sqc 0.4.84 - Docs.rs

SQLite format 3@  ��>M�.v�
�'
J
�
!��
�
l���m�)tabletasks_newtasks_newtCREATE TABLE tasks_new (
            id           INTEGER PRIMARY KEY AUTOINCREMENT,
            title        TEXT NOT NULL,
            details      TEXT,
            status       TEXT NOT NULL CHECK(status IN ('pending','partial','in-progress','done','rejected')),
            priority     INTEGER NOT NULL DEFAULT 3 CHECK(priority BETWEEN 1 AND 5),
            created_at   TEXT NOT NULL,
            started_at   TEXT,
            complete�k�c�%tabletaskstaskstCREATE TABLE "tasks" (
            id           INTEGER PRIMARY KEY AUTOINCREMENT,
            title        TEXT NOT NULL,
            details      TEXT,
            status       TEXT NOT NULL CHECK(status IN ('pending','partial','in-progress','done','rejected')),
            priority     INTEGER NOT NULL DEFAULT 3 CHECK(priority BETWEEN 1 AND 5),
            created_at   TEXT NOT NULL,
            started_at   TEXT,
            completed_at TEXT
        )Z3{indexidx_deps_depends_ondepsCREATE INDEX idx_deps_depends_on ON deps(depends_on_id)B
%Yindexidx_tags_tagtagsCREATE INDEX idx_tags_tag ON tags(tag)x?�'indexidx_tasks_status_prioritytasksCREATE INDEX idx_tasks_status_priority ON tasks(status, priority, created_at)^�tablemetametaCREATE TABLE meta (
    key   TEXT PRIMARY KEY,
    value TEXT NOT NULL
)';indexsqlite_autoindex_meta_1meta	��tabledepsdepsCREATE TABLE deps (
    task_id       INTEGER NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
    depends_on_id INTEGER NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
    PRIMARY KEY (task_id, depends_on_id),
    CHECK (task_id <> depends_on_id)
)';indexsqlite_autoindex_deps_1deps�)�5tabletagstagsCREATE TABLE tags (
    task_id INTEGER NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
    tag     TEXT NOT NULL,
    PRIMARY KEY (task_id, tag)
)';indexsqlite_autoindex_tags_1tagsyP++Ytablesqlite_sequencesqlite_sequenceCREATE TABLE sqlite_sequence(name,seq)��gtabletaskstasksCREATE TABLE tasks (
    id           INTEGER PRIMARY KEY AUTOINCREMENT,
    title        TEXT NOT NULL,
    details      TEXT,
    status       TEXT NOT NULL CHECK(status IN ('pending','in-progress','done')),
    priority     INTEGER NOT NULL DEFAULT 3 CHECK(priority BETWEEN 1 AND 5),
    created_at   TEXT NOT NULL,
    started_at   TEXT,
    completed_at TEXT
)���aA!����aA!
�
�
�
�
a
A
!
����aA!����aA!
�
�
�
|
[
:
	�	�	�	�	t	S	2	����lK*	����dC"���_?����_?����_?����_?����_?����_?�� 5done2026-04-20T16:58:08Z>5done2026-04-20T16:58:08Z=5done2026-04-20T16:58:08Z<5done2026-04-20T16:58:08Z;5done2026-04-20T16:58:08Z:5done2026-04-20T16:58:08Z95done2026-04-20T16:58:08Z85done2026-04-20T16:58:08Z75done2026-04-20T16:58:08Z65done2026-04-20T16:58:08Z55done2026-04-20T16:58:08Z45done2026-04-20T16:58:08Z35done2026-04-20T16:58:08Z25done2026-04-20T16:58:08Z15done2026-04-20T16:58:08Z05done2026-04-20T16:58:08Z/5done2026-04-20T16:58:08Z.5done2026-04-20T16:58:08Z-5done2026-04-20T16:58:08Z,5done2026-04-20T16:58:08Z+5done2026-04-20T16:58:08Z*5done2026-04-20T16:58:08Z)5done2026-04-20T16:58:08Z(5done2026-04-20T16:58:08Z'5done2026-04-20T16:58:08Z&5done2026-04-20T16:58:08Z%5done2026-04-20T16:58:08Z$5done2026-04-20T16:58:08Z#5done2026-04-20T16:58:08Z"5done2026-04-20T16:58:08Z!5done2026-04-20T16:58:08Z 5done2026-04-20T16:58:08Z5done2026-04-20T16:58:08Z5done2026-04-20T16:58:08Z5done2026-04-20T16:58:08Z5done2026-04-20T16:58:08Z5done2026-04-20T16:58:08Z5done2026-04-20T16:58:08Z5done2026-04-20T16:58:08Z5done2026-04-20T16:45:55Z5done2026-04-20T16:45:55Z5done2026-04-20T16:45:55Z5done2026-04-20T16:45:55Z5done2026-04-20T16:45:55Z5done2026-04-20T16:45:55Z5done2026-04-20T16:45:55Z 5done2026-06-25T12:27:56Z� 5done2026-06-23T23:38:11Z� 5done2026-06-23T22:01:25Z� 5done2026-06-23T19:59:40Z� 5done2026-06-23T19:36:21Z� 5done2026-06-23T19:03:04Z� 5done2026-06-23T19:03:04Z� 5done2026-06-22T22:36:44Z� 5done2026-06-19T12:48:23Z� 5done2026-06-18T20:57:13Z� 5done2026-06-18T15:43:55Z� 5done2026-06-17T23:25:03Z� 5done2026-06-17T13:56:19Z� 5done2026-06-16T13:25:06Z� 5done2026-06-16T12:35:56Z� 5done2026-06-16T12:35:56Z� 5done2026-06-15T13:57:22Z� 5done2026-06-14T22:20:35Z� 5done2026-06-12T12:16:27Z� 5done2026-06-12T00:10:41Z� 5done2026-06-11T23:33:02Z� 5done2026-06-11T17:58:10Z� 5done2026-06-10T12:32:58Z� 5done2026-06-10T03:51:31Z� 5done2026-06-10T03:51:31Z� 5done2026-06-10T03:51:31Z� 5done2026-06-09T21:46:07Z� 5done2026-05-17T15:29:05Z� 5done2026-05-07T18:45:33Z� 5done2026-05-07T18:45:32Z� 5done2026-05-07T18:45:29Z� 5done2026-05-07T18:45:26Z� 5done2026-05-07T18:45:24Z� 5done2026-05-07T18:45:22Z�5done2026-04-30T15:41:49Zu5done2026-04-30T15:41:33Zt5done2026-04-30T15:41:33Zs5done2026-04-23T13:56:29Zo5done2026-04-20T16:45:55Z5done2026-04-20T16:45:55Z5done2026-04-20T16:45:55Z5done2026-04-20T16:45:55Z5done2026-04-20T16:45:55Z
5done2026-04-20T16:45:55Z	5done2026-06-25T14:12:38Z�	5done2026-06-25T14:12:22Z�	5done2026-06-25T14:12:22Z�	5done2026-06-25T14:12:22Z�	5done2026-06-25T14:12:22Z�	5done2026-06-25T14:12:22Z�	5done2026-06-25T14:12:22Z�	5done2026-06-25T14:12:22Z�	5done2026-06-25T14:12:22Z�	5done2026-06-25T14:12:22Z�	5done2026-06-25T14:12:22Z�	5done2026-06-18T13:55:07Z�	5done2026-06-14T22:19:35Z�	5done2026-06-14T22:19:35Z�	5done2026-06-14T22:19:35Z�	5done2026-06-14T22:19:35Z�	5done2026-06-14T22:19:35Z�	5done2026-06-11T20:04:31Z�	5done2026-06-11T13:34:58Z�	5done2026-06-11T12:22:56Z�	5done2026-06-10T12:32:44Z�	5done2026-06-10T12:32:35Z�	5done2026-05-17T15:29:05Z�	5done2026-05-17T15:29:05Z�	5done2026-05-17T15:29:05Z�	5done2026-05-17T15:29:05Z�	5done2026-05-0
 5done2026-06-16T19:54:42Z�
5done2026-04-20T16:45:55Z
���tasks_new�
tasks+�q������zjZJ:*
��������zj]PE8- 
�
�
�
�
�
�
�
�
�
�
�
v
i
^
S
F
9
.
!

	�����������xmbUH=0#�����������wj]RE8- 
�
�
�
�
�
�
�
�
�
�

t
g
Z
O
B
7
*


	�	�	�	�	�	�	�	�	�	�	z	l	^	P	B	6	(			���������zn`RF8*���������xj\N@2$
����������tfXJ<."����������rfXJ<0"����������vh\N@4&
����������tfVH:,��������~n`RD4&�
Zchanged
�	Zbenchmark�Zv0.3.82�Zrelease�Ychanged
�Ybenchmark�Yv0.3.81�Yrelease�Xchanged
�Xbenchmark�Xv0.3.80�Xrelease�~Wchanged
�}Wbenchmark�|Wv0.3.79�{Wrelease�zVchanged
�yVbenchmark�xVv0.3.78�wVrelease�vUchanged
�uUbenchmark�tUv0.3.77�sUrelease�rTchanged
�qTbenchmark�pTv0.3.76�oTrelease	�nSadded�mSv0.3.75�lSrelease�kRresults	�jRfixed	�iRadded�hRv0.3.74�gRrelease�fQresults	�eQfixed�dQv0.3.67�cQrelease	�bPadded�aPv0.3.66�`Prelease	�_Ofixed�^Ov0.3.65�]Orelease	�\Nadded�[Nv0.3.64�ZNrelease	�YMfixed	�XMadded�WMv0.3.63�VMrelease	�ULfixed�TLv0.3.62�SLrelease	�RKadded�QKv0.3.61�PKrelease�OJresults	�NJadded�MJv0.3.60�LJrelease�KIresults	�JIadded�IIv0.3.59�HIrelease�GHresults	�FHadded�EHv0.3.58�DHrelease	�CGfixed�BGv0.3.57�AGrelease	�@Fadded�?Fv0.3.56�>Frelease�=Eresults�<Echanged�;Ev0.3.52�:Erelease	�9Dadded�8Dv0.3.51�7Drelease�6Cchanged�5Cv0.3.50�4Crelease�3Bchanged�2Bv0.3.49�1Brelease	�0Afixed�/Achanged	�.Aadded�-Av0.3.48�,Arelease�+@results�*@changed�)@v0.3.47�(@release�'?results�&?changed�%?v0.3.46�$?release�#>results�">changed�!>v0.3.44� >release	�=added�=v0.3.43�=release	�<fixed�<changed�<v0.3.42�<release	�;fixed�;v0.3.39�;release	�:fixed�:changed�:v0.3.38�:release	�9fixed�9v0.3.37�9release	�8added�
8v0.3.36�8release	�7fixed�
7changed	�	7added�7v0.3.35�7release	�6fixed�6v0.3.34�6release�5removed�5changed�5v0.3.33�5release	4fixed~4v0.3.32}4release	|3fixed{3v0.3.31z3release	y2fixedx2v0.3.30w2releasev1changed	u1addedt1v0.3.28s1release	r0fixedq0changed	p0addedo0v0.3.27n0release	m/fixedl/v0.3.26k/release	j.fixed	i.addedh.v0.3.25g.releasef-changed	e-addedd-v0.3.24c-releaseb,changed	a,added`,v0.3.23_,release	^+fixed]+v0.3.22\+release	[*addedZ*v0.3.21Y*releaseX)changedW)v0.3.20V)release	U(fixedT(v0.3.19S(release	R'fixed	Q'addedP'v0.3.18O'release	N&addedM&v0.3.17L&release	K%addedJ%v0.3.15I%release	H$fixedG$v0.3.14F$release	E#fixed	D#addedC#v0.3.13B#release	A"fixed	@"added
?"v0.3.8>"release	=!added
<!v0.3.5;!release	: fixed
9 v0.3.38 release	7fixed6v0.2.255release	4fixed3v0.2.222release	1fixed	0added/v0.2.21.release	-fixed	,added+v0.2.20*release	)fixed(v0.2.17'release	&added%v0.2.16$release	#fixed	"added!v0.2.15 release	fixedchanged	addedv0.2.13release!plan-id:71!plan-id:70!plan-id:69!plan-id:68!plan-id:67!plan-id:66!plan-id:65!plan-id:64!plan-id:63!plan-id:62!
plan-id:61!plan-id:60!plan-id:59
!
plan-id:53!	plan-id:51!plan-id:49
!plan-id:47	!plan-id:37!plan-id:27!plan-id:20deferred!plan-id:10deferred
plan-id:9	defe"�*�X)�
�s������raP?.��������sbQ)C5
�
�
�
�
�
�
�
�
�
c
W
}
o
/
#
I
;�

���������^Rwj*D6�������~r��JdV <.
�
�
�
�
�
�
�
�
r
d
�
~
<
0
V
H

"
	�	�	�	�	�	�	�	�	�	h	�	t	@	Z	L		2	$�		������wj��?[L0!�������u��JfW;,��������k\O�x"@1��������cp8TE
)���������_{l4PA	�%������{��PlA]	2�#�������bS�s$D5Wrelease�Vchanged�Vbenchmark�Vv0.3.78�Vrelease�Uchanged�Ubenchmark�Uv0.3.77�Urelease�Tchanged�Tbenchmark�Tv0.3.76�Trelease�Sadded�Sv0.3.75�Srelease�Rresults�Rfixed�Radded�Rv0.3.74�Rrelease�Qresults�Qfixed�Qv0.3.67�Qrelease�Padded�Pv0.3.66�Prelease�Ofixed�Ov0.3.65�Orelease�Nadded�Nv0.3.64�Nrelease�Mfixed�Madded�Mv0.3.63�Mrelease�Lfixed�Lv0.3.62�Lrelease�Kadded�Kv0.3.61�Krelease�Jresults�Jadded�Jv0.3.60�Jrelease�Iresults�Iadded�Iv0.3.59�Irelease�Hresults�Hadded�Hv0.3.58�Hrelease�Gfixed�Gv0.3.57�Grelease�Fadded�Fv0.3.56�Frelease�Eresults�Echanged�Ev0.3.52�Erelease�Dadded�Dv0.3.51�Drelease�Cchanged�Cv0.3.50�Crelease�Bchanged�Bv0.3.49�Brelease�Afixed�Achanged�Aadded�Av0.3.48�Arelease�@results�@changed�@v0.3.47�@release�?results�?changed�?v0.3.46�?release�>results�>changed�>v0.3.44�>release�=added�=v0.3.43�=release�<fixed�<changed�<v0.3.42�<release�;fixed�;v0.3.39�;release�:fixed�:changed�:v0.3.38�:release�9fixed�9v0.3.37�9release�8added�8v0.3.36�8release�7fixed�7changed�7added�7v0.3.35�7release�6fixed�6v0.3.34�6release�5removed�5changed�5v0.3.33�5release�4fixed
4v0.3.32~
4release}3fixed|
3v0.3.31{
3releasez2fixedy
2v0.3.30x
2releasew
1changedv1addedu
1v0.3.28t
1releases0fixedr
0changedq0addedp
0v0.3.27o
0releasen/fixedm
/v0.3.26l
/releasek.fixedj.addedi
.v0.3.25h
.releaseg
-changedf-addede
-v0.3.24d
-releasec
,changedb,addeda
,v0.3.23`
,release_+fixed^
+v0.3.22]
+release\*added[
*v0.3.21Z
*releaseY
)changedX
)v0.3.20W
)releaseV(fixedU
(v0.3.19T
(releaseS'fixedR'addedQ
'v0.3.18P
'releaseO&addedN
&v0.3.17M
&releaseL%addedK
%v0.3.15J
%releaseI$fixedH
$v0.3.14G
$releaseF#fixedE#addedD
#v0.3.13C
#releaseB"fixedA"added@"v0.3.8?
"release>!added=!v0.3.5<
!release; fixed: v0.3.39
 release8fixed7
v0.2.256
release5fixed4
v0.2.223
release2fixed1added0
v0.2.21/
release.fixed-added,
v0.2.20+
release*fixed)
v0.2.17(
release'added&
v0.2.16%
release$fixed#added"
v0.2.15!
release fixed
changedadded
v0.2.13
release!plan-id:71!plan-id:70!plan-id:69!plan-id:68!plan-id:67!plan-id:66!plan-id:65!plan-id:64!plan-id:63!plan-id:62!
plan-id:61!plan-id:60!plan-id:59!
plan-id:53
!	plan-id:51!plan-id:49!plan-id:47
!plan-id:37	!plan-id:27!plan-id:20deferred!plan(%�fp-reduction$'�benchmark�&Ov0.3.65�
Z�����������������xof]TKB90'��������������|sjaXOF=4+"
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
w
n
e
\
S
J
A
8
/
&



���Z&Y%X$W#V"U!T SRQPONMLKJIHGFEDCBA
@
	?
>
=
<
;
:
9
8
7
6
�5��4��3��2��1��0��/��.��-��,��+��*��)��(��'��&��%��$��#��"��!�� ���������������������������������	�	�
������
��	����

	
Z�r�{�������������6,"h^TJ@�������������xndZPF<2(

�
�
�
�
�
�
�
�
�
�
�
�
~
t
j
`
V
L
B
8
.
$


������������	&Z	%Y	$X	#W	"V	!U	 T	S	R	Q	P	O	N	M	L	K	J	I	H	G	F	E	D	C	B	
A	
	@	
?	
>	
=	
<	
;	
:	
9	
8	
7	
�6	��5	��4	��3	��2	��1	��0	��/	��.	��-	��,	��+	��*	��)	��(	��'	��&	��%	��$	��#	��"	��!	�� 	��	��	��	��	��	��	��	��	��	��	��	��	��	��	���	�	�	��
	��	��	��
	��		��

