Iteration 2 of the fold optimization loop
(docs/research/optimization-loop-2026-07-30.md).
The disposition baselines predated source edits; finding IDs encode
location, so line moves surfaced as new+resolved pairs and both
project evaluations gated red:
- fold: 8 new findings exceeded limit 0 (review coverage 0.111)
- yams: 3 new findings exceeded limit 0
Each finding was verified against source before re-baselining:
- fold: 5 SafetyObserver virtual-stub clones (line-moved, same
methods) accepted-risk; 2 detector-internal clone sites re-hashed,
accepted-risk; 2 sql-injection sites re-verified — all SQL text is
compile-time constants or fixed internal table lists (store.cpp:22,
:251) — false-positive
- yams: 3 clone IDs refreshed after line moves (document_metadata.h
600/623, connection_pool.cpp 42); 4 high-complexity locations
updated
Also fixes the disposition target fingerprint to the exact
runner-reproduced configuration fingerprint (manifest_configuration +
SOURCE_SETTING_FLAGS defaults), which the prior fold baseline had
stale.
Green proof (tests/benchmarks/runs/optimization-2026-07-31-dispositions/):
fold eval status failed -> ok, yams failed -> ok; finding fingerprints
unchanged (fold 0fec78e5..., yams 247523c5...); churn 0, pairwise
Jaccard 1.0, review_coverage 1.0. No gate weakened and no production
code change.
Unit + integration coverage for the session's work: incremental project
graph/index, pcode encoder, unreachable/dead-branch, equiv/cross-TU,
div-by-zero/sign-conversion/int-truncation, use-after-free, quality-precision,
scan-router profile, source TU runner, detector plan, and the eval fixtures.
