focus-areas.md scope rows were never diffed against the file tree: two whole subsystems (5,553 + 2,183 loc) are owned by no area, one already implicated by sev:high #16

[ms609]

Found by the 2026-08-04 area-12 round (red-team process meta-review, sonnet), doing a diff the
2026-07-03 area-12 round flagged and never performed.

One root cause: nothing keeps dev/red-team/focus-areas.md's 13 scope rows in sync with the
file tree. Rows were written once and grown by hand, so files added since — and whole
subsystems that predate the rotation — are owned by no area and are therefore never reviewed at
any tier, at any point in the rotation.

This gap has already cost real findings, twice

• The 2026-07-03 area-12 round wrote: "Not yet checked (flagged for a future area-12
  round): R/*.R file coverage … this round only diffed src/* against area file lists." It
  sat unactioned for a month.
• The 2026-08-03 area-10 round then filed three findings in two R/*.R files sitting in
  no scope row (R/recode_hierarchy.R, R/CharacterHierarchy.R), and its log entry names the
  delay as area 12's. One of those files had already been flagged as unowned by the 2026-07-03
  round.
• escalation-backlog.md item 5(a) records that TreeLength / MinimumLength /
  CharacterLength and the R-layer IW scoring are in no scope row — and TreeLength() on a multifurcating tree performs out-of-bounds heap writes and returns a score read from memory *before* the buffer — reachable with no error and no warning from MaximizeParsimony()'s DEFAULT output. #16 (sev:high) is a
  TreeLength() out-of-bounds-write bug. Proven twice over before anyone diffed.

Already fixed inline this round (no decision needed)

17 files added to existing rows 1, 2, 4, 5, 6; area 7 extended to the Shiny app's own test
suite; area 8's glob broadened from test-ts-*.R to tests/testthat/*.R, which had been
excluding ~44 of ~110 test files. Every addition is annotated UNMEASURED / no inherited
maturity, per this area's own standing lesson that a scope row that grows does not inherit
the dry verdicts earned before it grew.

Also fixed: README.md's hand-kept severity breakdown (read 6/5/13 against a true 6/4/14 —
drifted within the same round it was written) replaced with a query; the undocumented
gh label create area:N dependency when a row is added; a missing migration-map-todo.tsv row;
and the stale "NEVER REVIEWED" rationales on areas 12 and 13, both of which had been reviewed.

Decision 1 — a new area for the statistics / support-metrics subsystem (recommended)

5,553 lines across 14 files, owned by no area, and it has already carried a real bug while
unowned: src/MaddisonSlatkin.cpp's arm64 probe_slot() hang, fixed in PR ms609#272.

File	loc
src/MaddisonSlatkin.cpp	1786
R/Concordance.R	1139
R/ParsSim.R	634
R/pp_info_extra_step.r	523
R/WideSample.R	392
R/Consistency.R	232
R/TaxonInfluence.R	196
R/ScoreSpectrum.R	185
src/expected_mi.cpp	149
src/ts_mc_fitch.cpp	103
src/quartet_concordance.cpp	88
R/RandomTreeScore.R	61
R/WhenFirstHit.R	41
R/QuartetResolution.R	24

This is one coherent subsystem — recursive Maddison–Slatkin DP, factorial-cache log-space
arithmetic, Monte Carlo fallbacks, concordance-factor statistics — larger than several existing
areas, numerically dense in exactly the way the tier doctrine reserves for opus, and with its
own test convention (test-MaddisonSlatkin.R, test-Concordance.R, test-ParsSim.R,
test-Consistency.R, test-ScoreSpectrum.R, test-QuartetResolution.R, test-TaxonInfluence.R,
test-WideSample.R, test-pp-*.R).

Recommended as area 14, start_tier: opus. Not enacted because adding a row also means
creating an area:14 label and recomputing N in log.md's rotation formula — a restructuring
decision, and N changes every future rotation index.