		
��)schema_version3
��)	schema_version
n����aA!����aA!
�
�
�
�
a
A
!
����a[A!����aA!
�
�
�
|
[
:
	�	�	�	��	t	S	2	�����lK*	����dC"��:��zY8����rQ0����jI(���{�_?�����_?�� 5do 5done2026-07-05T22:07:22Z" 5done2026-07-05T22:07:22Z! 5done2026-07-05T22:07:22Z  5done2026-07-05T22:07:22Z 5done2026-07-05T22:07:22Z 5done2026-07-05T22:07:22Z 5done2026-07-05T22:07:22Z 5done2026-07-05T22:07:21Z 5done2026-07-05T22:07:21Z 5done2026-07-05T22:07:21Z 5done2026-07-05T22:07:21Z 5done2026-07-05T22:07:21Z 5done2026-07-05T22:07:21Z 5done2026-07-05T22:07:21Z 5done2026-07-05T22:07:21Z 5done2026-07-05T22:07:21Z 5done2026-07-05T22:07:21Z 5done2026-07-05T22:07:21Z 5done2026-07-05T22:07:21Z 5done2026-07-05T22:07:21Z 5done2026-07-05T22:07:21Z 5done2026-07-05T22:07:21Z
 5done2026-06-16T12:42:51Z� 5done2026-06-10T20:17:54Z��5done2026-04-20T16:58:08Z%5done2026-04-20T16:58:08Z$5done2026-04-20T16:58:08Z#5done2026-04-20T16:58:08Z"5done2026-04-20T16:58:08Z!5done2026-04-20T16:58:08Z 5done2026-04-20T16:58:08Z5done2026-04-20T16:5 5done2026-06-18T23:47:25Z� 5done2026-07-03T19:55:27Z�	5done2026-07-05T22:06:58Z 5done2026-07-05T22:07:22Z& 5done2026-07-05T22:07:22Z% 5done2026-07-05T22:07:22Z$ 5done2026-07-05T22:07:22Z#5done2026-04-20T16:45:55Z5done2026-04-20T16:45:55Z5done2026-04-20T16:45:55Z5done2026-04-20T16:45:55Z5done2026-04-20T16:45:55Z5done2026-04-20T16:45:55Z 5done2026-06-25T12:27:56Z� 5done2026-06-23T23:38:11Z� 5done2026-06-23T22:01:25Z� 5done2026-06-23T19:59:40Z� 5done2026-06-23T19:36:21Z� 5done2026-06-23T19:03:04Z� 5done2026-06-23T19:03:04Z� 5done2026-06-22T22:36:44Z� 5done2026-06-19T12:48:23Z� 5done2026-06-18T20:57:13Z� 5done2026-06-18T15:43:55Z� 5done2026-06-17T23:25:03Z� 5done2026-06-17T13:56:19Z� 5done2026-06-16T13:25:06Z� 5done2026-06-16T12:35:56Z� 5done2026-06-16T12:35:56Z� 5done2026-06-15T13:57:22Z� 5done2026-06-14T22:20:35Z� 5done2026-06-12T12:16:27Z� 5done2026-06-12T00:10:41Z� 5done2026-06-11T23:33:02Z� 5done2026-06-11T17:58:10Z� 5done2026-06-10T12:32:58Z� 5done2026-06-10T03:51:31Z� 5done2026-06-10T03:51:31Z� 5done2026-06-10T03:51:31Z� 5done2026-06-09T21:46:07Z� 5done2026-05-17T15:29:05Z� 5done2026-05-07T18:45:33Z� 5done2026-05-07T18:45:32Z� 5done2026-05-07T18:45:29Z� 5done2026-05-07T18:45:26Z� 5done2026-05-07T18:45:24Z� 5done2026-05-07T18:45:22Z�5done2026-04-30T15:41:49Zu5done2026-04-30T15:41:33Zt5done2026-04-30T15:41:33Zs5done2026-04-23T13:56:29Zo5done2026-04-20T16:45:55Z5done2026-04-20T16:45:55Z5done2026-04-20T16:45:55Z5done2026-04-20T16:45:55Z5done2026-04-20T16:45:55Z
5done2026-04-20T16:45:55Z	5done2026-06-25T14:12:38Z�	5done2026-06-25T14:12:22Z�	5done2026-06-25T14:12:22Z�	5done2026-06-25T14:12:22Z�	5done2026-06-25T14:12:22Z�	5done2026-06-25T14:12:22Z�	5done2026-06-25T14:12:22Z�	5done2026-06-25T14:12:22Z�	5done2026-06-25T14:12:22Z�	5done2026-06-25T14:12:22Z�	5done2026-06-25T14:12:22Z�	5done2026-06-18T13:55:07Z�	5done2026-06-14T22:19:35Z�	5done2026-06-14T22:19:35Z�	5done2026-06-14T22:19:35Z�	5done2026-06-14T22:19:35Z�	5done2026-06-14T22:19:35Z�	5done2026-06-11T20:04:31Z�	5done2026-06-11T13:34:58Z�	5done2026-06-11T12:22:56Z�	5done2026-06-10T12:32:44Z�	5done2026-06-10T12:32:35Z�	5done2026-05-17T15:29:05Z�	5done2026-05-17T15:29:05Z�	5done2026-05-17T15:29:05Z�	5done2026-05-17T15:29:05Z�	5done2026-05-07T18:45:18Z�	5done2026-05-07T18:45:17Z�	5done2026-05-07T18:45:15Z�4������b@�h:
�
�	�	Y��:��e3��=��_�J��r<�U�\.
�
z	�	�	
�_+���_s=��e/���R���K
�
�
�
a
?
�����
�
�
X
6
	�	~	4	������b�����sdUF7(
�����������w?
�
�
�
w
U
3
���xV4���~P"
�
�
�
n
L
*
	�	�	q	L	'���yE��yR-���}K���zU0���f0���X"���wE	�R��X&�k3
�
�
�
k
I��lJ(����rD
�
�
�
(
b
@
	�	�	�	d	?	���l8��
lE ���p>���mH#���Y#����K���jreleasechanged
addedv0.3.87releasechangedbenchmarkv0.3.86releasechangedv0.3.85releasechangedv0.3.84releasechanged
v0.3.83releasechanged
benchmark	v0.3.82releasechangedbenchmarkv0.3.81releasechangedbenchmarkv0.3.80release�changed�benchmark�v0.3.79�release�changed�benchmark�v0.3.78�release�changed�benchmark�v0.3.77�release�changed�benchmark�v0.3.76�release�
added�v0.3.75�release�results�
fixed�
added�v0.3.74�release�results�
fixed�v0.3.67�release�
added�v0.3.66�release�
fixed�v0.3.65�release�
added�v0.3.64�release�
fixed�
added�v0.3.63�release�
fixed�v0.3.62�release�
added�v0.3.61�release�results�
added�v0.3.60�release�results�
added�v0.3.59�release�results�
added�v0.3.58�release�
fixed�v0.3.57�release�
added�v0.3.56�release�results�changed�v0.3.52�release�
added�v0.3.51�release�changed�v0.3.50�release�changed�v0.3.49�release�
fixed�changed�
added�v0.3.48�release�results�changed�v0.3.47�release�results�changed�v0.3.46�release�results�changed�v0.3.44�release�
added�v0.3.43�release�
fixed�changed�v0.3.42�release�
fixed�v0.3.39�release�
fixed�changed�v0.3.38�release�
fixed�v0.3.37�release�
added�v0.3.36�release�
fixed�changed�
added�v0.3.35�release�
fixed�v0.3.34�release�removed�changed�v0.3.33�release�	fixedv0.3.32~release}	fixed|v0.3.31{releasez	fixedyv0.3.30xreleasewchangedv	addeduv0.3.28treleases	fixedrchangedq	addedpv0.3.27oreleasen	fixedmv0.3.26lreleasek	fixedj	addediv0.3.25hreleasegchangedf	addedev0.3.24dreleasecchangedb	addedav0.3.23`release_	fixed^v0.3.22]release\	added[v0.3.21ZreleaseYchangedXv0.3.20WreleaseV	fixedUv0.3.19TreleaseS	fixedR	addedQv0.3.18PreleaseO	addedNv0.3.17MreleaseL	addedKv0.3.15JreleaseI	fixedHv0.3.14GreleaseF	fixedE	addedDv0.3.13CreleaseB	fixedA	added@
v0.3.8?release>	added=
v0.3.5<release;	fixed:
v0.3.39release8	fixed7v0.2.256release5	fixed4v0.2.223release2	fixed1	added0v0.2.21/release.	fixed-	added,v0.2.20+release*	fixed)v0.2.17(release'	added&v0.2.16%release$	fixed#	added"v0.2.15!release 	fixedchanged	addedv0.2.13release!plan-id:71!plan-id:70!plan-id:69!plan-id:68!plan-id:67!plan-id:66!plan-id:65!plan-id:64!plan-id:63!plan-id:62!plan-id:61!plan-id:60!plan-id:59!plan-id:53
!plan-id:51!plan-id:49!plan-id:47
!plan-id:37	!plan-id:27!plan-id:20defer.7sqlite-audit-followup�-realworld�,%fp-reduction
Z
��������������������!��|ung`��YRKD/=6(���������������yrkd]VOHA:3,%	
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�&Z%Y$X#W"V!U TSRQPONMLKJIHGFEDCB
A	@?>=<;:987�6�5�4�3�2�1�0�/�.�-�,�+�*�)�(�'�&�%�$�#�"�!� �������������������
���
�	�	
i���v6����vV6��V6����vV6����vV6����vV����`@ ����`@ 
�
�
�
�
`
@
 
����`@ ����`@ 
�
�
�
�
`
@
 
	�	�	�	�	`	@	 	���~]<��kG#����oK'#5pending2026#5pending2026-06-17T03:42:18Z�#5pending2026-06-16T19:40:54Z�#5pending2026-06-16T12:32:34Z�#5pending2026-06-16T12:32:34Z�#5pending2026-06-16T12:32:15Z�#5pending2026-06-14T22:20:35Z�#5pending2026-06-14T22:20:35Z�#5pending2026-06-12T14:54:42Z�#5pending2026-06-12T02:10:48Z�#5pending2026-06-11T17:58:10Z�#5pending2026-06-10T12:32:58Z�#5pending2026-06-10T03:51:31Z�#5pending2026-05-07T18:45:40Z5done2026-04-20T16:58:08Z&5done2026-04-20T16:58:08Z%5done2026-04-20T16:58:08Z$5done2026-04-20T16:58:08Z#5done2026-04-20T16:58:08Z"5done2026-04-20T16:58:08Z!5done2026-04-20T16:58:08Z 5done2026-04-20T16:58:08Z5done2026-04-20T16:58:08Z5done2026-04-20T16:58:08Z5done2026-04-20T16:58:08Z5done2026-04-20T16:58:08Z5done2026-04-20T16:58:08Z?5done2026-04-20T16:58:08Z>5done2026-04-20T16:58:08Z=5done2026-04-20T16:58:08Z<5done2026-04-20T16:58:08Z;5done2026-04-20T16:58:08Z:5done2026-04-20T16:58:08Z95done2026-04-20T16:58:08Z85done2026-04-20T16:58:08Z75done2026-04-20T16:58:08Z65done2026-04-20T16:58:08Z55done2026-04-20T16:58:08Z45done2026-04-20T16:58:08Z35done2026-04-20T16:58:08Z25done2026-04-20T16:58:08Z15done2026-04-20T16:58:08Z05done2026-04-20T16:58:08Z/5done2026-04-20T16:58:08Z.5done2026-04-20T16:58:08Z-5done2026-04-20T16:58:08Z,5done2026-04-20T16:58:08Z+5done2026-04-20T16:58:08Z*5done2026-04-20T16:58:08Z)5done2026-04-20T16:58:08Z(5done2026-04-20T16:58:08Z'5done2026-04-20T16:58:08Z� 5done2026-04-20T16:58:08Z5done2026-04-20T16:58:08Z 5done2026-06-16T17:51:33Z� 5done2026-06-16T13:25:06Z� 5done2026-06-16T13:25:06Z� 5done2026-06-11T20:39:48Z� 5done2026-06-11T17:58:10Z� 5done2026-06-11T17:36:17Z� 5done2026-05-07T18:45:37Z�5done2026-04-30T15:42:09Z~5done2026-04-30T15:42:09Z}5done2026-04-30T15:42:09Z|5done2026-04-30T15:42:09Z{5done2026-04-30T15:42:09Zz5done2026-04-30T15:42:09Zy5done2026-04-30T15:41:49Zx5done2026-04-30T15:41:49Zw5done2026-04-30T11:20:20Zr5done2026-04-28T18:59:56Zq5done2026-04-23T17:44:45Zp5done2026-04-22T19:22:42Zn5done2026-04-22T19:22:38Zm5done2026-04-20T17:24:37Zl5done2026-04-20T16:58:09Zk5done2026-04-20T16:58:09Zj5done2026-04-20T16:58:09Zi5done2026-04-20T16:58:09Zh5done2026-04-20T16:58:09Zg5done2026-04-20T16:58:09Zf5done2026-04-20T16:58:09Ze5done2026-04-20T16:58:09Zd5done2026-04-20T16:58:09Zc5done2026-04-20T16:58:09Zb5done2026-04-20T16:58:09Za5done2026-04-20T16:58:09Z`5done2026-04-20T16:58:09Z_5done2026-04-20T16:58:09Z^5done2026-04-20T16:58:09Z]5done2026-04-20T16:58:09Z\5done2026-04-20T16:58:09Z[5done2026-04-20T16:58:08ZZ5done2026-04-20T16:58:08ZY5done2026-04-20T16:58:08ZX5done2026-04-20T16:58:08ZW5done2026-04-20T16:58:08ZV5done2026-04-20T16:58:08ZU5done2026-04-20T16:58:08ZT5done2026-04-20T16:58:08ZS5done2026-04-20T16:58:08ZR5done2026-04-20T16:58:08ZQ5done2026-04-20T16:58:08ZP5done2026-04-20T16:58:08ZO5done2026-04-20T16:58:08ZN5done2026-04-20T16:58:08ZM5done2026-04-20T16:58:08ZL5done2026-04-20T16:58:08ZK5done2026-04-20T16:58:08ZJ5done2026-04-20T16:58:08ZI5done2026-04-20T16:58:08ZH5done2026-04-20T16:58:08ZG5done2026-04-20T16:58:08ZF5done2026-04-20T16:58:08ZE5done2026-04-20T16:58:08ZD5done2026-04-20T16:58:08ZC5done2026-04-20T16:58:08ZB5done2026-04-20T16:58:08ZA5done2026-04-20T16:58:08Z@
�R�!U
4
�
|
[
:
����tS2K*��rN
���v�����oN-�
�
�
}
Y
5	�	�	�	�	c	@	����hD ����l���p(�
��*��uQ-	
�L����������������������'#5in-progress2026-07-05T22:07:21Z
#5pending2026-07-05T22:07:22Z&!5pending2026-07-05T22:07:22Z%�5pending2026-07-05T22:07:22Z$�5pending2026-07-05T22:07:22Z#5pending2026-07-05T22:07:22Z"�5pending2026-07-05T22:07:22Z!�5pending2026-07-05T22:07:22Z �5pending2026-07-05T22:07:22Z�5pending2026-07-05T22:07:22Zd5pending2026-07-05T22:07:22Z@5pending2026-07-05T22:07:22Z5pending2026-07-05T22:07:21Z�5pending2026-07-05T22:07:21Z�5pending2026-07-05T22:07:21Z�5pending2026-07-05T22:07:21Z�5pending2026-07-05T22:07:21Zh5pending2026-07-05T22:07:21ZD5pending2026-07-05T22:07:21Z#5pending2026-07-05T22:07:21Z�5pending2026-07-05T22:07:21Z�5pending2026-07-05T22:07:21Z�5#5pending2026-07-06T21:06:38Z+5i 5done2026-07-06T19:37:36Z) 5done2026-06-20T16:10:35Z� 5done2026-06-19T12:48:23Z� 5done2026-06-17T03:42:18Z� 5done2026-07-04T00:31:26ZZ 5done2026-07-03T21:51:27Z	Z	 5done2026-07-03T21:51:27ZZ 5done2026-07-03T21:35:16ZZ 5done2026-07-03T21:35:16ZZ#5pending2026-07-06T13:54:11Z' 5done2026-07-03T21:14:17ZZ 5done2026-07-03T21:14:17ZZ 5done2026-07-03T20:25:05ZZ 5done2026-07-03T20:25:05ZZ#5pending2026-07-03T20:25:05Z
�#5pending2026-07-03T22:03:34Z
 5done2026-07-02T16:18:55Z� 5done2026-07-02T02:21:30Z�#5pending2026-06-17T03:42:18Z�#5pending2026-06-16T19:40:54Z�#5pending2026-06-16T12:32:34Z�#5pending2026-06-16T12:32:34Z�#5pending2026-06-16T12:32:15Z�#5pending2026-06-14T22:20:35Z�#5pending2026-06-14T22:20:35Z�#5pending2026-06-12T14:54:42Z�#5pending2026-06-12T02:10:48Z�#5pending2026-06-11T17:58:10Z�#5pending2026-06-10T12:32:58Z�#5pending2026-06-10T03:51:31Z�#5pending2026-05-07T18:45:40Z�"5pending2026-04-30T15:41:49Zv"5pending2026-04-20T16:45:55Z	"5pending2026-04-20T16:45:55Z"5pending2026-04-20T16:45:55Z"5pending2026-04-20T16:45:55Z!5	pending2026-04-20T16:45:55Z 5done2026-06-19T00:13:22Z�Z�#5pending2026-06-18T15:24:18Z�#5pending2026-06-17T22:04:55Z�#5pending2026-06-16T12:55:45Z�"	5pending2026-07-06T17:16:30Z( 5done2026-07-03T21:14:17Z"5partial2026-04-20T16:45:55Z 5done2026-06-16T20:13:12Z� 5done2026-06-24T23:08:26Z� 5done2026-06-21T23:44:21Z� 5done2026-06-21T23:44:17Z� 5done2026-06-18T03:07:00Z�5done2026-04-20T16:45:55Z5done2026-04-20T16:45:55Z5done2026-04-20T16:45:55Z
 5done2026-06-26T21:03:36Z� 5done2026-06-23T21:36:35Z� 5done2026-06-23T19:03:04Z� 5done2026-06-23T16:36:27Z� 5done2026-06-23T15:17:27Z� 5done2026-06-22T22:36:44Z� 5done2026-06-22T22:36:25Z� 5done2026-06-22T22:36:25Z� 5done2026-06-22T22:36:25Z� 5done2026-06-22T13:33:13Z� 5done2026-06-21T20:27:57Z� 5done2026-06-21T01:49:14Z�#5pending2026-07-02T02:21:30Z� 5done2026-06-20T22:54:48Z�Z�#5pending2026-06-21T18:20:06Z�#5pending2026-06-17T23:44:15Z�#5pending2026-06-16T17:51:33Z�#5pending2026-06-16T13:25:06Z�#5pending2026-06-16T12:32:34Z�#5pending2026-06-10T12:32:58Z�"5pending2026-04-20T16:45:55Z#5pending2026-06-25T13:58:19Z�#5pending2026-06-23T22:27:29Z�#5pending2026-06-21T19:53:49Z�#5pending2026-07-06T20:25:35Z*#5pending2026-06-18T19:31:16Z�#5pending2026-06-18T13:55:07Z�#5pending2026-06-18T12:28:51Z�#5pending2026-06-17T13:53:48Z�
M
M��C�J�_�+	555Surface benchmark timing as a tracked metric (compare_runs + run-level duration + prescan/analysis split)LOCUS: bench/db.py (logic layer), NOT the MCP server. Timing is fully captured in the DB (runs.started_at/finished_at written by bench/runner.py:253/334; cwe_scans.duration_s written per-scan). The gap is that db.py never surfaces it:
- get_run_summary (bench/db.py ~558) copies started_at/finished_at into the summary but computes no wall-clock duration and does not aggregate SUM(cwe_scans.duration_s).
- compare_runs (bench/db.py:680) builds the delta dict (tp/fp/total/rate) and never references timing, though both summaries already hold the timestamps.
mcp_servers/server.py:compare_runs (~1562) and bench/__main__.py are thin formatters over db.compare_runs — fixing db.py surfaces timing in BOTH the MCP tool and the CLI for free.
Proposed: (a) get_run_summary returns wall_s (finished-started) and analysis_s (SUM cwe_scans.duration_s); the gap approximates prescan/overhead; (b) compare_runs adds a timing block with base/target/delta; (c) update MCP + CLI formatters to print it. Per-CWE timing already comparable via cwe_scans.duration_s (used to measure task 143's ~+4.5% on CWE-124/127). Optional: split prescan_s vs scan_s in runner.py for a true depth-vs-time axis.

