v1.2.0 — Scanner v5: HTML entity decode, corrected wave-2 dataset

Scanner v5 (237ca95)

HTML-entity-encoded <img src> attribute values were live-checked undecoded. Browsers unescape entities in attribute values before fetching, so a URL like ?v=4&s=18 renders fine in every reader — but the scanner requested the raw string and recorded HTTP 400.

Fix: decode HTML img src values only (html.unescape); markdown refs pass through unchanged. Two regression tests added; suite 60/60.

Corrected wave-2 dataset (10839f1)

Rescanned the 100-repository wave-2 corpus under v5:

• externalBroken 248 → 104
• axios/axios 136 → 0: the entire block was CHANGELOG contributor avatars that were never broken
• trekhleb/javascript-algorithms 40 → 32, rustdesk/rustdesk −1, jackfrued/Python-100-Days +1 (live drift between the two scans, verified individually)
• missingInRepo 48 and unresolvable 11 unchanged — the three filed issues (PowerToys#50821, firecrawl#4776, flutter#193415) are in-repo cases and were never affected
• NousResearch/hermes-agent recovered from the v4 transient fetch error (uniqueImages 9 → 15), validating the markdownFetchErrors contract

Published copy at codebyaurora.com/docrot/docrot-wave2.json replaced with md5 parity (f5c050ff774f2cab255aecba5b88456b).

The pattern

Third scanner-caused false-positive class found by auditing our own findings before publishing (after adev/ docs-site roots and silent fetch skips in v3/v4). Every headline number in this repository has now survived a "prove it is really broken" pass — and the corrections are public, not quietly patched.