Repository navigation
Code Analysis Validation
这轮用两个问题检验分析结果。内部函数加入公共入口后，能否指到正确的实现？回调通过事件名注册后，能否找到执行它的代码？先用上游的源码、差异和测试写下答案，再运行同一版本的分析器读变更前后两份源码。另取 EventEmitter3 5.0.1 复核同名回调的实际分派。Code Analysis One Page · 公开 Labs 基线 bf0a29e7
#4621（85d7f27a → c9e06506）只改了 src/index.ts。变更后，第 8 行导入原有的 isPlainObject，第 48 行把它列为公共导出。原有三个内部调用方是 combineReducers、createStore 和 isAction 所在的文件。它们和函数实现的源码在两版中相同。入口导入 · 公共导出 · 函数实现
-
Labs 找对了文件依赖。 仅扫描
src/的 17 个文件。变更前的 38 条导入和变更后的 39 条都解析到文件。指向该函数实现文件的导入方从 3 个变为 4 个，新增的正是公共入口。 -
公共名称需要核对导出语句。 导入记录里的
default只说明入口怎样取得这个函数。用 TypeScript 5.9.3 将两份源码分别转为 CommonJS 后，直接读取入口，确认只有后版导出了isPlainObject，而且与原函数是同一对象。本次验证读取源码入口，范围不含已发布的 npm 包和外部使用方。 - 本地双版本实验
c3dddd5c选中了唯一变化的index.ts。公开 Labs 的文件依赖加上上面两处源码，已足够回答本例。实验输出对读者用时或准确度的增益，需另做对照。
#1763（3ae30a29 → 2c7f687e）新增 preSubcommand。注册时，父命令把监听函数存入事件表。分派时，先调用监听函数，再把参数交给直接子命令。用 Node 跑同一个根命令、子命令和孙命令，旧版拒绝注册，新版只触发一次根钩子，传入直接子命令，随后才执行孙命令动作。注册 · 分派 · 回调调用处 · 上游顺序测试
-
Labs 漏掉了进入库的依赖。 两版各扫描 149 个 JS/TS 文件，各记录 174 条导入。125 个文件中的 125 处相对目录
require都由 Node 解析到根index.js，包括 96 个测试文件和 29 个示例文件。默认配置下，Labs 对这 125 处都报告未解析。放开.d.ts排除后，这些运行时引用又全指向了类型声明。包分别声明了 JS 入口和类型入口。包入口声明 · 测试的实际导入 -
定位方法和认出回调对象是两个结果。 本地实验
c3dddd5c选中了 7 个 Git 变更文件中的 4 个。两份 README 和公开声明typings/index.d.ts在默认扫描范围外。实验找到了新增方法的第 1202–1212 行。对第 1207 行究竟执行哪一个监听函数，它明确报告未绑定。该方法的直接引用计数为 0，但第 1058 行确有调用。调查影响时应沿注册表回查，并保留对运行时顺序的独立验证。
| 固定样本 | 公开 Labs 的结果 | Draft #1214 的本地验证 |
|---|---|---|
| Commander #1763，变更前后分别检查 | 每版 125 处目录引用均未解析。显式纳入声明时都指向类型文件 | 两版各 125 处均与 Node 的运行时入口一致。纳入声明后也指向 JS |
| dotenv v16.4.7，追加检查相邻的类型文件 | 7 处省略扩展名的引用均未解析 | 7 处均指向 lib/main.js，逐处与 Node 一致 |
| minimist v1.2.8，追加检查已能解析的目录入口 | 16 处均指向 index.js
|
同样 16 处逐一吻合 |
上层 d2754f100 继承下层条件导入修复 5df422692。它利用本轮已捕获的文件区分相对 CommonJS 引用和类型入口。Commander 单版的已解析导入由 16/174 增至 141/174，剩余 30 条外部依赖和 3 条未知项。该变化集中于测试和示例。233 项模块测试通过。解压后用 CLI 重跑 Commander 和 dotenv，原始分析结果均与源码版相同。修复已提交审查，详见条件导入 Draft #1213和运行时入口 Draft #1214。表中的 Labs 列可以直接按下方命令复现。dotenv 配置入口 · dotenv 测试使用处 · minimist 示例
-
已有分工继续按原讨论推进。稳定 finding ID 修复已开 Draft PR。配置无效时的错误提示、解析失败与跳过语言的披露，由原协作者按 A1、A2 分别推进。稳定 ID #1212 · A1/A2 范围
-
间接调用的两个对照分别跟踪了EventEmitter3 的同名监听器和pluggy 的跨文件注册与排除。两个案例都区分了源码调用位置与实际选中的对象。
-
Ansible 同名包与模块核对了标为已解析的导入是否指对文件。SymPy 全库与同名导出核对了 1,572 个 Python 文件的覆盖，以及
simplify导入对象的身份。两个 Python 修复已分别提交审查。包入口 #1216 · 整库扫描 #1217 Follow-up in the same Draft now checks parent-package paths and namespace portions: five authored probe corrections and two false targets removed from adapted Pyright cases; Ansible, pluggy and pytest controls preserve all 4,409 references. Reproduction -
SLF4J 的 Java 服务选择用两个版本、十次独立 JVM 运行，区分接口依赖、服务描述文件和运行时选中的实现。Guava 的两套源码里，六处同名导入在合扫时都保留未解析，按 JRE、Android 分开扫描后全部与 JDK 指向的文件一致。两套源码各有七个文件因 Unicode 转义被跳过。后续验证与修复恢复了这 14 个文件，并与 JDK 逐条核对了 863 个声明位置，代码已提交审查。Draft #1218
-