PRIORITY/RATIONALE (promoted to P1 2026-06-18): performance is a first-class result for the paper, not just an ops concern — reviewers will expect sqc's scan-time characteristics (and the depth-vs-time tradeoff of FP-reduction work) reported alongside precision/recall. This gap resurfaces every FP-reduction task (e.g. 143 added prescan cost only visible via a manual per-CWE query), so making timing a tracked, comparable metric pays off repeatedly and feeds the paper's evaluation section.done2026-06-18T13:55:07Z2026-06-18T14:22:54Z2026-06-18T15:24:18Z�l�K��#5STR31-C cross-function FP follow-ups: function-pointer (44), static-global (45), control-flow (21/22), CWE-127 source-sideAfter task 143 (v0.4.44), CWE-121/122/124/127 STR31-C precision is 70.7% (FP 611->476, TP 1150 unchanged). The cross-function buffer-size propagation handles direct + forwarded parameter destinations (variants 41, 51-54). Remaining FP classes need separate handling:
- _44 function-pointer sinks: the sink is invoked via a funcptr (funcPtr=sink; funcPtr(data)), so the call is not name-resolvable in callsite_buf_args. Needs funcptr-assignment resolution.
- _45 static-global passing: the destination is a local assigned from a static global (data = g_global), not a function parameter, so callsite_param_buffer_size doesn't apply. Needs a global buffer-size summary (mirror of the param summary, keyed on global name + writer functions).
- _21/_22 control-flow: buffer chosen via if(staticTrue/goodB2G) branching; needs dead-branch-aware buffer selection in the caller's local buffer-size collection.
- CWE-127 source-side: the *parameter* is the strcpy SOURCE (strcpy(localdest, param)); suppression flips to caller_source_buffer <= dest_buffer. Mirror of the current dest-side analysis in check_strcpy_safety/check_strcat_safety.
All build on analyze/buffer_size + the prescan callsite_param_buffer_size infra from task 143.pending2026-06-18T13:55:07Z�x�I��#5FIO30-C: cross-TU + function-pointer format-string FPs (remaining 210)After task 142 (v0.4.43), CWE-134 precision is 88.7% with 210 FPs remaining, all from variants the per-file rule cannot resolve: cross-file b/c/d/e sink files (22b/51b/52c/53d/54e/65b, 30 each = 180) where the tainted-vs-literal caller lives in a sibling translation unit, and the function-pointer variant (44, 30) where the sink is invoked via a funcptr so the call is not name-resolvable. Each remaining variant carries a matching TP, so they are precision-neutral but block further FP reduction. Fixing requires cross-TU taint (whole-program/prescan call-graph across files) or function-pointer assignment resolution (funcPtr = sink; funcPtr(arg)).pending2026-06-18T12:28:51Zwin, DCL31 has 0 curl TPs); Juliet TP 21961->21961 (delta 0), FP 5494->5494 (delta 0) vs 0.4.34 baseline = no recall regression. 50 curl DCL31 FP remain (macros not collected even textually / non-curlx names) - optional follow-up. 2c-i COMPLETE.
PHASE 2c-ii IN FLIGHT (commit cc4b2240, v0.4.37): EXP33-C macro output-arg recognition. Root: CF_DATA_SAVE(save,cf,data) body assigns (save)= ; sqc saw save as uninit read at call site + downstream. Fix: macro_expand::macro_output_param_indices(table,name) expands w/ sentinels, reports params that are whole-object assignment targets (excludes p->f=/p[i]=/*p=/+=/==). Wired into InitAnalysisConfig.macro_output_params (transfer marks output args Initialized) + EXP33 read-checker skip (is_function_macro_output_arg) + per-file precompute for invoked macros only. Removed macro_expand allow(dead_code) (expander now consumed). Verified curl cf-h2-proxy.c save 9->0 (-d lib). +6 unit tests, cli_integration macro_out_param fixture, lib green 3366. GATES RUNNING: juliet sqc-0.4.37-cc4b2240 + realworld sqc-curl-0.4.37-cc4b2240 (reused prescan). ON RESUME: get_status; realworld-score curl for EXP33 FP delta; juliet compare 0.4.36->0.4.37 recall gate; then run mosquitto. NEXT: 2c-iii Curl_safefree->MEM30 (task 181).
2c-ii GATES PASSED (juliet sqc-0.4.37-cc4b2240; realworld curl rid48 + mosquitto rid49). Juliet recall: TP 21961->21961 (d0), FP 5494->5494 (d0) vs 0.4.36 = NO regression (Juliet has no function_macros table so macro_output_params empty = path inert). curl oracle EXP33-C FP 398->360 (-38 labeled, -58 raw), zero TP loss (EXP33 has 0 curl TPs). mosquitto oracle EXP33-C FP 60->57 (-3, disjoint root-cause macro, confirms engine not curl-overfit), zero TP loss. EXP34-C/ARR00-C unchanged in both (they don't use init_state; would need separate wiring = optional 2c-ii-b). NB: mosquitto auto-ingest skipped (shared version_dir already ingested by curl); manually ingested as rid49. 2c-ii COMPLETE.
PHASE 2c-iii IN FLIGHT (commit 714fd11c, v0.4.38): MEM30-C safe-free macro recognition. Root: Curl_safefree(p)=do{curlx_free(p);(p)=NULL;}while(0); MEM30 treats it as free (name contains FREE) but can't see the =NULL, so p stays dangling -> UAF/double-free FP on later access + 2nd safe-free. Fix: macro_expand::macro_nulls_param_indices(table,name) (sentinel-expand, detect whole-object =NULL/0 assignment; shares find_assignment_targets w/ 2c-ii). MEM30 now stateful (set_project_context like MEM31), precomputes safe-free macros invoked per file (guarded by non-empty table=0 cost on Juliet), clears arg freed-state after process_free_call (clear_freed_for_nulled_args, mirrors explicit p=NULL). Recall-safe: 2nd safe-free=free(NULL), read=null-deref(EXP34); plain double free(p) still flags (verified). VERIFIED curl url.c MEM30 287->161 (-44%). +5 unit tests, cli_integration safe_free_macro fixture, lib green 3371. GATES RUNNING: juliet sqc-0.4.38-714fd11c + realworld curl; mosquitto to follow (mosquitto_FREE is same idiom). ON RESUME: realworld-score curl MEM30 FP delta; juliet compare 0.4.37->0.4.38 recall gate (MEM30=CWE-416, real recall stakes).
2c-iii GATES PASSED (juliet sqc-0.4.38-714fd11c; curl rid50, mosquitto rid51). Juliet recall: TP 21961->21961 (d0), FP 5494->5494 (d0) vs 0.4.37 = NO regression incl CWE-416/UAF (Juliet has no macro table = path inert). curl oracle MEM30-C FP 1437->901 (-536, -37%), zero TP loss (MEM30 100% FP in curl). mosquitto oracle MEM30-C FP 662->134 (-528, -80%!) via mosquitto_FREE (same free+null idiom = engine generalizes, not curl-overfit), zero TP loss; MEM31/MEM12 TPs intact in both. Combined ~-1064 MEM30 oracle FP across 2 codebases = biggest 2c win. RESIDUAL (curl MEM30 901 FP remain): struct-member->base free-conflation (e.g. curlx_free(data->state.range) poisons data->state) = task 181, NOT macro-blindfold. 2c-iii COMPLETE. Phase 2c DONE (2c-i DCL31, 2c-ii EXP33, 2c-iii MEM30). NEXT: task 181 (free-state precision, clears the MEM30 901 residual) and/or Phase 3 (task 186, migrate ~51 rule files).done2026-06-16T13:25:06Z2026-06-16T16:01:20Z2026-06-17T13:53:48Z

<
<xx��O�-�-5EXP34-C bucket 2: caller-contract / precondition FP suppression (~338 sqlite FP)Second EXP34-C FP bucket from task 175 (bucket 1 = rc==SQLITE_OK out-param correlation, done separately). Pattern: a parameter pointer is dereferenced in a static helper, non-null guaranteed by the caller / API contract (e.g. fts3_tokenizer.c:316 'objPtr param non-NULL by API contract'; fts5_main.c 'ha�2�M
}�#55Fix realworld benchmark timing instrumentation for paperrealworld_results.duration_s is a run-level total duplicated across every project row (not per-project): e.g. 0.4.22 wrote 2423s to all 5 projects, 0.4.41 wrote 4131s to both. Also loc unpopulated in 145/195 rows, and cppcheck/clang-tidy have 0 timed rows. Blocks a realworld runtime-over-versions graph AND a tool-vs-tool throughput (LOC/s) comparison for the paper. Fix: (1) record per-project sqc duration, (2) populate loc, (3) time cppcheck + clang-tidy. Juliet timing is already paper-grade (scripts/benchmark_timing_figure.py + paper/fig_timing.tex).

--- 2026-06-18 add: record cache warm/cold per run ---
Realworld runs must note whether they ran cache-warm (reused prescan cache) or
cache-cold (rebuild_prescan=true). Owner wants this tracked from now on; it
explains misleading deltas (a cache-warm run after a rule change can under-report
improvement; cold runs are the source of truth). Cold-cache full suite is ~1hr.
Design: thread the rebuild_prescan flag from run_all/_build_sqc_cmd into the
per-run sidecar, have _auto_ingest_to_sqlite/ingest_realworld_run append
'cache:cold' or 'cache:warm' to realworld_runs.notes (or a dedicated column).
Implement off-run (MCP server doesn't hot-reload; coordinate a server restart).
Also relevant to the prescan-cache monthly-refresh cadence.

--- 2026-06-18 CORRECTION ---
Caching is currently UNWIRED for realworld: _build_sqc_cmd passes no prescan flag,
so every run is cold/fresh; the rebuild_prescan param is a dead no-op (swallowed by
**_kwargs); data/prescan_cache/*.cache (May 15) are vestigial. sqc DOES have
--save-prescan/--load-prescan. So warm/cold tracking is only meaningful AFTER the
runner is wired to those flags. Sub-scope: (a) decide whether to wire prescan
caching for realworld at all (cold is ~9-20min/codebase, maybe acceptable), (b) if
yes, thread --save/--load-prescan + a real rebuild flag, THEN (c) record cache:warm|cold.
If no, remove the dead rebuild_prescan param to avoid the misleading API.in-progress2026-06-18T15:43:55Z2026-06-20T15:30:22Z�@�L�[�q5Optimize multi-hop buffer-size propagation: re-parse only forwarder files (cut task-143 cold-scan cost)Task 143's propagate_param_buffer_sizes re-parses ALL source files per pass to push buffer sizes through forwarding chains. The task-202 timing metric shows this costs ~+558s (+6.2%) on the cold full Juliet benchmark (0.4.43->0.4.45), dominated by the LARGE dirs that legitimately fire the gate: CWE-78 +160s (Δfp=0 — zero benefit!), CWE-121 +161s, CWE-134 +58s. The tightened gate (0.4.45) only recovered buffer-FREE dirs (CWE-190 -30s, CWE-191 -10s); it can't help dirs that genuinely have buffer forwarding but yield no STR31 suppression.

Root cause: each propagation pass re-parses every file (thousands) though only files containing a FORWARDER function (param_passthroughs non-empty) can contribute. Fix: during the initial per-file prescan, record the set of files that contain at least one forwarder of a (potentially) bounded buffer; in propagate_param_buffer_sizes, re-parse ONLY that set each pass. For CWE-78/121 most files are leaf testcases with no forwarding, so the re-parse set should shrink dramatically.

Cost is cache-amortized (ProjectContext bincode cache) for repeat scans, so this only bites cold scans / per-version benchmarks — but those matter for the paper's perf numbers (see task 202). Validate: analysis_s returns toward the 0.4.43 baseline with STR31-C FP unchanged at the suite total (4981).pending2026-06-18T15:24:18Z
�n�X�M�[5Project-relevance prescan: auto-gate inapplicable rule classes (CON/WIN/C11/Annex-K) per projectFollow-up to task 151. Today, per-project rule applicability is curated BY
HAND in conf/realworld/<project>-rules.toml: each file enable/disables rule
classes and explains the rationale in its [metadata].description prose (e.g.
curl: "WIN*, FIO*, POSIX socket/thread, SIG*, CON* are IN scope"; sqlite drops
the 14-rule advisory baseline). This is correct-by-construction but manual and
doesn't scale to arbitrary user codebases.

GOAL: a lightweight project-characterization prescan that detects which rule
CLASSES are even relevant to a given codebase, then auto-gates the categorically
-inapplicable ones (the way the realworld configs do manually). This is about
RELEVANCE/applicability, NOT FP-suppression — same principle as memory
'fn-focus-vs-perproject-disable' (we only ever drop categorically-inapplicable
rules; genuine FPs stay measured in the ground_truth oracle).

Dimensions to detect (examples):
  - Threading/concurrency: no pthread/threads.h/_Atomic/std::thread, no
    mtx_*/atomic_* usage  => CON0x / CON3x not relevant.
  - Platform: no <windows.h>/Win32 API  => WIN* not relevant; conversely
    POSIX-only daemon vs cross-platform lib changes SIG*/FIO* scope.
  - Language level: strict C99 target (no <stdatomic.h>, <threads.h>,
    Annex-K *_s funcs, _Generic) => C11/Annex-K-specific rules not relevant.
    Ties into the C99-benchmark tasks (191/193/194).

Design questions:
  - Detection signal: header includes + symbol/identifier scan (cheap, fits
    existing prescan) vs compile_commands.json / build flags (-std=, defines).
  - Output: emit a generated rules-<project>.toml override, or an in-process
    relevance mask applied at scan time? Former is auditable + matches current
    workflow; latter is zero-config for end users.
  - Guardrails: detection must be conservative (false "irrelevant" = silent FN).
    Prefer "disable only when we're confident the whole class can't apply."

Deliverable: design first (like task 151), then implement behind a flag.
Relates to: 151 (concurrency relevance is one dimension), 191/193/194 (C99),
188 (Windows benchmarks), and the conf/realworld/*-rules.toml manual configs.pending2026-06-21T19:53:49Z
	���T��}555Ingest cppcheck + clang-tidy realworld rows (timing + LOC/s)Follow-up from task 205 (sqc timing fixed). realworld_results only ever gets sqc rows: _auto_ingest_to_sqlite globs sqc-*.json and ingest_realworld_run hardcodes tool='sqc'. So cppcheck/clang-tidy have 0 timed rows, blocking the tool-vs-tool throughput (LOC/s) figure. Need: (a) parse cppcheck .xml + clang-tidy .txt result files into realworld_violations, (b) insert their realworld_results rows with tool name + per-codebase duration (the _completion_time mtime approach + state durations now work for all tools; _extract_run_durations currently filters tool=='sqc' — generalize), (c) reuse _count_c_source for loc (same curated source_dirs denominator across tools => fair LOC/s). Cache warm/cold tracking is separate (tasks 208/209).
2026-06-20 DONE: _ingest_competitors attaches cppcheck+clang-tidy per-project rows (violation_count + loc + mtime-based duration) to the sqc run row, called from _auto_ingest_to_sqlite. loc reuses _count_c_source (shared denominator across tools => fair LOC/s). _extract_run_durations generalized with a tool param. Also fixed a pre-existing run_all fragility: auto-ingest trigger now locates the sqc dir via _latest_completed_version_dir (was _get_version_dir/latest-by-mtime, which in a run_all batch is a competitor dir => ingest silently skipped). Per-finding detail not stored (competitors aren't scored vs the CERT-rule-keyed oracle; matches historical backfill). Picks the latest completed competitor run per codebase from state (competitor versions are stable, so every run row carries all 3 tools). VERIFIED offline against real libcrc artifacts (temp state+DB): sqc 391 finds/0.7s, cppcheck 40/0.1s, clang-tidy 2/0.4s, all loc=1034; counts match raw .xml/.txt. Live auto-attach needs an MCP server restart (next run_all populates it).done2026-06-20T16:10:35Z2026-06-20T16:24:03Z2026-06-20T16:47:10Z�l�S�A�555ARR30 FN 2b: helper-function over-read across a tainted blob arg (nextchar/readUtf8 class)DONE v0.4.55 (dfa1e177). Interprocedural over-read at tainted-blob callsite.