Decision 2 — where the legacy pure-R search API belongs (higher urgency)

2,183 lines across 9 files, backing the still-shipped pre-C++-engine search functions:
R/CustomSearch.R (defines TreeSearch()), R/Ratchet.R, R/NNI.R, R/SPR.R, R/TBR.R,
R/SuccessiveApproximations.R, R/tree_rearrangement.R, R/morphy-deprecated.R,
R/Bootstrap.R.

Urgency comes from #16, which states in its own body that EdgeListScore() — one of the four
confirmed-vulnerable entry points — is "the default TreeScorer for
TreeSearch()/Ratchet()/Jackknife()". So this family is a second, wholly unreviewed
exposure surface for an already-confirmed sev:high bug.

Three ways to settle it, all defensible: fold into area 2 (rearrangement-adjacent), fold into
area 9, or review once as frozen legacy and then explicitly deprioritise from rotation. Unlike
the statistics cluster this code is not growing, so "review once then park" is reasonable — but
it should be a recorded decision, not a silent omission.

Residuals — all three verified this round, and one inverted on verification

• src/ts_temper.cpp/.h (523 loc), unowned, ambiguous between areas 2 and 3. Reachability
  settled: no shipped preset or effort rung sets annealCycles > 0 (default 0L at
  R/SearchControl.R:370; R/MaximizeParsimony.R:365 notes drift replaced it), but the code is
  fully live when a user sets it explicitly — ts_driven.cpp:505 → anneal_search()
  (ts_temper.cpp:420) → stochastic_tbr_phase. So: opt-in, not dead, and unreviewed.

• src/rearrange.cpp (643 loc) is NOT dead code — its own header said so and was wrong.
  This was filed as "dead code still compiled" and inverted on verification. The
  [[Rcpp::export]] tags are indeed all commented out, but src/RcppExports.cpp and
  src/TreeSearch-init.c were never regenerated afterwards, so the wrappers
  _TreeSearch_nni / _TreeSearch_spr / _TreeSearch_spr_moves persist, are declared and
  registered in the callMethods table (TreeSearch-init.c:11-13, :66-69), are bound at
  R/RcppExports.R:60-68, and are exercised by three test files — test-NNI.R,
  test-zzz-tree-rearrange.R, and test-rearrange.cpp.R (via all_spr). Only tbr_moves is
  genuinely unexported.

  The header was actively hazardous, since it read "no functions are exported or called …
  Safe to remove": acting on it breaks three test files and leaves dangling registrations.
  Corrected inline this round. Two residuals for someone with more context: whether the
  registrations should be regenerated to match the tags (which would remove the exports and
  require rewriting those tests) or the tags restored to match reality; and that 643 lines of
  live, registered, test-exercised code are owned by no area.

• R/ImposeConstraint.R — cosmetic, with an identified accidental origin. 0 bytes, listed
  at DESCRIPTION:104. Sourcing a 0-byte file is valid R and defines nothing, so it breaks no
  build — but it is not intentional: it was added by 78b74147 ("test(tbr): regression guard
  for exact_verify cache regime-keying", 2026-06-19), a commit about something else entirely.
  No local ImposeConstraint is referenced anywhere; the only reference in the package is a
  doc link to TreeTools::ImposeConstraint() in R/AdditionTree.R. Cleanup is to drop line 104
  from Collate: and delete the file.

• Visualization (R/PlotCharacter.R, R/PaintCharacters.R, R/PresentContra.R,
  R/ClusterStrings.R) → proposed area 7. Infra (R/TreeSearch_utilities.R,
  R/ReleaseQuestions.R, R/zzz.R) → proposed area 6. Both low confidence, not enacted.

Methodology note worth keeping

The diff must glob R/*.[Rr], not R/*.R. R/pp_info_extra_step.r has a lowercase extension
and is silently skipped by a case-sensitive pattern — it caught this round's own methodology
before the finder noticed. Recorded in README.md.