Node package loading conditions compares import/require targets with Node and TypeScript, studies dependency-cruiser’s resolver choices, and records unchanged real-project controls plus two remaining source/runtime gaps. The loading-mode correction is under review in Draft #1219; Draft #1220 corrects 19 JavaScript implementation targets in dependency-cruiser and chalk, each independently checked against Node.
复现公开 Labs 对 Redux 和 Commander 的结果
在临时目录准备 Git 和 Node 22。下面固定三个仓库版本。npm ci 只给临时的分析器副本安装锁定依赖。两个被分析的仓库均不需要安装依赖。这里使用 --fail-on never 收集分析结果，逐条比较导入目标。最后一段使用 Node 的 require.resolve，不执行被解析的模块。Node.js CommonJS 解析规则
set -eu
w=$(mktemp -d)
pin() {
git init -q "$w/$1"
git -C "$w/$1" fetch -q --no-tags --depth=2 "https://github.com/$2.git" "$3"
git -C "$w/$1" checkout -q --detach FETCH_HEAD
}
pin archify tt-a1i/archify bf0a29e7664f52973d06a8e6a608df2db1ecbd39
pin redux reduxjs/redux c9e06506f88926e252daf5275495eba0c04bf8e3
pin commander tj/commander.js 2c7f687eaea6e7b29b917db8d71a06fe6fbfb53e
(cd "$w/archify/archify/modules/code-analysis" && npm ci --ignore-scripts --no-audit --no-fund)
cli="$w/archify/archify/bin/archify.mjs"
for project in redux commander; do
git -C "$w/$project" worktree add -q --detach "$w/$project-base" 'HEAD^1'
for side in base head; do
root="$w/$project"
if [ "$side" = base ]; then root="$w/$project-base"; fi
if [ "$project" = redux ]; then root="$root/src"; fi
node "$cli" code-analysis check "$root" --language ts --fail-on never --json \
--out "$w/$project-$side-out" > "$w/$project-$side-receipt.json"
done
done
node - "$w" <<'JS'
const fs = require('node:fs');
const path = require('node:path');
const { createRequire } = require('node:module');
const w = process.argv[2];
for (const side of ['base', 'head']) {
const facts = name => require(path.join(w, name + '-' + side + '-out', 'raw-facts.json'));
const helper = facts('redux').imports.filter(e => e.to === 'utils/isPlainObject.ts');
const repo = fs.realpathSync(path.join(w, side === 'base' ? 'commander-base' : 'commander'));
const loads = facts('commander').imports.filter(e => e.kind === 'require' && ['../', '../../'].includes(e.specifier));
const agree = loads.filter(e => {
const target = createRequire(path.join(repo, e.from)).resolve(e.specifier);
return e.to === path.relative(repo, target).split(path.sep).join('/');
});
console.log(side, { reduxImporters: helper.map(e => e.from), commanderAgreed: agree.length, commanderChecked: loads.length });
}
JS预期 Redux 的导入方从三个增加到四个，新增 index.ts。Commander 的 commanderChecked 在两版均为 125，公开 Labs 的 commanderAgreed 均为 0。复核上层 Draft 时，把 pin archify 一行的 SHA 换成 d2754f10066980b9ce1e7c13f2f634e6cec67447。从 GitHub 重新取得该提交后，两版均为 125/125，Redux 仍只增加 index.ts。
-
Resolver design research connects the TypeScript, dependency-cruiser, Pyright and JavaParser findings to source-context choices and accuracy checks. The TypeScript 6.0.3 upgrade experiment was not adopted because a valid Node array fallback regressed; both boundaries are reproducible.