Approach (within-TU, no prescan/FunctionSummary changes — canonical case is
same-file): per-file summary helper_overread_summary maps function name ->
positional indices of const char* params (no paired length) walked unbounded
(embedded-increment subscript inside a loop, index never relationally bounded).
On each call_expression, check_overread_helper_callsite flags when the arg at
an over-read index resolves (stripping +offset/casts) to a blob/value-accessor-
tainted pointer in the caller. Double gate = caller taint + callee unbounded
param walk + no length arg. Reuses task-210 embedded-increment + relational-
bound analysis and task-172 blob-taint collector.

Results:
  - Canonical FN recovered: nextchar.c:184 readUtf8(zOut+p->nPrefix, &cNext),
    zOut = sqlite3_column_text(...). Fires exactly there.
  - Precision: 1 hit / 0 FP across ALL 315 sqlite C files (the nextchar.c TP).
  - Juliet: delta-0 (TP 22615 / FP 4607 identical v0.4.52->v0.4.55; zero rule
    movement) — Juliet has no blob/value accessors so no delta expected.
  - Tests: 67 ARR30 + full suite (3391) pass.

Limitation / follow-up: covers same-TU case (helper + caller in one file, the
disclosed nextchar.c shape and the sqlite3.c amalgamation). True cross-FILE
(separate-TU) over-read helpers would need the cross-TU FunctionSummary infra
rather than the per-file map. Defer until a cross-TU instance surfaces.done2026-06-19T12:48:23Z2026-06-19T16:58:02Z2026-06-20T14:16:34Z
�����+�P
w�-5Record cache warm/cold state on Juliet benchmark runsMirror of the realworld warm/cold tracking (task 205 sub-item). Juliet runs (bench.runner / mcp_servers/server.py, runs table in benchmarks.db) should record wheth�z�M
}�{555Fix realworld benchmark timing instrumentation for paperrealworld_results.duration_s is a run-level total duplicated across every project row (not per-project): e.g. 0.4.22 wrote 2423s to all 5 projects, 0.4.41 wrote 4131s to both. Also loc unpopulated in 145/195 rows, and cppcheck/clang-tidy have 0 timed rows. Blocks a realworld runtime-over-versions graph AND a tool-vs-tool throughput (LOC/s) comparison for the paper. Fix: (1) record per-project sqc duration, (2) populate loc, (3) time cppcheck + clang-tidy. Juliet timing is already paper-grade (scripts/benchmark_timing_figure.py + paper/fig_timing.tex).

--- 2026-06-18 add: record cache warm/cold per run ---
Realworld runs must note whether they ran cache-warm (reused prescan cache) or
cache-cold (rebuild_prescan=true). Owner wants this tracked from now on; it
explains misleading deltas (a cache-warm run after a rule change can under-report
improvement; cold runs are the source of truth). Cold-cache full suite is ~1hr.
Design: thread the rebuild_prescan flag from run_all/_build_sqc_cmd into the
per-run sidecar, have _auto_ingest_to_sqlite/ingest_realworld_run append
'cache:cold' or 'cache:warm' to realworld_runs.notes (or a dedicated column).
Implement off-run (MCP server doesn't hot-reload; coordinate a server restart).
Also relevant to the prescan-cache monthly-refresh cadence.

--- 2026-06-18 CORRECTION ---
Caching is currently UNWIRED for realworld: _build_sqc_cmd passes no prescan flag,
so every run is cold/fresh; the rebuild_prescan param is a dead no-op (swallowed by
**_kwargs); data/prescan_cache/*.cache (May 15) are vestigial. sqc DOES have
--save-prescan/--load-prescan. So warm/cold tracking is only meaningful AFTER the
runner is wired to those flags. Sub-scope: (a) decide whether to wire prescan
caching for realworld at all (cold is ~9-20min/codebase, maybe acceptable), (b) if
yes, thread --save/--load-prescan + a real rebuild flag, THEN (c) record cache:warm|cold.
If no, remove the dead rebuild_prescan param to avoid the misleading API.
2026-06-20 DONE (sqc timing + loc/c_files): Root cause of duplicated run-level total: get_status set end_time=now (poll time), so a single late poll reaping all parallel codebase runs stamped them with the same wall-clock-until-observed value (run 59: all 5 = 31061s = 8.6h). Fix: end_time now derives from result/log file mtime (_completion_time helper) = process actual last write, independent of poll timing. Applied to all 4 get_status completion branches (the 2 log-only branches previously set no end_time). loc/c_files: new _count_c_source (over curated cppcheck source_dirs => same LOC denominator across tools) + _extract_run_metrics, threaded through _auto_ingest_to_sqlite -> ingest_realworld_run(metrics=). Was hardcoded 0,0. Backfilled 18 surviving /tmp result dirs (run_ids 42-59): durations now realistic & stable (curl ~100s, hostap ~435s, sqlite ~220s, mosquitto ~25s, libcrc ~0.6s); LOC/s ~900-1900. benchmarks.db gitignored (local-only). MCP server doesn't hot-reload — effect after server restart. REMAINING: (3) cppcheck/clang-tidy never ingested => 0 timed rows => task 212. Cache warm/cold => tasks 208/209.
2026-06-20 VERIFIED LIVE (post MCP restart): fresh run 60 sqc-libcrc-0.4.55-bf7ffbd6 ingested duration_s=0.4s (accurate mtime-based, not poll-display 4s), loc=1034, c_files=9. Going-forward path confirmed.done2026-06-18T15:43:55Z2026-06-20T15:30:22Z2026-06-20T23:24:46Z
�V�'��O�-�-#55EXP34-C bucket 2: caller-contract / precondition FP suppression (~338 sqlite FP)Second EXP34-C FP bucket from task 175 (bucket 1 = rc==SQLITE_OK out-param correlation, done separately). Pattern: a parameter pointer is dereferenced in a static helper, non-null guaranteed by the caller / API contract (e.g. fts3_tokenizer.c:316 'objPtr param non-NULL by API contract'; fts5_main.c 'handles NULL'). Requires interprocedural precondition propagation: suppress a param-pointer deref only when ALL callers pass a provably non-null argument (or the function is a documented API entry whose contract guarantees it). CRITICAL: must NOT mask the unguarded-malloc null-deref FN (verified firing as of 0.4.32) and must not blanket-trust all params. Higher regression risk than bucket 1 — assess after bucket-1 sqlite result is in. Validate Juliet CWE-476 recall �j�O�-�)555EXP34-C bucket 2: caller-contract / precondition FP suppression (~338 sqlite FP)Second EXP34-C FP bucket from task 175 (bucket 1 = rc==SQLITE_OK out-param correlation, done separately). Pattern: a parameter pointer is dereferenced in a static helper, non-null guaranteed by the caller / API contract (e.g. fts3_tokenizer.c:316 'objPtr param non-NULL by API contract'; fts5_main.c 'handles NULL'). Requires interprocedural precondition propagation: suppress a param-pointer deref only when ALL callers pass a provably non-null argument (or the function is a documented API entry whose contract guarantees it). CRITICAL: must NOT mask the unguarded-malloc null-deref FN (verified firing as of 0.4.32) and must not blanket-trust all params. Higher regression risk than bucket 1 — assess after bucket-1 sqlite result is in. Validate Juliet CWE-476 recall stays flat.
DONE v0.4.56 (commit 31d632b8): shipped PRECONDITION-ASSERT subset. KEY FINDING: ~338-FP estimate was from a STALE oracle (1496 FPs at old sqc); current 0.4.55 already only 314 total/191 in-scope sqlite EXP34-C FPs. is_guarded_by_precondition_assert in exp34_c.rs: suppress deref when a dominating assert() establishes non-null (explicit assert(p)/assert(p!=0) OR implicit unconditional deref inside assert e.g. assert(p->flags&X)), gated on no ||/ternary + no reassignment between assert and deref. Self-contained in is_unsafe_at; does NOT touch shared callsite aggregation. RESULTS: scoped sqlite in-scope FP 191->185 (-6), TP unchanged; benchmark sqlite 1666->1656 (-10); curl/hostap/mosquitto/libcrc EXP34 IDENTICAL (zero regression); Juliet CWE-476 IDENTICAL (TP370/FP175/67.9%, recall flat). Tests: pass/testcases_precondition_assert.c + fail/testcases_reassign_after_assert.c. Remaining caller-contract (no assert, needs interprocedural) -> task 214.done2026-06-18T20:57:13Z2026-06-20T23:27:44Z2026-06-21T02:13:13Z�&�N�E�S5Alias-bound CWE-121/122 FP buckets: ARR38-C CWE805 cross-fn dest + ARR30-C CWE-129 subscriptResidual from task 144 after the ARR30-C string-copy FP win (v0.4.47). Both buckets are 100% good-section FPs that require interprocedural/alias analysis, NOT rule-local heuristics:
- ARR38-C/CWE-121 504 FP (CWE805 memcpy/memmove/ncat/snprintf): the sink line is IDENTICAL in bad and good; only the pointed-to buffer differs (data=dataBadBuffer[50] vs dataGoodBuffer[100]), set in the caller and passed cross-function. A content-length/size heuristic here would re-introduce the kind of unsound TP loss fixed in 18cbff53.
- ARR30-C/CWE-121 248 subscript FP (CWE-129): array index via aliased pointers (data=7 written through *dataPtr1, read via *dataPtr2). Needs alias/VRA.
Do these on top of task 150's alias-analysis decision (SSA-lite use-def vs alias). Keep the Static-dest discipline from 18cbff53.pending2026-06-18T19:31:16Z
��
���F�S�A�g#55ARR30 FN 2b: helper-function over-read across a tainted blob arg (nextchar/readUtf8 class)Follow-up to task 172. Some §2a FNs pass a tainted (blob-accessor-derived) pointer + offset INTO a helper that does the unbounded read, so the over-read loop is not in the same function. Canonical: ext/misc/ne�+�P
w�-5Record cache warm/cold state on Juliet benchmark runsMirror of the realworld warm/cold tracking (task 205 sub-item). Juliet runs (bench.runner / mcp_servers/server.py, runs table in benchmarks.db) should record whether the run was cache-warm (reused prescan/per-CWE cache) or cache-cold (regenerated). Owner wants this tracked from now on so version-to-version deltas can be read correctly — a cache-warm run after an analysis change can under-report movement. Design: add the warm/cold flag to the runs table (notes or a dedicated column) and surface it in list_runs/get_status/compare_runs output. Confirm first whether Juliet fast-mode actually consumes a prescan cache and where; if it does not, record 'cache:n/a'. Pairs with the ~monthly prescan-refresh cadence.

--- 2026-06-18 note ---
Cross-check the realworld finding (task 205): realworld caching is currently unwired
(rebuild_prescan is a no-op, runs are always cold). Confirm whether Juliet fast-mode
actually loads/saves a prescan cache before building warm/cold recording; if Juliet
is also always-cold, record 'cache:cold' (or n/a) rather than inventing a warm path.

--- 2026-06-18 CONFIRMED ---
Juliet runner (bench/runner.py:124) invokes: sqc <cwe_dir> -m <manifest>
-d <cwe_dir> -d <testcasesupport> -e <csv> -j 1 — NO --load/--save-prescan.
So Juliet ALSO always prescans fresh (cold); it does not use a prescan db.
Both benchmarks are always-cold. --save/--load-prescan exist in sqc (src/main.rs,
CI-oriented, in docs) but no runner uses them; data/prescan_cache/*.cache is
referenced by nothing (vestigial). => For now, record 'cache:cold' (or n/a) on
Juliet runs; a real warm path requires wiring --load-prescan into the runner
first (joint with task 205). Lower priority since there is no warm path to
distinguish yet.pending2026-06-18T23:47:25Z��Q�+�!5Plumb prescan caching into benchmark runners (make rebuild_prescan real) + testToday the rebuild_prescan param on realworld run_all/run_analysis is a dead no-op (swallowed by _build_sqc_cmd(**_kwargs)) and neither the realworld runner (mcp_servers/realworld_server.py:_build_sqc_cmd) nor the Juliet runner (bench/runner.py:124) passes sqc's --save-prescan/--load-prescan. So every run is cold (fresh in-memory prescan); data/prescan_cache/*.cache is vestigial.

Scope: (1) wire the runners to sqc --save-prescan <FILE> (cold/first run) and --load-prescan <FILE> (warm/reuse) keyed per codebase/CWE; (2) make rebuild_prescan actually force a regenerate (save) vs reuse (load); (3) invalidate/regene on binary-or-manifest change (e.g. cache key includes sqc commit + manifest hash) to avoid silent staleness; (4) add a test: a warm run reusing a cache produces identical violations to a cold run on the same binary, and rebuild_prescan=true regenerates. Decide first whether the speedup is worth it (cold is ~9-20min/codebase realworld; Juliet per-CWE is already fast) — if not worth wiring, instead REMOVE the dead rebuild_prescan param and document that runs are always cold. Unblocks warm/cold recording (tasks 205 realworld, 208 Juliet).pending2026-06-19T00:13:22Z
||��D
i�;555Exclude `#if 0` dead-code blocks from analysissqc flagged dev_stu.c:505 (MEM30-C) for code inside a `#if 0 … #endif` block that is never compiled. Scanning dead preprocessor branches produces unfixable noise and inflates counts, masking real issues.

Fix scope: preprocessor/prescan stage — detect and mark `#if 0` regions; skip them in all rule checkers.

Evidence: FP-002 in Catapult RC624 V1.5.8 firmware review (1 hit, but cross-cutting correctness concern for any codebase that uses `#if 0` to comment out code). Source: Catapult FP code review (DB_UPDATE.md, 2026-06-17).done2026-06-17T13:56:19Z2026-06-19T01:29:58Z2026-06-19T02:07:25Z�k�E��5Block-level text-scan robustness: rule heuristics match raw get_node_text spans (comment/string/identifier-substring sensitive)AUDIT (2026-06-17, surfaced during task 181 pattern 2). 165 call sites across 22 rule files do substring matching (.contains/.find/.starts_with/.matches) on get_node_text() of BLOCK-level nodes (compound_statement, loop, if, function body), bound to vars like body_text/loop_text/if_text/then_text/else_text/func_text. get_node_text returns the RAW source span INCLUDING comments and string literals, so these heuristics are: (a) comment-sensitive — e.g. MEM30 unconditionally_diverges was defeated by a trailing /* comment */ after goto (fixed in pattern 2 by excluding comment nodes); MSC40 func_text.contains('inline') trips on /* inline */; (b) string-literal-sensitive — MEM30 body_text.contains('size != 0'), body_text.contains('realloc('); (c) identifier-substring-sensitive — 'inline' matches 'spinline', func_name as substring matches longer names. Heavy users (oracle-relevant in *): STR31-C(24)*, INT30-C(17), MEM30-C(16)*, ARR32-C(13), SIG02-C(12), API00-C(12), EXP20-C(11)*, ERR33-C(9), FLP34-C(6), FIO50-C(6), ARR30-C(6)*, FIO34-C(5), ARR00-C(5), FLP36-C(4), ERR32-C(4), STR02-C(3), SIG34-C(3), MSC40-C(3), EXP33-C(3)*, WIN03-C(1), MEM11-C(1), INT32-C(1). Full inventory saved at /tmp/blocktext_inventory.txt at audit time (regenerate: grep -rnE '(body_text|loop_text|if_text|then_text|else_text|func_text|...)\.(contains|find|starts_with|ends_with|matches)\(' src/rules/). FIX direction: replace block-text substring scans with AST-node traversal (find the actual call_expression/identifier/keyword nodes), OR a shared helper node_text_sans_comments() as a cheap interim for pure comment-sensitivity. Each rule needs its own Juliet recall + oracle FP gate — do NOT batch-rewrite blind. Overlaps/feeds task 153 (shared iterative AST walker). Recall-safety: these are mostly used to GATE detection, so a stale substring can cause both FP (spurious match in comment) and FN (heuristic fooled). Prioritize oracle-relevant rules first (STR31, MEM30, EXP20, ARR30, EXP33).pending2026-06-17T22:04:55Z�}�C��/5Macro-expansion 2c-ii-b: EXP34-C/ARR00-C macro output-arg recognitionOptional remainder of task 185 Tier-1(b) (split out 2026-06-17 when 185 closed). 2c-ii wired the macro-expansion engine's output-arg map (macro_output_param_indices) into EXP33-C (init_state) — clearing CF_DATA_SAVE-style 'used uninitialized' FP. EXP34-C (null-state) and ARR00-C (array-init) have the SAME macro-output-arg class (a macro that writes its arg via the body) but use their OWN analyses (null_state / ARR00 array checker), so they were untouched. TASK: thread the same per-file macro_output_params map into EXP34-C's null-state transfer + ARR00-C's array-init checker (mirror EXP33-C's is_function_macro_output_arg skip + transfer marking). STOCKTAKE estimated the combined EXP33/34/ARR00 init-macro class at ~280 curl FP; 2c-ii cleared only the EXP33 slice (curl -38, mosquitto -3), so a real EXP34/ARR00 remainder exists. Recall-gate Juliet (EXP34=CWE-476 null-deref, ARR00 array — real recall stakes) + measure curl/mosquitto oracle FP delta. Engine already built (task 185); this is pure consumer wiring. Relates to 185.pending2026-06-17T13:53:48Zcks.

