        ),
     }