-
JS/TS lexical call evidence is now isolated in Draft #1225: four fixed scopes preserve existing facts, selected direct targets agree with source, and dynamic EventEmitter3 dispatch remains unresolved. The page records the explicit call model, compatibility and output-size costs, and an executed public reproduction. Single-entry question orientation is now isolated in Draft #1226, including TypeScript entries and explicit unavailable-versus-zero receipts. Required-entry paired investigation is isolated in Draft #1229, with seven source/archive cases, a format-only control and explicit declaration coverage.
-
Relative default function calls, Draft #1227, adds six source-verified Redux targets while preserving all earlier call records in EventEmitter3 and Archify Labs. It records v1/v2 compatibility and an executed source/archive reproduction.
-
Relative Python namespace imports extends Draft #1216 with ordered cross-portion lookup for relative imports. Independent CPython expectations, three real repository controls and ten source/archive comparisons are recorded, with a self-contained public reproduction.
-
Java static value and type namespaces, Draft #1231, restores two missing type dependencies in a JDK-verified authored case. Guava and SLF4J preserve all existing records; the page includes an executed public compiler/CLI/archive reproduction and remaining parsing limits.
-
JavaScript parameter-default scopes corrects a false body-local call target in Draft #1225 and propagates it through #1226/#1227/#1229. The authored Node oracle, unchanged real-source controls, final revision/validation table and executed public replay are recorded.
-
Vite configuration merge follows a changed recursive helper through an unchanged wrapper and configuration caller. Frozen source answers, an 18-case helper matrix, explicit partial capture and source/archive/public replay are recorded; no new product fix was needed.
-
Current review map links the open Drafts to their dependencies, evidence and remaining review decisions, with adjacent teammate work kept separate.
-
Saved Python/Java source questions, Draft #1234, reuses captured function/import evidence in SymPy and SLF4J while retaining unavailable calls and ambiguous-overload errors. Exact public capture recreation, normal CLI and unpacked-archive checks passed; no runtime selection or reader-effectiveness claim.
-
Optional-chain CommonJS guards updates Draft #1213 and preserves its #1214/#1216 dependents. Eight authored cases separate short-circuited arguments/keys from eager bases/grouped boundaries; two real controls preserve facts and ten scopes match source/archive. Standalone public replay passed. No real-project trigger was found in the bounded inventory scan; current CI retains the known README baseline failure.
-
pandas selection study follows three source questions through scalar/list, boolean-mask and duplicate/MultiIndex branches. Saved orientation and archive checks, 14 independent wheel cases, a shared reader interpretation error and two separate follow-up checks are recorded. The page includes a field-reading recipe, executed standalone replay and a later source audit of two cycle warnings that separates static dependencies from feasible initialization order; no new product defect or reader-effectiveness claim.
-
HTTPX deferred imports follows a real change from module-scope dependencies to constructor/helper imports. Ten selected import facts and six source/archive question pairs agree with source; a separate six-process oracle shows why bypassing HTTPX’s SSL constructor still allows httpcore to import certifi. Executed standalone replay included; no requests, benchmark or new product defect.
-
Conditional null package targets updates Draft #1220 and its existing dependents. A frozen 16-site authored matrix corrects nine prior wrong targets, preserves type-only and array-selection boundaries, and passes a public source/archive replay. Seven fixed real scopes preserve their earlier facts; the final top passes 287 module tests. Current heads, archive identities, evidence reuse and CI outcomes are recorded separately from human review.
Seven projects, five changes, source/ZIP replay and per-unit results now compare Labs, the combined Draft baseline, Python calls and cross-language definition comparisons. These are experimental Draft results with explicit unknowns and partial coverage, not an integrated release.
Language capability table: Labs, Draft validation and unsupported scope.