TASK: pick a permissively-licensed C codebase that genuinely adopts C99 idioms (conformant/VLA array params, designated initializers, compound literals, _Bool/stdbool, mixed declarations, restrict). Candidates to evaluate: a numerics/DSP or embedded lib that uses VLA params; modern crypto (e.g. monocypher), a modern parser, or a C99-style utility lib. Verify it actually contains conformant-array-parameter signatures (grep for 'type name[var]' param forms) before adopting. Then:
 1. clone pinned to a commit under ~/toolchain/<name>; add ~/data-enterprise/<name>-main for trunk cross-ref.
 2. add to PROJECTS in mcp_servers/realworld_server.py (sqc/cppcheck/clang-tidy include+source dirs) + conf/realworld/<name>-rules.toml.
 3. run + ingest a baseline; build the ground-truth oracle (file-at-a-time audited corpus, adversarial pass) like curl/mosquitto.
Goal: a codebase where API05-C and other C99-conformance rules have real TPs to validate against, complementing the C89-style majority. Relates to 190 (API05-C correctness fix).
NOTE (2026-06-16): split into two tracks after Melon/cgltf discussion. Melon evaluation (explicit --c99 mode; possible dual C99+macro oracle) = separate candidate task. Synthetic-conformance-corpus option for API05-C's '[static N]' (which no real codebase uses) = separate exploration task. This task (191) stays scoped to a REAL idiomatic-C99 codebase for the broader conformance rules (designated inits/compound literals/FAM/restrict/_Bool). cgltf evaluated + rejected for this goal (too conservative on structural C99).
CANDIDATE (2026-06-17, user): Lua 5.2 — recommended as a good codebase for idiomatic C99. Permissively licensed (MIT). Evaluate for C99-conformance rule validation (designated inits / compound literals / _Bool / mixed declarations / restrict); verify conformant-array-parameter signatures present before adopting.
VERSION/SHA (2026-06-17, user OK'd targeting 5.5): adopt ~/toolchain/lua = Lua 5.5 (NOT 5.2; user not version-locked as long as we pin the SHA). Pinned commit 40b76de2d77e66b70a9d4bf989c3f5340919973f (git describe v5.5.0-34-g40b76de2, dated 2026-06-03). SLOC (pygount, code lines): ~19,128 C across 66 files — tiny, ~2% of the current 5-project suite (~862K C-family), so a full file-at-a-time FN oracle like curl/sqlite is feasible and fast. ACTION: verify it actually exercises C99-conformance idioms before committing to it as the C99 target.

--- 2026-06-21 PROGRESS: Lua wired into the suite (sqc v0.4.59) ---
Lua 5.5 @ 40b76de2 added to the realworld suite as a GENERAL-PURPOSE oracle
(small ~19K SLOC, MIT, new VM/interpreter domain). Verification BEFORE adopting
showed Lua is portability-C99, NOT structural-C99 (0 designated inits / compound
literals / _Bool / restrict / FAM / conformant-array params) — so it does NOT
close this task's headline C99-conformance-validation goal. That goal is spun
off to task 217 (hunt for a genuinely idiomatic structural-C99 codebase).

Wiring delivered:
  - sqc gained a generic `--exclude <glob>` flag (repeatable, path-suffix globs
    via the shared glob_to_regex). Filters scanned files while leaving prescan/
    cross-file context intact. (src/main.rs, src/analyze/mod.rs; glob_to_regex
    made pub(crate) in suppression.rs.)
  - mcp_servers/realworld_server.py: CODEBASES['lua'] for all 3 tools; scope =
    shipping lib + lua.c, EXCLUDING the checked-in amalgamation onelua.c (would
    double-count under cppcheck/clang-tidy preprocessing), the ltests.c test/
    debug harness, and testes/ C fixtures. sqc uses --exclude; cppcheck uses -i;
    clang-tidy builder gained an optional `exclude` find-prune list.
  - conf/realworld/lua-rules.toml (same 14-rule advisory baseline as sqlite).
  - sqc scans 33 shipping .c (raw count 8631 violations pre-oracle).

REMAINING for this task: (a) clone ~/data-enterprise/lua-main for trunk
cross-ref; (b) run + ingest a baseline across all 3 tools; (c) build the
file-at-a-time ground-truth oracle (data/precision_audit/lua/) like curl/sqlite.done2026-06-16T19:54:42Z2026-06-21T20:03:41Z2026-06-22T21:13:56Z
�
(����W�7�M5CWE-680 interprocedural integer-range propagation (param/global/cross-file sink args)Follow-on to task 145. After the v0.4.58 constant-overflow fix (INT32-C check_allocation_overflow now flags malloc/calloc/realloc size args that fit 64-bit but definitely wrap a 32-bit size_t, via expression_overflows_unsigned_vra(...,32,...)), CWE-680 per-file detection moved 125->135/336 (~40%). Frama-C is at 82.6%.

The remaining ~200 missed files are NOT recoverable without interprocedural integer-range propagation, which task 150 deliberately deferred (no major infra). Two miss buckets:

1. Interprocedural dataflow variants (Juliet 41 param-in, 44, 45, 51-54 cross-file, 62-68) across all 6 patterns (~155 files). Sink is e.g. badSink(int data){ malloc(data*sizeof(int)); } called as badSink(data) where the caller set data=INT_MAX/2+2. The call passes a VARIABLE, so the existing const-callsite mechanism (callsite_param_const_int, tasks 115/116) can't seed it -- that only fires on literal call-site args. Needs caller->callee VRA range propagation (or extend callsite_param_const_int to fold the caller's intra-fn VRA of the arg variable before propagating).

2. Straddling control-flow variants (08-15, 17): data = -1; if(staticReturnsTrue()){ data = INT_MAX/2+2; }. VRA merges to a POSSIBLE-not-definite large range [-1, 1.07e9], so the precise definite-wrap check correctly doesn't fire. Catching these means flagging range.MAX>UINT32_MAX (possible wrap) instead of range.MIN -- FP-prone in the broad suite/real-world; needs path-sensitivity or branch-condition folding (staticReturnsTrue/GLOBAL_CONST_TRUE), not a blunt threshold.

Gated on the same infra decision as task 150; revisit only if the ceiling decision flips to invest in interprocedural range tracking. INT32-C is already a top real-world FP rule (4502), so any range-propagation work must measure real-world precision, not just Juliet recall.pending2026-06-21T18:20:06Z��V�=�w555EXP34-C bucket 2b: interprocedural caller-contract (all-callers-non-null) FP suppressionDONE v0.4.57 (83ccb394). Root cause: error/cleanup null assignments whose statement is immediately followed by a divergent jump (e.g. 'pWInfo = 0; goto whereBeginError;') were the textually-last write, so flow-insensitive collect_local_var_states recorded them as the variable's null state and cast a null call-site vote that poisoned callee params every reachable caller passes non-null (whereOmitNoopJoin pWInfo; growOp3 p via forwarding). Fix: stmt_diverges_after skips recording such dead-end null assignments (goto/return/break/continue follow). Malloc-then-deref FN untouched (no trailing jump). RESULTS: sqlite EXP34-C 1656->1633 (-23); all 19 adjudicated removals oracle-confirmed FP + 4 unaudited Tcl-shell tooling, 0 TP loss; all 7 oracle TPs preserved. Juliet 100% FLAT (TP 22615, FP 4607, tp_rate 83.1%) — zero recall/precision delta across all 74 CWEs, CWE-476 unchanged. NOTE: -d <repo> is essential to reproduce the interprocedural mechanism; without it EXP34 drops to 310 and the fix is dormant.done2026-06-21T01:49:14Z2026-06-21T13:03:46Z2026-06-21T15:25:07Z�T�U�1�y555Fix realworld auto-ingest 'already ingested' short-circuit blocking full re-ingest_auto_ingest_to_sqlite (mcp_servers/realworld_server.py ~L1389) skips ingest entirely if ANY existing realworld_run has the sqc dir_name in its notes. A partial/test run (e.g. libcrc-only) ingested first for a given version+sha permanently blocks the later full 5-codebase run from auto-ingesting — we had to manually DELETE the run row from benchmarks.db then re-call get_status. Fix: either upsert/merge missing project+tool rows into the existing run, or re-ingest when the on-disk result set is more complete than what's stored, instead of all-or-nothing skip.done2026-06-20T22:54:48Z2026-06-20T23:15:26Z2026-06-20T23:21:27Z
�+%+��+��+
{�S	55GATE: sqlite FP reduction before new-codebase expansionUser decision (2026-06-14): tamp down sqlite FPs BEFORE auditing new codebases — misfire patterns (ANALYSIS.md §1) are codebase-independent and recur in mosquitto/curl/hostap, inflating FP counts and audit cost.

PRECISION LIFT CONFIRMED (2026-06-16, run #44, sqc-sqlite-0.4.33-65ff3cd3): sqlite measured precision 6.3% (v0.4.21 baseline, run #33) -> 8.6% (v0.4.33), recall flat 98.4% -> 97.9%, findings 46,189 -> 34,977 (-24%). Driven by MEM30(167)/EXP34(168)/INT3x(140); API00(�l�+
{�c	555GATE: sqlite FP reduction before new-codebase expansionGATE MET + CLOSED (2026-06-16). Precision lift confirmed (sqlite 6.3%->8.6%, recall flat, run #44/45). Hold-for-180 condition satisfied: macro-opacity (the dominant codebase-independent FP class) hardened via the macro_semantics registry — mosquitto A/B -429 FP, 0 net-new, Juliet recall identical (docs/design/macro-expansion.md §8b). USER DECISION (2026-06-16): unblock new-codebase audits now; let curl/hostap surface what actually recurs to drive 181/175 with real data rather than pre-emptive hardening. Remaining sqlite FP classes (181 free-state, 175 EXP34-contract) proceed in parallel, not as gate blockers.done2026-06-14T22:19:35Z2026-06-16T13:03:15Z2026-06-16T15:37:04Z��*�7�q	555Disposition the 37 zero-TP rules from sqlite audit (suppress / gate / raise-evidence)REVERTED 2026-06-16: the config-disable approach was wrong. conf/realworld/*.toml only drops categorically-INAPPLICABLE rules (Windows on POSIX, advisory style the project rejects); per-finding FP is recorded in the ground_truth oracle so the benchmark MEASURES precision improvement rather than hiding it. None of the 19 group-A rules is platform/domain-inapplicable (EXP33=uninitialized memory applies to all C; WIN04 sees in-scope src/os_win.c), so none belongs in a config disable set. libcrc third exhaustive oracle proved it: EXP33 zero-TP on sqlite+mosquitto but 1 real TP / 9 FP on libcrc (macro-opacity noise). Group-A noise must be fixed by RULE HARDENING + FN reduction, routed through existing tasks: EXP33/EXP34 macro opacity=180 (+118/146), MEM30/MEM12 free-state=181, EXP34 contract=175, FN taint untrusted-length=172, group-B raise-evidence (EXP20 !strcmp gate / INT33 bridge.c:930)=182/183. This is now an umbrella/tracking item. See data/precision_audit/mosquitto/adversarial_verification.md.done2026-06-14T22:19:35Z2026-06-16T12:37:13Z2026-06-16T12:48:58Zt
{�5	5GATE: sqlite FP reduction before new-codebase expansionUser decision (2026-06-14): tamp down sqlite FPs BEFORE auditing new codebases — the misfire patterns (ANALYSIS.md §1) are codebase-independent and will recur in mosquitto/curl/hostap, inflating their FP counts and audit cost. This milestone is met when the high-volume ~0% rules are gated: INT32/31/30 (140), MEM30 freed-context-arg, EXP34 guarded-null, API00 internal-contract, and the 37 zero-TP rules dispositioned. Re-run the sqlite audit subset to confirm precision lift, THEN unblock the new-codebase audits (157/158/159).pending2026-06-14T22:19:35Z�W�)��	555API00-C internal-contract FP suppression (1366 FP / 1 TP in sqlite audit)ANALYSIS.md §1: API00-C = 1366 FP / 1 TP (0.1%), #4 FP source. Misfire: flags params that an internal contract guarantees non-null (mutex held / caller invariant / asserted) — not a trust boundary. Fix: API00 should fire only at actual external trust boundaries (public API entry, untrusted input), not internal callees.done2026-06-14T22:19:35Z2026-06-15T15:04:54Z2026-06-15T16:04:55Z
��!|�t�,�G�#555FN-detection 2a: taint-aware 'untrusted length -> unguarded buffer access' (+ re-point ARR30)ANALYSIS.md §2a: the biggest recall gap. 13 of 23 sqlite FNs are unbounded varint/decode-loop reads where a length/count/pointer from sqlite3_column_*/blob/file/page bytes drives a read/write with no bound check before access (os_kv.c:469 [disclosed], fts3_snippet.c:890 high-conf OOB write, spellfix.c:2597, sqlite3rbu.c:2654, fts5_storage.c:1405, fts3_term.c:232, fts3view.c:568, checkindex.c:389, sqlite3intck.c:322, scrub.c:442, nextchar.c:184, zipfile.c:714, dbstat.c:449, pager.c:1335). THE ARR30 PARADOX: ARR30-C = 628 FP / 0 TP yet these FNs are ARR30-class -> the rule fires on bounded indices it misreads and misses the real unbounded reads. Re-point ARR30 at: taint a length from untrusted source, require a 'p<end'/'idx<n' guard dominating the indexing read; treat getVarint and while(*p++!=term) loops as unbounded absent such a guard. Rare change that lifts recall AND precision together.
Catapult audit update (2026-06-17, DB_UPDATE.md): Catapult RC624 firmware produced ~109 ARR30-C FPs from two sub-patterns reinforcing the ARR30-C re-point. Sub-pattern A (~108): enum-constant indices on arrays sized exactly to the enum range (e.g. WIFI_Net_FunArray indexed by WIFI_NET_IDLE/CONF, array sized to WIFI_NET_END); sqc cannot prove cross-TU enum-to-array-size alignment. Goes away entirely with the taint-aware unbounded-read trigger (main thrust of task 172). Sub-pattern B (1-2): sqc miscounts AdcChannelTable in dev_adc.c as 5 elements vs actual 11 — likely only one conditional-compilation branch's initializer counted; secondary array-size inference bug — if old trigger kept for transition, size-counting should aggregate across if/else branches. Both resolved by task 172's new trigger; no separate task needed. Sub-pattern B also addressed by the if-0 preprocessor task (196) if it extends to conditional compilation in array initializers.done2026-06-14T22:20:35Z2026-06-19T11:56:45Z2026-06-19T13:43:54Z�!�.��w5FN-detection 2c: integer truncation before allocation (INT31 pattern)ANALYSIS.md §2c: detect narrowing of a 64-bit/attacker-controlled value to a narrower type on the path into an allocation size. FNs: amatch.c:1160 (nBuf=(char)(nWord+100) signed-char truncation before realloc), sqlar.c:94 (i64 sz from sqlar blob -> sqlite3_malloc(int) truncation, then uncompress overflows).pending2026-06-14T22:20:35Z�[�-��k5FN-detection 2b: OOM null-deref after sqlite3_malloc* (EXP34 pattern)ANALYSIS.md §2b: flag 'p = sqlite3_malloc*(...)' followed by a write/deref of p with no intervening if(p==0)/p!=0 check. FNs: compress.c:63, compress.c:102, vfstrace.c:897. sqc currently mis-fires EXP33 (uninit) at some of these instead of EXP34. Coordinate with the EXP34 guarded-null FP-suppression task so suppression does not also mask the unguarded-malloc case.pending2026-06-14T22:20:35Z
>
�>�9�B�#�5Explore C99 ruleset validation options (incl. synthetic conformance corpus)Broader-than-191 exploration of how to give the C99-conformance ruleset a POSITIVE-validation target (raised 2026-06-16). Key insight from the Melon/cgltf discussion: API05-C's exact trigger — 'T arr[static N]' parameter syntax — is vanishingly rare in ANY real-world project, so no realworld oracle (Melon included) will validate it positively. Decouple it from the realworld-codebase search (191) so that effort doesn't stall on API05-C. OPTIONS to explore: (1) a SYNTHETIC C99-conformance fixture corpus (hand-written .c exercising [static N] params, designated inits, compound literals, FAM, restrict, _Bool, VLA params, mixed decls) used as a positive-validation suite — cheap, deterministic, fully controllable ground truth; (2) a real idiomatic-C99 codebase for the broader conformance rules (overlaps 191 — designated inits/compound literals/FAM/restrict ARE common in modern C); (3) mine existing CERT C / SEI example code for conformant snippets. Goal: every C99-conformance rule has at least one confirmable TP. Relates to 190 (API05-C correctness fix) and 191 (realworld C99 oracle).
EMPIRICAL CONFIRMATION (2026-06-23, task 217): grep over 11 local repos + raylib + monocypher found ZERO genuine '[static N]' conformant-array-param uses — the only match anywhere was a documentation comment in newlib (gd_toolchain) cdefs.h. So API05-C has no real-world oracle; its positive-validation MUST come from the synthetic corpus (option 1). The broader conformance idioms (compound literals/designated-init/FAM/restrict, option 2) DO have a real-world target: raylib @962bbfc (see task 217).pending2026-06-17T03:42:18Z��A
�)555Evaluate Melon (Water-Melon/Melon) as benchmark candidateCandidate real-world oracle (raised 2026-06-16). Melon is a C framework (data structures, regex, JSON, lang VM) with an explicit --c99 build mode (-std=c99 -DMLN_C99 -D_POSIX_C_SOURCE=200112L), so it is deliberately C99-conformant — unlike the current 5 oracles (all C89/C90; curl is strict C89). Possible DUAL value: (a) C99-conformance rule validation (task 191) IF it uses structural C99 idioms densely; (b) 3rd MACRO oracle to cross-validate the macro-expansion engine before Phase 3 migration (task 186), since it is macro-heavy and disjoint from curl/mosquitto. EVALUATE BEFORE COMMITTING: grep Melon src for density of designated initializers, compound literals, flexible array members, restrict, _Bool, and especially conformant array params 'T name[static N]' / 'T name[n]' (the API05-C trigger — likely absent even here). Also gauge full-audit cost (it is large vs single-file libcrc). Alternative considered: jkuhlmann/cgltf — REJECTED for C99-rule hardening (conservative; no designated inits/compound literals/FAM/restrict/_Bool/VLA), but noted as a strong PARSER-RECALL oracle for a different goal (untrusted glTF/GLB+JSON decode). Relates to 191.

