GVClass v1.6.0

Correctness, scientific-output, and security release. Software v1.6.0 is compatible with resource bundle v1.5.0.

⚠️ Some fixes change reported values (completeness, completeness quality, per-contig contamination signals). Re-run any analyses where these columns matter; they are corrections, not regressions.

Scientific corrections

• Novelty completeness R² gate now works. The runtime read a metadata key that never existed, so the gate never fired and every order was surfaced as advisory_only. It now reads the shipped test_r2 column: low-R² orders are demoted to the strategy-2 tier score, mid/high-R² orders are labelled moderate/high, and estimated_completeness_r2_holdout is populated.
• Completeness no longer collapses to 0% when an order lacks a tier set or the scorer is unavailable; it falls back to the strategy-1 estimate.
• estimated_completeness_r2_holdout is written at full precision (was truncated to an integer).
• taxonomy_strict is now always at least as conservative as taxonomy_majority (it could previously be more specific).
• Per-contig contamination now counts pipeless phage reference hits (their genome ids were silently dropped), changing viral_bearing_contig_count and downstream signals for affected bins.
• Gene calling: DNA .fasta/.fas inputs are now gene-called (were silently treated as protein); minus-strand .fna records are reverse-complemented so they match the .faa; genetic-code selection adds a 5% coding-density override gate.
• Weighted completeness is functional again: the scorer reads a real per-order marker-conservation table instead of an HMM size table that forced uniform weights. (Activates once a resource bundle containing markers/marker_conservation.tsv is published; see Upgrade notes.)

Bug fixes

• BLAST honours the documented top-100 hits per query (pyswrd defaulted to 10).
• --resume no longer drops a completed query whose loose summary is missing; it is reported in gvclass_failed_queries.tsv.
• Partial or empty gvclass_config.yaml files no longer crash; defaults are deep-merged.
• ErrorHandler.log_error added (a missing method that could mask real errors).
• Docker docker-compose/example commands invoke the entrypoint correctly (the pixi run gvclass prefix was mangled into bogus arguments).

Security

• Database downloads fail closed: an env-provided GVCLASS_DB_URL requires GVCLASS_DB_SHA256 (opt out with GVCLASS_DB_ALLOW_UNVERIFIED=1), sources must be https, and the unpinned legacy NERSC mirrors were removed.
• completeness/model.joblib is now SHA-256-gated like the contamination model (refuses to deserialize a tampered pickle).

Upgrade notes

• Compatible resource bundle: v1.5.0 (unchanged).
• To activate the weighted-completeness fix, regenerate the resource bundle (python -m src.bin.build_novelty_completeness_resources), republish it, then add markers/marker_conservation.tsv to DatabaseManager.REQUIRED_FILES and update the download checksum. Without it, completeness behaves as before.