Go first source/ZIP investigation: exact root-module source bindings and known callers in Draft #1256, with build/typing scope, finite score, Chi oracle correction and remote CI kept separate.
-
Rust source paths and direct callers, Draft #1258, follows changed regex/serde_json definitions and real workspace/use-as paths. Six source/ZIP fact captures match byte-for-byte; both paired profiles remain partial. Local tests, remote CI, package verification and unmerged status are explicitly separate.
-
Java explicit class-qualified static paths, Draft #1259, follows SLF4J and Commons source targets. Source/ZIP parity, compiler-agreed new targets and remaining compiler-known misses are separate from local tests and final remote CI.
-
Stable default ordinary-function references, Draft #1260, restores Prettier source jumps and real version-pair known callers while retaining factory/callback unknowns. Signature audit diagnostics, source/ZIP parity, local tests and final remote CI are explicitly separate.
-
Configured captured-alias calls, Draft #1261: Redux source-first aliases, retained known barrel miss, eleven independent signature attributions, source/ZIP parity and separate local/CI/integration states. Native JS→TS stack #1262; no Labs merge.
-
Cumulative six-language candidate, Draft #1263: original Go/Rust/Java/JS/TS/Python histories,17captures/20questions source/ZIP parity,373/373local module passes, explicit archive Git-only test limitation and separate final-head CI/DSH checks. No Labs merge.
-
Concrete Go methods, Draft #1264: three fixed direct targets, real Chi changed-method callers, 9,281 independently attributed new targets and 37 retained known misses. Source/ZIP parity and local/CI/merge states remain separate.
serde_json 的 value/from.rs:60 Number::from_f64 以前停在未知目标，现在可以沿 Number 导入跳到 number.rs:183。真实版本中移除 inline 属性的定义调查，两侧各找回 3 处源码确认的引用，位置均有效；函数体没有改变，整体调查仍为 partial、退出码 1。regex 两个模块中的同名 Regex::new 分别指到自己的定义。预留 Map 泛型样本仍有 2 个实际调用点遗漏，不能算作合理未知。
本地完整模块 380/380，解包 Rust/question/change 测试 42/42，三个原始捕获与四个问题完成源码/ZIP 对比。远端 CI 与合并状态另列，未把 Draft 算入 Labs，也未发布或安装。固定版本、复现方法、工具链成本及未证明范围。
#1265 最终 head CI 已结束并通过；完整回归、浏览器、ZIP、三平台打包及 Windows 检查通过，部署任务跳过。仍是未合并 Draft。独立 rust-analyzer 复核在发布后另行开始，安装成本及工作区配置另记，不将尚未完成的审核算作准确性证据。
独立 rust-analyzer1.89.0 复核的 1,250 个目标观测覆盖 1,230 个实际调用点，定义位置均一致；它包含先前有限样本，不能累加成新的独立样本。预留 Map 两个实际遗漏在两个 feature 配置下也都能由 RA 定位。逐项请求、函数范围、返回位置、依赖锁与复现脚本现已公开，错误的 string/bytes 目标对照能被校验器拒绝。证据和限制。这仍不证明完整编译、运行行为或全仓召回率。
证据 head1788ace7a 的 CI 已结束并通过，实际模块日志 380/380、零跳过。发布代码和 ZIP 字节未改变，RA 复核属于另行执行的本地验证；未合并、发布或安装。
Chi mux.go:82 rctx.Reset() 原先停在未知接收者；现在通过真实 SDK 类型及显式 *Context 断言跳到 context.go:82。Chi3处、gRPC34处此前已知遗漏全部与完整项目类型图一致，接口调用保留未知。记录的已知方法体调用群体为9318/9318匹配，不代表全仓召回率或运行行为。
本地模块383/383，解包相关测试40/40；四份原始捕获和六个问题完成源码/ZIP对比，实际历史v2结果仍可读取。冷本地Go缓存的正常CLI运行6.90秒、154952KiB，工具链已预装；不作为一般性能结论。远端CI与实际合并状态另列。固定来源、复现、范围与成本。