--- 2026-06-21 CLOSED (owner) ---
Not pursuing Melon. Using Lua as the C99-compliant real-world benchmark
candidate instead (clean portable C89/C99, no platform/threading deps).
Supersedes this evaluation. See task 191 (add a C99 codebase to the suite).done2026-06-17T03:42:18Z2026-06-21T20:02:46Z2026-06-21T20:02:46Z�k�@
c�w555sqlite scope verification result (task 189)Confirmed sqlite scope at commit b1a73ba34d matches audited corpus exactly. (1) audit_corpus_meta.total_inscope_files=220 == audited_files=220 (100pct coverage). (2) 220 audited files == git-tracked in-scope universe on disk (src/ core + shipped ext/) after documented exclusions (test/ tool/ autosetup/jimsh0.c src/test*.c tclsqlite *test* glue ext/jni ext/wasm) -- zero set diff via comm. (3) Of 347 files sqc flagged in run 45, 215 in-scope ALL within the 220 audited (zero gap); other 132 all out-of-scope test/tool/binding/generated glue. score_audited_corpus restricts findings+labels to audited set, so denominators align.done2026-06-16T20:13:12Z2026-06-16T20:13:12Z2026-06-16T20:13:12Z
����
�9��'5��9��55Macro-expansion Phase 2: in-tree function-like macro expansion enginePhase 2 = in-tree function-like macro expansion engine (docs/design/macro-expansion.md §5B/§6). Incremental:
2a (DO�M�:�?�]555Macro-expansion Phase 3: migrate ARR30 onto shared function_macros (re-scoped post-audit)Per docs/design/macro-expansion.md §10 (Phase-3 stock-take, 2026-06-17). The doc's '51 files' is a pre-Phase-1 count; Phases 1/2c already consolidated the heavy hitters. Full per-file audit (§10 disposition table) shows the ONLY rule still duplicating the shared expansion engine is ARR30-C: a local extract_function_macros + dead-code FunctionMacro struct reimplementing context.function_macros. MIGRATE ARR30 to consume context.function_macros (like MEM30/EXP33). Shared macro_expand::FunctionMacro = {params, body} only (no name/line) -> ARR30's 'defined at line N' suggestion must drop/recover the line. check_macro_invocation is LIVE (~60 curl manual-review flags) so gate the flag delta AND Juliet recall (CWE-121/122/787). KEEP: PRE rules, def-side hygiene/naming (MSC38/41, API03/10, DCL37/15/19, EXP44), incidental preproc_ traversal, is_likely_macro_constant heuristics. const_eval-consumer DRY (11 files) split to task 199.done2026-06-16T13:25:06Z2026-06-17T23:41:23Z2026-06-18T01:19:46Z�d�9��3555Macro-expansion Phase 2: in-tree function-like macro expansion enginePhase 2 = in-tree function-like macro expansion engine (docs/design/macro-expansion.md §5B/§6). Incremental:
2a (DONE, 23c2430a): src/analyze/macro_expand.rs — collect_function_macros + textual expand_invocation. 10 unit tests.
2b (DONE): wired collection into prescan pre-pass — ProjectContext.function_macros, cached cross-file, sqc output byte-identical (no consumer yet).
2c (TODO, TARGETS NOW CHOSEN from curl+mosquitto audits — see data/precision_audit/curl/STOCKTAKE.md): wire expander into dataflow consumers. FP-ranked target set:
  TIER 1 (pure opacity, expansion fixes outright, ~600 curl FP): (a) curlx_free/calloc/realloc/strdup/memdup wrappers -> clears 337 DCL31-C outright; (b) CF_DATA_SAVE + dynbuf/uthash(HASH_FIND/HASH_ITER)/utlist(DL_FOREACH_SAFE)/MY_SETOPT do-while -> clears ~280 EXP33/34/ARR00 'uninitialized'.
  TIER 2 (expansion exposes free+null, then task 181 finishes): Curl_safefree (frees AND nulls) -> ~1114 MEM30/31/12 macro-adjacent FP; expansion removes the blindfold, free-state precision (181) does the rest.
  Cross-validated in mosquitto: mosquitto_FREE<->Curl_safefree, DL_FOREACH_SAFE/utlist, HASH_FIND/uthash, SAFE_FREE/SAFE_PRINT. Check hostap (159) before locking.
  Recall-gate Juliet + measure FP delta on curl+mosquitto oracles (both ingested, scorable via audit-score run 46/45). Remove macro_expand allow(dead_code) when consumed.
PHASE 2c-i DONE (commit 37ee3a5e, v0.4.36): curl DCL31 337-FP root cause was macro COLLECTION failure (curlx_* in curl_setup.h, has_error region misparses #define as ERROR+call_expression). Fix: collect_function_macros_textual (secondary error-correcting #define scanner) + DCL31 consumes function_macros. curl uint-spbset.c DCL31 2->0; lib green 3360. GATES RUNNING: juliet sqc-0.4.36-37ee3a5e + realworld sqc-curl/mosquitto-0.4.36-37ee3a5e (rebuild_prescan). ON RESUME: get_status; audit-score curl+mosquitto for FP delta; juliet compare_runs recall gate. NEXT: 2c-ii EXP33/34/ARR00 init-macros (wire expand_invocation into init-state); 2c-iii Curl_safefree->MEM30 (task 181). See memory macro-expansion-phase2c.
2c-i GATES PASSED (run 47 / juliet sqc-0.4.36-37ee3a5e): curl oracle DCL31 FP 337->50 (-85%, pure 
[[
�v��/��555EXP34-C rc==SQLITE_OK / caller-contract FP suppression (~665 sqlite FP)Follow-up to task 168 (which removed sizeof/assert-context FPs, -160). The two largest remaining EXP34-C FP buckets in the sqlite audit need interprocedural/correlation analysis: (1) rc==SQLITE_OK success-path correlation (~327 FP): pointer assigned only on the success path, deref dominated by if/while(rc==SQLITE_OK && ...); requires tracking the rc<->pointer correlation. (2) caller-contract/precondition (~338 FP): param pointer dereferenced in a static helper, non-null guaranteed by the caller; requires interprocedural precondition propagation. CRITICAL: any suppression here must NOT mask the unguarded-malloc null-deref FN pattern (verified still firing as of 0.4.32). Validate Juliet CWE-476 recall stays flat (TP 376/FP 231 baseline).

--- 2026-06-18 bucket 1 DONE (v0.4.48-0.4.50; commits 04d8f23d, 488b6c16, 152c0df7) ---
rc==SQLITE_OK out-parameter success-correlation guard, applied in BOTH is_unsafe_at
and the interprocedural check_callsite_null_args path (the dominant project-mode FP
source, which bypasses is_unsafe_at — that's why the first cut only moved sqlite -35).
Restricted the success constant to SQLITE_OK only (dropped ambiguous ==0/!x, which
inverts polarity for pointer returns and had suppressed a real TP, expert.c:91).
RESULT (realworld, cold): sqlite EXP34-C 1875 -> 1670 (-205); curl/hostap/mosquitto
net 0 (==0 suppressions intentionally reverted for correctness). Aggregate recall
1946 -> 1947 (expert.c:91 TP restored); all 7 adjudicated sqlite EXP34 TPs flag.
Juliet CWE-476 recall provably unchanged: SQLITE_OK does not appear anywhere in the
Juliet corpus, so the guard cannot fire there. EXP34 tests pass (64); FN preserved.
Bucket 2 (interprocedural caller-contract, ~338 FP) is tracked in task 207. Possible
follow-up: typed (int-only) ==0/!x success guard to recover the curl/hostap ~25 FP
safely. Closing 175 on the bucket-1 deliverable (bucket 2 = 207 per owner direction).done2026-06-15T13:57:22Z2026-06-18T20:32:55Z2026-06-19T00:33:45Z�_�1
q�5File mosquitto PR: handle_auth MQTT5 property leakBranch fix/handle-auth-property-leak (off origin/master, signed barrendo@gmail.com). PR body: data/precision_audit/mosquitto/upstream_prs/pr_bodies/pr-01-handle_auth.md. Normal-path leak (auth_method/auth_data freed after callback). Push: git push -u fork <branch>; gh pr create --repo eclipse-mosquitto/mosquitto --base master --head szarta:<branch> --title 'Fix memory leak of MQTT v5 auth properties in handle__auth' --body-file <pr-01>. Add AI-disclosure footer like #3666. Capture valgrind in real env if feasible.pending2026-06-16T12:32:34Z�#�0�	�	5GATE: eclipse-mosquitto#3666 (SRV c-ares cleanup) review/mergeFirst upstream mosquitto PR filed 2026-06-15: https://github.com/eclipse-mosquitto/mosquitto/pull/3666 (combined SRV reply-free + channel-destroy). ECA pass, open, mergeable vs master. Fork szarta/mosquitto, branch fix/srv-ares-resource-cleanup. Mark DONE when it gets a maintainer response/merges; that unblocks filing the remaining mosquitto PRs (calibrate to Roger Light's review style first). See data/precision_audit/mosquitto/upstream_prs/.pending2026-06-16T12:32:15Z
::���3�:�?�C#55Macro-expansion Phase 3: migrate ARR30 onto shared function_macros (re-scoped post-audit)Per docs/design/macro-expansion.md §6. Replace per-rule macro workarounds (FOR_EACH_MACROS, match_initializing_function/get_output_arg_indices, scattered preproc_* handling across ~51 of 290 rule files) with the Phase-1 registry + Phase-2 engine. Delete dead tables. Pay down the macro tech debt; ensure consistency. Heavy regression surface — gate on Juliet recall + real-world FP delta. Depends on Phase 2.in-progress2026-06-16T13:25:06Z2026-06-17T23:41:23Z��<
}�a5Add Windows open-source C tools as real-world benchmarkscurl audit excluded 14 WIN_MAC files (vtls/schannel*, vtls/apple*, system_win32*, curlx/{winapi,version_win32,multibyte}) as out-of-scope for the Linux oracle. These represent a distinct Windows build configuration, not dead code. Need a few good Windows-targeted open-source C codebases (and/or a curl windows-rules config that scopes the schannel/win32 backends) to benchmark WIN*-category rules properly. Bring in windows audit configs at a later date.
CANDIDATE (2026-06-17, user): ReactOS — recommended as a good codebase for idiomatic Windows C. Use to benchmark WIN*-category rules against genuine Windows-targeted code (Win32 API idioms). Permissively licensed (GPL — check license compatibility for inclusion vs. external clone-only use).
LICENSE CLARIFICATION (2026-06-17, user): GPL is NOT a concern — benchmark codebases are cloned externally (not shipped/vendored with tools_sqc), so ReactOS's GPL does not propagate. Proceed as a normal external clone like the other benchmark projects.
SCOPE CAVEAT (2026-06-17, user): ReactOS is very large — a full file-at-a-time FN audit (like curl/sqlite/mosquitto oracles) may be infeasible. Likely viable as a TP/FP exercise only (measure precision on WIN* rules), NOT a complete ground-truth oracle with recall/FN coverage. Consider scoping to a subset of modules if FN audit is desired.
SIZING (2026-06-17, pygount code lines): ReactOS ~/toolchain/reactos = ~5.35M C-family SLOC (C 4,908,659 / 13,897 files + C++ 443,620 / 2,018 files), i.e. ~6.2x the ENTIRE current 5-project suite (~862K). Confirms FN audit is infeasible -> TP/FP precision run, or scope to a few WIN*-relevant modules. Even one full sqc scan is a heavy run vs anything in the current suite. (SLOC ref for current suite: libcrc ~0.75K, mosquitto ~67K, curl ~158K, sqlite ~239K, hostap ~397K C-family.)pending2026-06-16T17:51:33Z�K�=�	�555Confirm sqlite realworld benchmark scope matches audited filescurl established that the benchmark scoring scope should match the audited oracle file set (WIN_MAC excluded for curl). Verify the sqlite benchmark run's scored/scoped files match exactly the in-scope files that were audited in data/precision_audit/sqlite/ (core src/ + shipped ext/, excluding autosetup/jimsh0.c, tool/, test/, src/test*.c, ext/jni, ext/wasm). Ensure realworld-score and the dashboard denominators align with the adjudicated corpus.done2026-06-16T17:51:33Z2026-06-16T20:12:57Z2026-06-16T20:13:11Z33Z�d�;�3�a5Macro-expansion Phase 4 (optional, opt-in): compile_commands.json preprocessed modePer docs/design/macro-expansion.md §5(C)/§6. Opt-in flag to run a real preprocessor (cpp/clang -E) using compile_commands.json for full system-header expansion correctness, with #line source-location back-mapping. NEVER the default — breaks the no-build-system usability model. Only for users who already have a compile DB. High effort/risk; lowest priority.pending2026-06-16T13:25:06Z
xx��>�3�!5Fix API05-C: unsound trigger (any size_t -> flag any pointer); then advisory triagecurl audit: API05-C = 1062 findings, ~all FP. Root cause is a RULE DEFECT, not just non-adoption (verified by reading src/rules/cert_c/API/API05-C/api05_c.rs + curl signatures):

THE BUG: check fires on any char/void/int-ish pointer param whenever the signature has ANY size_t param ANYWHERE (api05_c.rs:195 has_size_t_param && is_plain_pointer_param). It never associates the size_t with the flagged pointer. So:
 - FALSE: async_ares_rr_done(void *user_data, ..., size_t timeouts, ...) flags void *user_data (opaque callback ctx, unrelated to timeouts). Also hits NUL-terminated const char* strings and char** out-params.
 - The 3 'size variable declared after the array' findings: uint64_t H[SHA512_256_HASH_SIZE_WORDS] — a #define macro constant mistaken for a later-declared PARAMETER (macro-opacity).
 - COINCIDENTALLY-CORRECT: chunk_append(const uint8_t *buf, size_t len), Curl_alpn2alpnid(name,len) — real C99 candidates, but the rule got them right only because buf is the sole counted pointer.

WHY IT MATTERS: the rule would also misfire on a C99-COMPLIANT codebase (flags void*/strings/**-out-params in any fn that has a size_t). conformant char p[n] params ARE correctly skipped, but mixed signatures still false-fire. So fix the rule, don't just disable.

FIX: (1) only fire when an integer param can be tied to the flagged pointer as element count (pointer indexed / memcpy/memset by that size in body); (2) exclude void*, NUL-terminated const char*, pointer-to-pointer; (3) declared-after check must resolve #define/enum constants (not treat a macro constant as a later param). THEN (4) decide advisory-only/disabled-by-default in conf/realworld base for the residual correct-but-unadopted findings. Recall-gate Juliet (API05 test cases) + re-measure curl/mosquitto oracle precision.pending2026-06-16T19:40:54Z


�)�?�	�e#55Add a C99-compliant codebase to the real-world benchmark suiteAll 5 current real-world codebases (libcrc, sqlite, mosquitto, curl, hostap) are conservative C89/C90-style — they avoid C99 conformant array parameters and other modern-C99 idioms. This leaves rules that CHECK C99 conformance with no positive-validation target: their TPs can never be confirmed, only their FPs on non-adopting code measured.

Concrete driver (task 190): API05-C 'use conformant array parameters' fired 1062x on curl, ~all FP — but with NO codebase that actually uses 'void f(size_t n, char buf[n])' syntax, we can't validate that the rule correctly CREDITS conformant usage / correctly flags genuine non-conformance. Same gap likely affects other C99-targeting checks.

TASK: pick a permissively-licensed C codebase that genuinely adopts C99 idioms (conformant/VLA array params, designated initializers, compound literals, _Bool/stdbool, mixed declarations, restrict). Candidates to evaluate: a numerics/DSP or embedded lib that uses VLA params; modern crypto (e.g. monocypher), a modern parser, or a C99-style utility lib. Verify it actually contains conformant-array-parameter signatures (grep for 'type name[var]' param forms) before adopting. Then:
 1. clone pinned to a commit under ~/toolchain/<name>; add ~/data-enterprise/<name>-main for trunk cross-ref.
 2. add to PROJECTS in mcp_servers/realworld_server.py (sqc/cppcheck/clang-tidy include+source dirs) + conf/realworld/<name>-rules.toml.
 3. run + ingest a baseline; build the ground-truth oracle (file-at-a-time audited corpus, adversarial pass) like curl/mosquitto.
Goal: a codebase where API05-C and other C99-conformance rules have real TPs to validate against, complementing the C89-style majority. Relates to 190 (API05-C correctness fix).
NOTE (2026-06-16): split into two tracks after Melon/cgltf discussion. Melon evaluation (explicit --c99 mode; possible dual C99+macro oracle) = separate candidate task. Synthetic-conformance-corpus option for API05-C's '[static N]' (which no real codebase uses) = separate exploration task. This task (191) stays scoped to a REAL idiomatic-C99 codebase for the broader conformance rules (designated inits/compound literals/FAM/restrict/_Bool). cgltf evaluated + rejected for this goal (too conservative on structural C99).
CANDIDATE (2026-06-17, user): Lua 5.2 — recommended as a good codebase for idiomatic C99. Permissively licensed (MIT). Evaluate for C99-conformanc�s�?�	�_555Add a C99-compliant codebase to the real-world benchmark suiteAll 5 current real-world codebases (libcrc, sqlite, mosquitto, curl, hostap) are conservative C89/C90-style — they avoid C99 conformant array parameters and other modern-C99 idioms. This leaves rules that CHECK C99 conformance with no positive-validation target: their TPs can never be confirmed, only their FPs on non-adopting code measured.

