Code Analysis Unified Investigation

Unified source investigation candidate

Draft #1269, head 1fa3cd0a097e973d653376721e6b8447f2be12b0, is the eighth layer of native stack #1262 above #1267. Pinned composition and evidence.

This composition extends Java Draft #1267 at bbfa46ce6bee206f1bf17267168539902d36ab40 with independent Python Draft #1268 at b7495c1d73736a81c8e58d9763bfdea3e2d8e579. Runtime merge11a0350919efc5553eff118094aa9cf1a39106be has both original heads as parents. Original team, Go/Rust, Java, JS/TS and Python commits, authors and PR ownership remain. Local history composition is not a GitHub PR merge. Do not merge overlapping cumulative/original scopes without reconciliation.

The dependent composition layer sits above #1267 in native stack #1262. The original Python PR remains independent above #1252. Labs remains bf0a29e7664f52973d06a8e6a608df2db1ecbd39. No approval, formal merge, release or live installation.

One more investigation path in the same distribution

The latest Go SDK/concrete methods, Rust inherent source candidates, Java fixed-arity candidates and JS/TS aliases previously coexisted without Python API reexports. Now the same normal CLI and ZIP can follow Jinja tests/test_api.py:100 through jinja2/init.py:32 to utils.py:104 while retaining, for example, Chi mux.go:82 Reset→context.go:82 and serde_json value/from.rs:60 Number::from_f64→number.rs:183. Jinja's nested generated expr2(), Go interface dispatch and Rust's reserved generic Map calls still lack sufficient product evidence.

This is compatibility/composition validation on already exposed fixed samples. It does not add independent accuracy samples, repeat earlier compiler/LSP audits or prove runtime behavior/full impact.

Composition decisions

Shared semantic validators, saved questions, paired coverage and schema retain all model-specific behavior: JS/TS v1–v4, Python v1/v2, Java v1–v3, Go v1–v3 and Rust v1/v2. Python's one-explicit-reexport reader is added without replacing native ranges, SDK/build scope, Java guards or historical capture contracts. The static import adjacency map is shared; no new language resolver rule is introduced.

Generated task examples and the ZIP are regenerated from the union. The original Go replay's existing compiler/source-verified Attributes.Value positive now applies to both concrete-call models v2/v3; the earlier guard accidentally treated v3 as v1. This changes a stale benchmark model discriminator, not its source answer or runtime resolver.

The latest base already retains the original #1242 README proof repair and the #1263 canonical test-fixture path correction. They are not new fixes in this layer. Independent #1268's local TypeScript snapshot and remote README failures remain facts about that earlier base and are not relabeled by this candidate's results.

Per-language replay

Nine existing graders run through source and extracted ZIP, with the original pins/hashes/profile checks, questions and expected exits:

Recipe	Selected correct / wrong / missed	Preserved boundary
Original Go direct/source change	10 /0 /0	Four unknowns; original changed Cobra callers and alias path retained. One existing concrete-method positive is included under v3.
Go SDK	37 /0 /0	Two interface unknowns; recorded SDK/build/test scope and partial changed-Chi question retained.
Original Rust direct/source change	9 /0 /0	Two unknowns; crate/workspace/alias paths and both partial real version pairs retained.
Rust inherent functions	4 /0 /4	Four unknown observations; four known-miss observations are two physical generic Map sites under two profiles.
Java fixed arity	2 /0 /5	Original five independently guarded test calls remain known misses.
JavaScript defaults	2 /0 /0	Two unknowns; real Prettier changed-definition question remains partial.
TypeScript captured aliases	6 /0 /1	One unknown; known Redux barrel target remains a miss.
Python original imports	5 /0 /0	Five unknowns; original Click/Jinja source questions retained.
Python reexports	4 /0 /0	Two unknowns; four Jinja/Flask API questions reach their definitions.

Do not sum the rows: repositories, profiles and target observations overlap and use different denominators. Earlier independent Go/Java compiler, JS/TS signature and Rust LSP audits remain evidence at their original recorded heads, not new runs here.

All26 raw captures are byte-identical between source/ZIP. All32 saved/paired questions agree after normalizing only installation/output paths. Fifty-eight CLI commands per distribution have matching normalized arguments and exits, including expected partial/nonzero paired results. Explicit --fail-on never check exits are not no-findings claims. See evidence/parity.json.

Reproduce

Use the fixed sample checkouts from the nine owning benchmark manifests. Do not execute project code. Install only the existing Code Analysis dependencies in source and package, plus the recorded Go/Rust toolchains. Then:

python3 benchmarks/code-analysis-investigation-unified/run.py \
  --cli archify/bin/archify.mjs --samples-root /fixed/samples \
  --product-sha 11a0350919efc5553eff118094aa9cf1a39106be --out /runs/source
python3 benchmarks/code-analysis-investigation-unified/run.py \
  --cli /extracted/archify/bin/archify.mjs --samples-root /fixed/samples \
  --product-sha 11a0350919efc5553eff118094aa9cf1a39106be --out /runs/zip
python3 benchmarks/code-analysis-investigation-unified/verify.py \
  --source-results /runs/source --zip-results /runs/zip --source-tree /candidate \
  --package-tree /extracted/archify --zip /candidate/archify.zip \
  --repeat /runs/repeat.zip --out /runs/parity.json

Build the second ZIP with scripts/build-zip.sh under official Node22.23.3 / bundled zlib1.3.1-e00f703. Runtime here is Node26.12.0/Python3.15.0 on darwin-arm64 with the previously installed Go1.27.2 and Rust1.89.0. No new toolchain was installed. Other profiles/interpreters can legitimately change captured coverage; read each owning language scope/cost report. No local Windows run is claimed.

Separate verification states

• Source module388/388, zero skips; core19/19; release identity passed.
• Extracted package: Python/paired/shared questions/Java52/52 and native Go/Rust26/26, zero skips. These are separate, nonoverlapping selections. Full Git-dependent self-bootstrap tests are not represented by this package selection.
• Two canonical builds agree; all168 tracked module files match extraction. ZIP SHA2562102f79456d6b58e06c09c048e1c8f8d64e5685430320a1425c42745fc0c5bf4.
• Nine source/ZIP graders and the parity verifier pass. Original implementation audits are reused only at their original revisions. No new broad accuracy claim.
• Remote final-head CI is tracked separately in the owning English Draft/Wiki. Local/package success does not establish remote or Windows success.
• Not in Labs/approved/merged/released/installed. Persistent work continues on real wrong targets, missed targets and interrupted source investigations.

Scoped review traces shared schema/semantic validation into saved and paired questions. Existing model/freshness controls plus all nine real-source graders cover the union. No duplicate language resolver, arbitrary export traversal or compatibility retirement was introduced.

Remote CI

Final-head CI42420773645 completed success at1fa3cd0a097e973d653376721e6b8447f2be12b0. Actual Code Analysis logs report388tests/388pass/0fail/0skip. Executed full regression, browsers, ZIP/WebM, website, three-platform packages and both Windows portability checks passed; deployment jobs skipped. This does not rewrite independent #1268 failures. No approval, formal merge, release or installation.