#1266 最终 head CI 已完成并通过，实际模块日志383/383、零跳过。完整回归、浏览器、ZIP/WebM、三平台包和两条Windows检查均通过，部署跳过。完整项目调用目标归属复核仍单列为本地验证；未合并、发布或安装。
Commons Lang 的 ExceptionUtils.java:287 StringUtils.defaultString(...) 原先停在重载歧义，现在能跳到 StringUtils.java:1553；SLF4J 的 MessageFormatter.java:124 arrayFormat(...) 能跳到两参数声明154。内部 Throwable.getMessage 调用和完整重载适用性仍缺乏证据。最初冻结的五处测试调用仍受继承或静态通配导入限制，全部保留为已知遗漏。
本地模块386/386、零跳过，核心19/19；解包相关测试41/41、零跳过。两份原始捕获及问题完成源码/ZIP一致性核对，旧Java2结果可读。新增292个目标中289个与独立JDK归属一致，另3个仅做源码复核，不能算编译器确认。现有SLF4J迁移文件解析失败仍可见。远端最终结果另列；未合并、发布或安装。固定版本、复现与边界。
#1267 最终 head CI 已完成并通过；实际模块日志386/386、零跳过。执行的完整回归、浏览器、ZIP/WebM、三平台打包与Windows检查通过，部署跳过。独立JDK目标归属属于本地验证，Draft仍未合并、发布或安装。
Jinja 的 tests/test_api.py:100 is_undefined(...) 原先有调用点但没有目标；现在能沿 jinja2/__init__.py:32 跳到 utils.py:104。内部 expr2() 仍是动态生成的调用对象，不能确定实现。另一个 Jinja 调用和预留的两个 Flask 调用也能定位定义，四个固定问题从0正确/4遗漏变为4正确/0遗漏；两个未知对照保持未知。
本地 Python/成对调查38/38，解包38/38，核心19/19；两个原始捕获与四个问题完成源码/ZIP对比，实际旧v1结果保持原覆盖语义。全模块345通过/1失败，TypeScript配置快照失败已在未修改的#1252基线上重现，不能记为全绿。35个新增目标均有显式源码链核对，其中包含四个固定问题；没有编译器归属或运行时身份保证。远端CI状态另列；未合并、发布或安装。固定版本、成本、复现和边界。
#1268 最终 head CI 已结束，整体失败。实际 Code Analysis 日志346/346、零跳过；失败为完整回归第二分片中的 README classic 素材摘要漂移，未修改的#1252基线同样失败，Node22最终汇总门因此失败。浏览器、ZIP/WebM、网站、三平台包和两条Windows移植性检查通过，部署跳过。这里的远端失败与本地 TypeScript 快照失败分开保留，均未豁免；未合并、发布或安装。
同一份正常 CLI 和 ZIP 现在既保留 Chi Reset、serde_json Number、Java固定参数个数、JS默认导出、TS别名路径，也能沿 Jinja API重导出找到函数。Jinja动态表达式、Go接口及Rust泛型Map仍保留未知或已知遗漏，未按组合结果豁免。
原始提交作为父历史保留，原PR归属不变。九组固定案例完成26份原始捕获、32份问题和每种分发58次CLI对比；五个预期partial成对调查仍退出1。本地完整模块388/388、零跳过，解包两组非重叠选择52/52及26/26；核心19/19、两次ZIP一致。原有独立编译器/LSP审计只按原版本复用，没有当成新准确率。远端CI状态另列；未合并、发布或安装。复现、逐语言结果与边界。
#1269 最终 head CI 已完成并通过；实际模块日志388/388、零跳过。执行的完整回归、浏览器、ZIP/WebM、网站、三平台打包和两条Windows移植性检查通过，部署跳过。#1268旧基线上的失败记录继续单列，未被组合候选的通过结果覆盖。未合并、发布或安装。
serde_json 的 value/index.rs:98 Map::new() 以前有调用点但没有目标；现在可沿 crate::map::Map 找到 impl Map<String,Value> 并跳到 map.rs:41。value/ser.rs:266 Map::with_capacity 能跳到49。内部 MapImpl::new 仍因 cfg 选择外部容器及泛型别名而未知，宏中的 Map 文本仍不算已展开调用者。
五个实际调用点在两个重叠配置下从10遗漏变为10正确目标观测；三个跨文件案例预留到规则冻结后复核。二十个新增目标观测对应十个实际点，RA位置全部一致，包含前述固定案例，不能累加为独立样本或视为完整编译。旧目标、22315调用范围及4730函数保持不变；18个新增依赖观测有源码声明核对。
本地模块391/391、零跳过；解包46/46，核心19/19；源码/ZIP捕获与问题、实际旧v1/v2问题保持一致，三个partial版本对比仍退出1。远端CI另列，其他五语言的真实复跑仍按#1269版本引用；未合并、发布或安装。固定版本、复现、工具成本与边界。
#1270 最终 head CI 已完成并通过，实际模块日志391/391、零跳过。执行的完整回归、浏览器、ZIP/WebM、网站、三平台打包及两条Windows移植性检查通过，部署跳过。RA定义位置核对仍单列为本地审计，未计为远端编译或运行时验证；未合并、发布或安装。
Fixed Redux questions, full independent audit, real source pair, source/ZIP parity and limits. Candidate0e41f1e7f: local397/397, extracted62/62, zero skips; four selected source calls correct,205new body targets compiler-agreed (overlapping denominators). Three raw capture instances(two distinct)/five orientation payloads agree; eight CLI commands per distribution exit0. Final-head CI42427971892 completed success (actual module397/397, zero skips). Source targets/ready orientation are not compilation, runtime execution or complete impact. Not in Labs/merged/released/installed.
Fixed Commons/SLF4J inputs, attribution, scope correction and reproducible source/ZIP parity. Headb5b14e8a9: local401/401, extracted48/48, zero skips; four frozen Commons calls correct. Compiler agreement covers4,748Commons new targets under its489-file graph and2SLF4J targets under the explicit64-file API graph; unrelated full-API errors and exclusions remain visible. The selected4are included, not additional observations. Five raw instances/four distinct payloads and9orientations match;14normal CLI commands per distribution exit0. Final-head CI42432297712 completed success (actual module401/401, zero skips). No Labs integration, approval, merge, release or installation.
Source/POM freezes, independent attribution, real upstream migration and public CLI/ZIP recipes. Head196dd3569: local407/407, extracted46/46, zero skips; two new targets independently javac-agreed under77-source graph,231old targets preserved. Four frozen questions2correct/2missed→4correct/0missed, external unknown retained. Real upstream added-definition migration retains partial/exit1 while adding two Simple callers. Source/ZIP9commands agree including stale-POM and historical-Java4 scope. Canonical package54pass/2environment skips, Node26package/community58pass/7skips, recorded separately. Final-head CI42436890903 attempt2 succeeded at196dd3569; actual independent module log407/407/0skip. Attempt1 nested self-import extraction failure and supported20s-deadline inference are retained separately; successful same-head rerun is not a proven flakiness fix. No Labs integration, approval, merge, release or installation.
Source freeze/correction, profiles, audit and recipes. Head915d528e5, runtimea150e7682: local394/394 and extracted42/42, zero skips; canonical package54pass/2environment skips. Three frozen misses become correct, two Visitor unknowns retained. Independent RA73regex+11serde-default+11serde-arbitrary=95observations/84physical sites, each with one matching location; selected3overlap. Source-reviewed imports and old target preservation are separate. Source/ZIP3rawcaptures/17questions/21CLIcommands per distribution agree, including intentional missing-SDK exit2 and actual old model reads. Owned changed-body known-reference check is synthetic and does not replace earlier real-version Go/Rust acceptance. Final-head CI42440422852 succeeded at915d528e5; actual analysis job128608361801 executed394/394/0skip. Full/browser/ZIP/WebM/website and package/Windows checks passed, deployment skipped. Superseded e02headCI42440119415 cancelled after additional evidence. No Labs integration, approval, merge, release or installation; the original independent result is now preserved in cumulative#1279, with new composition validation reported separately.
Fixed source answers, full recipes and limits. Head996e073de; runtime merge4e684e491 preserves original#1273 and#1277. Local410/410, extracted74/74 (zero skips); canonical package63pass/2environment skips. Actual#1273 frozen Rust replay0correct/3missed/2unknown → composition3correct/0missed/same2unknown. Source/ZIP96CLIcommands per distribution,32rawcaptures,63questionpayloads and170module files agree. Partial/stale evidence exits1 and missingRusttoolchain exit2 remain visible. Current schema/readers retain all6language scopes and historical captures without rebinding. Final-head CI42442200073 succeeded at996e073de; actual analysis job128613639512 executed410/410/0skip. Local/package evidence remains separate. No Labs integration, approval, merge, release or installation.