Concrete driver (task 190): API05-C 'use conformant array parameters' fired 1062x on curl, ~all FP — but with NO codebase that actually uses 'void f(size_t n, char buf[n])' syntax, we can't validate that the rule correctly CREDITS conformant usage / correctly flags genuine non-conformance. Same gap likely affects other C99-targeting che
���������zjYE0"������tWI2
�
�
�
�
�
�
�
m
\
M
<
.

��������yn]R;'������}m\M<.
�
�
�
�
�
�
�
|
i
Z
I
8
$

	�	�	�	�	�	�	�	r	c	U	A	3		�������ugWE/!���������~s]PA0�������o[G1������iYI5$��������obRE5(��������u_I7����h>���;	fp-reduction,robustness�;fp-reduction,robustness�;fp-reduction,robustness�;fp-reduction,robustness'�Qfp-reduction,robustness,mem-family�;fp-reduction,robustness#�Ifp-reduction,robustness,dcl01c#�Ifp-reduction,robustness,int33c�;fp-reduction,robustness�;fp-reduction,robustness#�I�fio22c,fp-reduction,robustness�!�robustness�)�infrastructure�)�infrastructure�!�robustness�)�infrastructure�)�rule-hardening�%�fp-reduction�
�ci
��knots
��refactor
�
�knots
�	�refactor
��knots
��refactor
��knots
��refactor
��knots
��refactor
��knots
��refactor
��knots
��refactor
�~�knots
�}�refactor
�|�knots
�{�refactor
�z�knots
�y�refactor
�x�knots�w�recall�v)�rule-hardening�u�benchmark�t%�fp-reduction
�s�security
�r�upstream�q)�rule-hardening�p%�fn-reduction�o)�rule-hardening�n%�fp-reduction
�m�security
�l�upstream�k)�rule-hardening�j%�fp-reduction�i)�rule-hardening�h%�fp-reduction�g)�rule-hardening�f%�fp-reduction�e%�preprocessor�d)�rule-hardening�c%�fp-reduction�b)�rule-hardening�a%�fp-reduction
�`�audit�_�c99�^%�ground-truth�]�realworld�\%�ground-truth�[�c99�Z�realworld�Y�benchmark�X�wontfix
�W�paper�V)�infrastructure�U�bug�T�bug�S�bug�R�bug
�Q�infra
�P�infra�O�realworld�N%�ground-truth�M�c99�L�benchmark�K)�rule-relevance�J�realworld�I�config�H)�infrastructure�G!�evaluation
�F�research�E�con03c�D�benchmark�C%�fp-reduction�B�benchmark
�A�bench�@�benchmark�?7�sqlite-audit-followup�>�recall�=%�fn-detection�<�arr30c�;7�sqlite-audit-followup�:�recall�9%�fn-detection�8�arr30c�7�prescan�6)�infrastructure�5�benchmark�4�juliet�3�benchmark�27�sqlite-audit-followup�1%�fp-reduction�0�exp34c�/�benchmark�.�arr30c�-�arr38c�,%�fp-reduction�+�benchmark�*�benchmark�)�prescan�(#�performance�'�str31c
�&�paper�%)�cross-function�$%�fp-reduction�#�str31c�"'�observability�!�tooling� �benchmark�)�cross-function�%�fp-reduction��fio30c��tech-debt��tooling��tech-debt
��refactor�+�macro-expansion��realworld��mem30c�%�fp-reduction�)�infrastructure�!�robustness�%�fp-reduction�%�preprocessor
��analysis�%�fp-reduction�+�macro-expansion�
�c99��benchmark��c99�
�benchmark�	�sqlite��benchmark�%�ground-truth��c99��realworld��benchmark��api05c��triage�%�fp-reduction�%�ground-truth��sqlite�~�benchmark�}�windows�|�benchmark�{%�architecture�z+�macro-expansion�y�tech-debt
�x�refactor�w+�macro-expansion�v)�infrastructure�u%�architecture�t+�macro-expansion
�s�spike�r%�architecture�q+�macro-expansion�p�triage�o7�sqlite-audit-followup�n%�fp-reduction�m)�raise-evidence�l7�sqlite-audit-followup�k%�fp-reduction�j�mem12c�i�mem30c�h'�cross-project�g%�fp-reduction�f�exp34c�e�exp33c�d'�cross-project�c%�fp-reduction�b�realworld
�a�upstream�`�mosquitto�_�realworld
�^�upstream�]�mosquitto�\�realworld
�[�upstream�Z�mosquitto�Y�realworld
HH2�S�#��?#55sqlite file-at-a-time: batches 2+ (191/220 files remaining)Continue sqlite file-at-a-time audited corpus vs config-correct run #40, denominator 220. Coverage 107/220 (48.6%) as of 2026-06-12. Done thru batch8: vdbeaux/select; b3 (8 decoders); b4 (json/geopoly/recover/fts5_hash/normalize); b5 (rbu/spellfix/qrf/fts3 tokenizers); b6 (rtree/date/amatch/checkindex/fuzzer/utf); b7 (changesetfuzz/fileio/series+build.c/os_unix.c); b8 (MEDIUM-effort core filler: os_win.c/main.c/util.c/vdbeapi.c, 1657 findings -> 31 TP/1626 FP, 0 semantic TP, 0 FN). 13 confirmed real bugs (ALL untrusted-input parsers), 13 FNs, still NO production hardened-core semantic TP (4 core files build/os_unix/os_win/main = 2828 findings, 0). EFFORT POLICY (user 2026-06-12): MEDIUM effort for pure hardened-core/glue fi�(�#���M555sqlite file-at-a-time: batches 2+ (191/220 files remaining)Continue sqlite file-at-a-time audited corpus vs config-correct run #40, denominator 220. Coverage 107/220 (48.6%) as of 2026-06-12. Done thru batch8: vdbeaux/select; b3 (8 decoders); b4 (json/geopoly/recover/fts5_hash/normalize); b5 (rbu/spellfix/qrf/fts3 tokenizers); b6 (rtree/date/amatch/checkindex/fuzzer/utf); b7 (changesetfuzz/fileio/series+build.c/os_unix.c); b8 (MEDIUM-effort core filler: os_win.c/main.c/util.c/vdbeapi.c, 1657 findings -> 31 TP/1626 FP, 0 semantic TP, 0 FN). 13 confirmed real bugs (ALL untrusted-input parsers), 13 FNs, still NO production hardened-core semantic TP (4 core files build/os_unix/os_win/main = 2828 findings, 0). EFFORT POLICY (user 2026-06-12): MEDIUM effort for pure hardened-core/glue filler, but KEEP HIGH effort + rigorous FN-hunt for the remaining genuine-untrusted-input files even though they're core: pager.c 429, wal.c 414, func.c 312, printf.c 249, vdbesort.c 223. Integrity gate (source-verify every semantic TP / FN candidate) is non-negotiable at any effort. Remaining in-scope ~113 files, mostly core/glue filler: expr.c 453, wherecode.c 226, window.c 216, analyze.c 211, vdbemem.c 193, insert.c 182, alter.c 178, sqliteInt.h 177, pragma.c 164, trigger.c 161, prepare.c 146, whereexpr.c 146, os_kv.c 138, fkey.c 123, vtab.c 110, utf.c done, ... Next: a HIGH-effort batch of pager/wal/func/printf/vdbesort, then resume medium-effort filler. Framework: /tmp/core_framework.md (core), /tmp/batch_framework.md (decoders). DISCLOSURE BACKLOG below.


DISCLOSURE BACKLOG (defer sqlite-team reports until FULL audit complete — user 2026-06-12): re-scan ground_truth verdict='FN' for live-at-HEAD items at report time. Only live-at-HEAD confirmed bug = amatch.c:1160 heap-overflow WRITE, but amatch is sqlite-labeled 'unused demonstration code'. changesetfuzz.c:506 INT32 overflow is tool-scope (standalone CLI). util.c:1328 GetUInt32 2^32 off-by-one noted-not-recorded (benign). All other confirmed bugs already fixed upstream or read/leak FNs in demo/repair/tool extensions.
BATCH 9 DONE (2026-06-14, HIGH-effort genuine-untrusted-input core): pager.c/wal.c/func.c/printf.c/vdbesort.c via untrusted-input framework + 17 reviewers + integrity gate. 1752 findings -> 79 TP / 1673 FP, 0 semantic TP, 1 FN. All 79 TP decl/macro/recursion (DCL13/MSC04/PRE/DCL03). Coverage 107 -> 112/220 (50.9%). FNs 13 -> 14. CSVs: data/precision_audit/sqlite/adjudication_sqlite_{pager,wal,func,printf,vdbesort}.csv; README batch-9 entry appended. Bifurcation now confirmed across the 5 genuine-untrusted-input core files too: 0 production semantic TP. NEXT: resume MEDIUM-effort core/glue filler (expr.c 453, wherecode.c 226, window.c 216, analyze.c 211, vdbemem.c 193, insert.c 182, alter.c 178, pragma.c 164, trigger.c 161, prepare.c 146, whereexpr.c 146, os_kv.c 138, fkey.c 123, vtab.c 110, ...).

DISCLOSURE BACKLOG ADD (batch9): pager.c:1335 readSuperJournal off-by-one (ARR30-C,,
��
��W�Y�	�'555Find an idiomatic structural-C99 codebase for conformance-rule validation (API05-C / designated-init / restrict / FAM / _Bool)Spun off from task 191. Lua (now in the suite as a general oracle) turned out
to be PORTABILITY-C99, not STRUCTURAL-C99: it uses long long / snprintf /
strtod / %a (gated behind !LUA_USE_C89) but ZERO designated initializers,
compound literals, _Bool/stdbool, restrict, flexible array members, or
conformant array parameters (verified 2026-06-21 by grep over the pinned
checkout). So it gives no positive-validation target for API05-C or the other
C99-conformance rules — same reason cgltf was rejected earlier.

GOAL (unchanged from 191's original rationale): find a permissively-licensed C
codebase that GENUINELY uses structural C99 idioms, so the conformance rules
have real TPs to validate against (not just FPs measured on non-adopting code).

Verify BEFORE adopting (the lesson from Lua + cgltf): grep the actual checkout
for the idioms, don't trust the project's reputation as "modern C":
  - conformant/VLA array params:  f(size_t n, char buf[n])  /  buf[static N]
  - designated initializers in aggregate inits:  = { .field = ..., [i] = ... }
  - compound literals:  (struct T){ ... }
  - _Bool / <stdbool.h>, restrict, flexible array members ( x[]; at struct end )
  - mixed declarations-after-statements

Candidate directions: numerics/DSP or scientific libs (often use VLA params),
modern crypto (monocypher was floated), modern parsers/codecs. API05-C's
'[static N]' specifically may have NO real-world user at all -> that sliver
stays on the synthetic-conformance-corpus track (task 194), not here.

Relates to: 191 (Lua added there as general oracle), 190 (API05-C correctness),
194 (synthetic C99 corpus), 216 (project-relevance gating).
FINDING (2026-06-23): raylib is the structural-C99 codebase. Verified by a high-precision idiom detector calibrated so Lua -> 0 across all idioms (loose grep gave Lua 100+ false hits from 'if(x){', 'obj.field=', local 'buf[SIZE]' — useless; tightened to anchor designated-inits to {/,/line-start, restrict compound literals to value-position tagged/typedef types excluding control kw, and use the unambiguous '[static' token for API05-C). raylib @962bbfc (zlib license, permissive): its 7 OWN .c TUs (rcore/rshapes/rmodels/rtext/rtextures/raudio/rglfw) carry 166 compound literals + 61 designated-init fields; (Vector2){x,y}/(Color){...}/(Rectangle){...} — the compound-literal idiom is ABSENT from every existing suite member and from Lua/monocypher. Exclude src/external/ (98 bundled glad/dr_mp3/glfw files). monocypher REJECTED (portability-C99 like Lua: 8 designated, 0 compound, 1 restrict — reputation failed the grep again). Existing suite ALREADY covers the other structural idioms: hostap 918 designated-field +202 designated-index +45 FAM; sqlite 167 designated; curl/mosquitto FAM+restrict+stdbool. _Bool spelled literally is rare (codebases use <stdbool.h> bool); gd_toolchain=newlib has the only literal _Bool (15). API05-C '[static N]': ZERO real-world adoption anywhere (only a doc comment in newlib cdefs.h) — confirms 194's synthetic-only call. Adoption into the realworld suite spun off as a follow-up.done2026-06-21T20:27:57Z2026-06-23T14:43:02Z2026-06-23T15:17:58Z�R�Z
�)555MCP realworld server leaks zombie children (doesn't reap)mcp_servers/realworld_server.py spawns cppcheck/clang-tidy subprocesses but never wait()s on them after capturing output, so finished children become defunct zombies (Zs state). This makes PID-based liveness checks unreliable: a clang-tidy run that finished in ~1min showed as 'alive' for ~3h via ps -p <pid>. Fix: ensure the server reaps child processes (proc.wait()/communicate() completion) so PIDs free correctly. Surfaced during Lua baseline run (task 191).done2026-06-21T23:44:17Z2026-06-22T21:53:04Z2026-06-22T21:57:40Z
[KK����$�1�K5Upstream contribution: report/PR genuine findings back to benchmarked OSS projectsTrunk-validated. SQLITE (sqlite-main 124f449319): 3 genuine bugs ALREADY FIXED upstream (session OOB-read 535b1f2875+4da2ddf50e; sqlar heap-overflow 34e139d3a3; compress null-derefs 1c0a370472) -> no action, validation wins. 2 STILL PRESENT, low-severity contribution candidates: fts5 fts5SegmentSize 1+pgnoLast-pgnoFirst overflow (~1485/1551, contained); pcache.h broken include guard (~16, harmless-in-amalgamation). LIBCRC (lammertb/libcrc): upstream HEAD == our audited pin 7719e21, UNMAINTAINED since 2021-04-21 -> all 13 TP + 1 FN still present but project abandoned (weak PR targets; CON03 race is a known documented libcrc limitation). NET actionable upstream contributions = the 2 still-present sqlite hardening items only, low priority, with AI-attribution disclosure. Do after full suite per user.
mosquitto PR drafts ready (2026-06-15): data/precision_audit/mosquitto/upstream_prs/ — 00-INDEX.md + 11 per-defect reports (root cause vs mainline d3dd4463, valgrind/ASan or fault-injection repro, fix diff). Net 9 file-a-PR defects + 1 defensive guard; #05 tls_opts_set withdrawn (not a bug). PR order: 01 handle_auth MQTT5 leak, 02 srv_mosq ares leak, 11 persist_write double-fclose (all normal/valgrind-reproducible) first. User installing gh to post. Prior-art checked vs eclipse-mosquitto issues.pending2026-06-12T02:10:48Z�p�%�I�555SECURITY (candidate): sqlite changeset invert/concat OOB-read via sessionChangesetBufferRecordAudit of ext/session/sqlite3session.c @ b1a73ba34d found a candidate out-of-bounds read. sessionChangesetBufferRecord (raw-record fast path for sqlite3changeset_invert/_concat/changegroup) reads field lengths via the UNSAFE sessionVarintGet (no buffer bound) and accumulates 'nByte += n' (lines 3691/3692/3695) with no nByte<0/overflow/bounds check -- unlike the validated sessionReadRecord path (which uses sessionVarintGetSafe + 'nByte>nData-iNext -> CORRUPT'). For non-streaming input sessionInputBuffer is a no-op (no bound). Callers use the unbounded nByte without validating vs input size: invert does sessionAppendBlob(&sOut,&aData[iNext],nByte) at ~4187, iterator does iNext+=nByte at ~3848. A crafted changeset with an inflated field-length varint -> signed overflow + OOB read of the application's changeset buffer. 4 INT32-C TP + 14 INT31-C uncertain (merge/rebase sessionSerialLen->memcpy consumers), 2 subagents corroborated. ACTIONS: (1) confirm still present on current sqlite trunk; (2) build a crafted-changeset PoC repro under ASAN; (3) if confirmed, RESPONSIBLE DISCLOSURE to sqlite (not a public PR) -- this is widely deployed. Disclose AI-assisted discovery per attribution norms. Relates to task 164.done2026-06-12T12:16:27Z2026-06-12T12:37:09Z2026-06-12T12:37:09Z��1�]5Upstream contribution: report/PR genuine findings back to benchmarked OSS projectsTrunk-validated. SQLITE (sqlite-main 124f449319): 3 genuine bugs ALREADY FIXED upstream (session OOB-read 535b1f2875+4da2ddf50e; sqlar heap-overflow 34e139d3a3; compress null-derefs 1c0a370472) -> no action, validation wins. 2 STILL PRESENT, low-severity contribution candidates: fts5 fts5SegmentSize 1+pgnoLast-pgnoFirst overflow (~1485/1551, contained); pcache.h broken include guard (~16, harmless-in-amalgamation). LIBCRC (lammertb/libcrc): upstream HEAD == our audited pin 7719e21, UNMAINTAINED since 2021-04-21 -> all 13 TP + 1 FN still present but project abandoned (weak PR targets; CON03 race is a known documented libcrc limitation). NET actionable upstream contributions = the 2 still-present sqlite hardening items only, low priority, with AI-attribution disclosure. Do after full suite per user.pending2026-06-12T02:10:48Z
����������raP?.��������sbQ)C5
�
�
�
�
�
�
�
�
�
c
W
}
o
/
#
I
;�

���������^Rwj*D6�������~r��JdV <.
�
�
�
�
�
�
�
�
r
d
�
~
<
0
V
H

"
	�	�	�	�	�	�	�	�	�	h	�	t	@	Z	L		2	$�		��������yj]N?2#���������uhYJ;,���������zm^O@1"���������rcVG8+
���������}n_RC4'���������{n_PA4'	���������qbSB3$Wbenchmark�Vv0.3.78�Vrelease�Vchanged�Vbenchmark�Uv0.3.77�Urelease�Uchanged�Ubenchmark�Tv0.3.76�Trelease�Tchanged�Tbenchmark�Sv0.3.75�Srelease�Sadded�Rv0.3.74�Rresults�Rrelease�Rfixed�Radded�Qv0.3.67�Qresults�Qrelease�Qfixed�Pv0.3.66�Prelease�Padded�Ov0.3.65�Orelease�Ofixed�Nv0.3.64�Nrelease�Nadded�Mv0.3.63�Mrelease�Mfixed�Madded�Lv0.3.62�Lrelease�Lfixed�Kv0.3.61�Krelease�Kadded�Jv0.3.60�Jresults�Jrelease�Jadded�Iv0.3.59�Iresults�Irelease�Iadded�Hv0.3.58�Hresults�Hrelease�Hadded�Gv0.3.57�Grelease�Gfixed�Fv0.3.56�Frelease�Fadded�Ev0.3.52�Eresults�Erelease�Echanged�Dv0.3.51�Drelease�Dadded�Cv0.3.50�Crelease�Cchanged�Bv0.3.49�Brelease�Bchanged�Av0.3.48�Arelease�Afixed�Achanged�Aadded�@v0.3.47�@results�@release�@changed�?v0.3.46�?results�?release�?changed�>v0.3.44�>results�>release�>changed�=v0.3.43�=release�=added�<v0.3.42�<release�<fixed�<changed�;v0.3.39�;release�;fixed�:v0.3.38�:release�:fixed�:changed�9v0.3.37�9release�9fixed�8v0.3.36�8release�8added�7v0.3.35�7release�7fixed�7changed�7added�6v0.3.34�6release�6fixed�5v0.3.33�5changed�5removed�5release�4fixed
4v0.3.32~
4release}3fixed|
3v0.3.31{
3releasez2fixedy
2v0.3.30x
2releasew
1changedv1addedu
1v0.3.28t
1releases0fixedr
0changedq0addedp
0v0.3.27o
0releasen/fixedm
/v0.3.26l
/releasek.fixedj.addedi
.v0.3.25h
.releaseg
-changedf-addede
-v0.3.24d
-releasec
,changedb,addeda
,v0.3.23`
,release_+fixed^
+v0.3.22]
+release\*added[
*v0.3.21Z
*releaseY
)changedX
)v0.3.20W
)releaseV(fixedU
(v0.3.19T
(releaseS'fixedR'addedQ
'v0.3.18P
'releaseO&addedN
&v0.3.17M
&releaseL%addedK
%v0.3.15J
%releaseI$fixedH
$v0.3.14G
$releaseF#fixedE#addedD
#v0.3.13C
#releaseB"fixedA"added@"v0.3.8?
"release>!added=!v0.3.5<
!release; fixed: v0.3.39
 release8fixed7
v0.2.256
release5fixed4
v0.2.223
release2fixed1added0
v0.2.21/
release.fixed-added,
v0.2.20+
release*fixed)
v0.2.17(
release'added&
v0.2.16%
release$fixed#added"
v0.2.15!
release fixed
changedadded
v0.2.13
release!plan-id:71!plan-id:70!plan-id:69!plan-id:68!plan-id:67!plan-id:66!plan-id:65!plan-id:64!plan-id:63!plan-id:62!
plan-id:61!plan-id:60!plan-id:59!
plan-id:53
!	plan-id:51!plan-id:49!plan-id:47
!plan-id:37	!plan-id:27!plan-id:20deferred!plan-id:10deferredplan-id:9
	deferred
		plan-id:8
�z��������rcTC4%��������z��������ufUF7(
���������rcVG8)
�
�
�
�
�
�
�
�
�
t
c
T
E
6
%

��������|m^N=.���������qbR@.
�
�
�
{
Y
0
	�	�	�	�	d	B	 	���������tePD/ �������}nY.�������mXA,��������kTB+��������teG8#������strateg7%�fp-reduction�7�sqlite-audit-followup�%�fp-reduction��api00c�7�sqlite-audit-followup�%�fp-reduction��exp34c�7�sqlite-audit-followup��mem30c�%�fp-reduction��sqc��research��upstream��sqlite��security��upstream��security��realworld��sqlite��realworld�%�ground-truth��benchmark��sqlite��realworld�%Wchanged�Wbenchmark�Vv0.3.78�Vrelease�Vchanged�Vbenchmark�Uv0.3.77�Urelease�Uchanged�Ubenchmark�Tv0.3.76�Trelease�Tchanged�Tbenchmark�Sv0.3.75�Srelease�Sadded�Rv0.3.74�Rresults�Rrelease�Rfixed�Radded�Qv0.3.67�Qresults�Qrelease�Qfixed�Pv0.3.66�Prelease�Padded�)�infrastructure��realworld�)�infrastructure�%�ground-truth��benchmark�!�robustness�)�infrastructure�
�paper��researchF!�evaluationG�con33c��con07c��con03cE�strategy�%�architecture�)�infrastructure�%�fp-reduction��realworld�
�paper��benchmark�
�paper%�fp-reduction~�int32c|�int30c}%�fp-reduction{�benchmarkz%�fp-reductiony�benchmarkx*Q�fp-reduction,str31c,cross-functionw%�fp-reductionu�fio30cv
�papert%�fp-reductionr#�concurrencys�vraq7�sqlite-audit-followup��int32cn�int31co�int30cp%�fp-reductionm�str31cl%�fp-reductionk�vraj%�fp-reductionh�arr30ci�testingg
�buildf
�rulese
�rulesd
�uxc�testingb#�reliabilitya
�build`#�diagnostics_#�performance^build]!A~fp-reduction,cert-c,exp15c\!A}fp-reduction,cert-c,pre07c[!A|fp-reduction,cert-c,exp02cZ!A{fp-reduction,cert-c,arr39cY!Azfp-reduction,cert-c,pre10cX!Ayfp-reduction,cert-c,flp00cW!Axfp-reduction,cert-c,msc37cV!Awfp-reduction,cert-c,mem05cU(Ovfp-reduction,cert-c,exp33c,arr00cT!Aufp-reduction,cert-c,mem30cS(Otfp-reduction,cert-c,dcl07c,dcl31cR(Osfp-reduction,cert-c,int32c,int10cQ+Urint31c,fp-reduction,cert-c,benchmarkP!pplan-id:49OobenchmarkN!nplan-id:49M!mplan-id:49L!lplan-id:49Kkv0.3.104HkreleaseGkchangedJkbenchmarkIjv0.3.103DjreleaseCjchangedFjbenchmarkEiv0.3.102@irelease?ichangedBibenchmarkAhv0.3.101<hrelease;hchanged>hbenchmark=gv0.3.1009grelease8gchanged:fv0.3.995frelease4fchanged7fbenchmark6ev0.3.981erelease0echanged3ebenchmark2dv0.3.97-drelease,dchanged/dbenchmark.cv0.3.93)crelease(cchanged+cbenchmark*bv0.3.92%brelease$bchanged'bbenchmark&av0.3.91!arelease achanged#abenchmark"`v0.3.90`task`release`changed_v0.3.87_release_changed_added^v0.3.86^release^changed^benchmark]v0.3.85]release]changed\v0.3.84\release\changed[v0.3.83[release[changed
Zv0.3.82ZreleaseZchanged
Zbenchmark	Yv0.3.81YreleaseYchangedYbenchmarkXv0.3.80Xrelease�XchangedXbenchmarkWv0.3.79�Wrelease�
��#��vdO=+�������vdO@.�������{jYJ9(������tVA#���}nYJ,������{fH6$
�
�
�
�
�
�
�
t
^
O
@
+

������eVA)������o]M;&
�
�
�
�
�
�
�
~
l
`
N
B
-

	�	�	�	�	�	�	z	b	Q	?	-		��������������~gR=&�������kT?(�������{m\N=/�����������
�ci����knots�
�knots��refactor�
�knots��refactor�
�knots��refactor�
�knots��refactor�
�knots��refactor
�knots~�refactor}
�knots|�refactor{
�knotsz�refactory
�knotsx)�rule-hardeningv�recallw�benchmarku%�fp-reductiont�upstreamr�securitys)�rule-hardeningq%�fn-reductionp)�rule-hardeningo%�fp-reductionn�upstreaml�securitym)�rule-hardeningk%�fp-reductionj)�rule-hardeningi%�fp-reductionh)�rule-hardeningg%�fp-reductionf)�rule-hardeningd%�preprocessore%�fp-reductionc)�rule-hardeningb%�fp-reductiona�realworld]%�ground-truth^�c99_
�audit`�realworldZ%�ground-truth\�c99[�benchmarkY
�pap7�sqlite-audit-followup�%�fp-reduction�7�sqlite-audit-followup�%�fp-reduction��api00c�7�sqlite-audit-followup�%�fp-reduction��exp34c�7�sqlite-audit-followup��mem30c�%�fp-reduction��sqc��research��upstream��sqlite��security��upstream��security��realworld��sqlite��realworld�%�ground-truth��benchmark��sqlite��realworld�%�ground-truth��benchmark��realworld��libcrc�%�ground-truth��benchmark�%�ground-truth��benchmark��realworld��hostap�%�ground-truth��benchmark��realworld�%�ground-truth��curl��benchmark��realworld��mosquitto�%�ground-truth��benchmark��sqlite�)�cross-function%�tooling!
�paper&'�observability"�benchmark %�fp-reduction�fio30c)�cross-function�tooling�tech-debt�tech-debt�refactor+�macro-expansion�realworld�mem30c%�fp-reduction!�robustness)�infrastructure%�fp-reduction%�preprocessor�analysis+�macro-expansion%�fp-reduction�c99
�benchmark�c99�benchmark
�sqlite	�benchmark�realworld%�ground-truth�c99�benchmark�triage%�fp-reduction�api05c�sqlite�%�ground-truth�benchmark��windows��benchmark�+�macro-expansion�%�architecture��tech-debt��refactor�+�macro-expansion�+�macro-expansion�)�infrastructure�%�architecture�
�spike�+�macro-expansion�%�architecture��triage�7�sqlite-audit-followup�%�fp-reduction�7�sqlite-audit-followup�)�raise-evidence�%�fp-reduction��mem30c��mem12c�%�fp-reduction�'�cross-project�%�fp-reduction��exp34c��exp33c�'�cross-project��upstream��realworld��mosquitto��upstream��realworld��mosquitto��upstream��realworld��mosquitto��upstream��realworld��mosquitto�7�sqlite-audit-followup�%�fp-reduction��exp34c�7�sqlite-audit-followup��recall��int31c�%�fn-detection�7�sqlite-audit-followup��recall�%�fn-detection��exp34c�7�sqlite-audit-followup��recall�%�fn-detection��arr30c��strategy�7�sqlite-audit-followup�%�fp-reduction��triage�	�re�realworld�%�ground-truth�

&��������zjZJ:*
��������zj]PE8- 
�
�
�
�
�
�
�
�
�
�
�
v
i
^
S
F
9
.
!

	�����������xmbUH=0#�����������wj]RE8- 
�
�
�
�
�
�
�
�
�
�

t
g
Z
O
B
7
*


	�	�	�	�	�	�	�	�	�	�	z	l	^	P	B	6	(			���������zn`RF8*���������xj\N@2$
����������tfXJ<."����������rfXJ<0"����������vh\N@4&
����������tfVH:,��������~n`RD4&�
Zchanged
�	Zbenchmark�Zv0.3.82�Zrelease�Ychanged
�Ybenchmark�Yv0.3.81�Yrelease�Xchanged
�Xbenchmark�Xv0.3.80�Xrelease�~Wchanged
�}Wbenchmark�|Wv0.3.79�{Wrelease�zVchanged
�yVbenchmark�xVv0.3.78�wVrelease�vUchanged
�uUbenchmark�tUv0.3.77�sUrelease�rTchanged
�qTbenchmark�pTv0.3.76�oTrelease	�nSadded�mSv0.3.75�lSrelease�kRresults	�jRfixed	�iRadded�hRv0.3.74�gRrelease�fQresults	�eQfixed�dQv0.3.67�cQrelease	�bPadded�aPv0.3.66�`Prelease	�_Ofixed�^Ov0.3.65�]Orelease	�\Nadded�[Nv0.3.64�ZNrelease	�YMfixed	�XMadded�WMv0.3.63�VMrelease	�ULfixed�TLv0.3.62�SLrelease	�RKadded�QKv0.3.61�PKrelease�OJresults	�NJadded�MJv0.3.60�LJrelease�KIresults	�JIadded�IIv0.3.59�HIrelease�GHresults	�FHadded�EHv0.3.58�DHrelease	�CGfixed�BGv0.3.57�AGrelease	�@Fadded�?Fv0.3.56�>Frelease�=Eresults�<Echanged�;Ev0.3.52�:Erelease	�9Dadded�8Dv0.3.51�7Drelease�6Cchanged�5Cv0.3.50�4Crelease�3Bchanged�2Bv0.3.49�1Brelease	�0Afixed�/Achanged	�.Aadded�-Av0.3.48�,Arelease�+@results�*@changed�)@v0.3.47�(@release�'?results�&?changed�%?v0.3.46�$?release�#>results�">changed�!>v0.3.44� >release	�=added�=v0.3.43�=release	�<fixed�<changed�<v0.3.42�<release	�;fixed�;v0.3.39�;release	�:fixed�:changed�:v0.3.38�:release	�9fixed�9v0.3.37�9release	�8added�
8v0.3.36�8release	�7fixed�
7changed	�	7added�7v0.3.35�7release	�6fixed�6v0.3.34�6release�5removed�5changed�5v0.3.33�5release	4fixed~4v0.3.32}4release	|3fixed{3v0.3.31z3release	y2fixedx2v0.3.30w2releasev1changed	u1addedt1v0.3.28s1release	r0fixedq0changed	p0addedo0v0.3.27n0release	m/fixedl/v0.3.26k/release	j.fixed	i.addedh.v0.3.25g.releasef-changed	e-addedd-v0.3.24c-releaseb,changed	a,added`,v0.3.23_,release	^+fixed]+v0.3.22\+release	[*addedZ*v0.3.21Y*releaseX)changedW)v0.3.20V)release	U(fixedT(v0.3.19S(release	R'fixed	Q'addedP'v0.3.18O'release	N&addedM&v0.3.17L&release	K%addedJ%v0.3.15I%release	H$fixedG$v0.3.14F$release	E#fixed	D#addedC#v0.3.13B#release	A"fixed	@"added
?"v0.3.8>"release	=!added
<!v0.3.5;!release	: fixed
9 v0.3.38 release	7fixed6v0.2.255release	4fixed3v0.2.222release	1fixed	0added/v0.2.21.release	-fixed	,added+v0.2.20*release	)fixed(v0.2.17'release	&added%v0.2.16$release	#fixed	"added!v0.2.15 release	fixedchanged	addedv0.2.13release!plan-id:71!plan-id:70!plan-id:69!plan-id:68!plan-id:67!plan-id:66!plan-id:65!plan-id:64!plan-id:63!plan-id:62!
plan-id:61!plan-id:60!plan-id:59
!
plan-id:53!	plan-id:51!plan-id:49
!plan-id:47	!plan-id:37!plan-id:27!plan-id:20deferred!plan-id:10deferred
plan-id:9	deferred	plan-id:8
c�����������tfVH:, ���������wi[M=/!
�
�
�
�
�
�
�
�
�
s
d
V
H
9
)


���������xjYH7'���zR1
�
�
�
�
k
J
>
+

	�	�	�	�	�	�	�	�	�	|	h	Z	F	8	*		�������l[G9+
�������qV@.�������wfRA0��������qcRA-��������yk[P<.������qT@0�������y\H:,�����
�X�upstream�W�mosquitto�V7�sqlite-audit-followup�U%�fp-reduction�T�exp34c�S7�sqlite-audit-followup�R�int31c�Q�recall�P%�fn-detection�O7�sqlite-audit-followup�N�exp34c�M�recall�L%�fn-detection�K7�sqlite-audit-followup�J�arr30c�I�recall�H%�fn-detection�G7�sqlite-audit-followup�F7�sqlite-audit-followup
�E�strategy�D%�fp-reduction�C7�sqlite-audit-followup�B�triage�A%�fp-reduction�@7�sqlite-audit-followup�?�api00c�>%�fp-reduction�=7�sqlite-audit-followup�<�exp34c�;%�fp-reduction�:7�sqlite-audit-followup�9�mem30c�8%�fp-reduction�7�sqc
�6�research�5�sqlite
�4�upstream
�3�security�2�realworld
�1�security
�0�upstream�/�realworld�.�sqlite�-%�ground-truth�,�benchmark�+�realworld�*�sqlite�)%�ground-truth�(�benchmark�'�realworld�&�libcrc�%%�ground-truth�$�benchmark�#%�ground-truth�"�benchmark�!�hostap� %�ground-truth��realworld��benchmark	��curl�%�ground-truth��realworld��benchmark��mosquitto�%�ground-truth��realworld��benchmark�%�ground-truth��realworld��sqlite��benchmark�)�infrastructure�)�infrastructure�%�ground-truth��realworld�
�benchmark�!�robustness�)�infrastructure
�
�paper�triage��con07c��con33c�%�architecture
��strategy�%�fp-reduction�)�infrastructure
��paper��realworld��benchmark
��paper�~%�fp-reduction�}�int30c�|�int32c�{%�fp-reduction�z�benchmark�y%�fp-reduction�x�benchmark'�wQ�fp-reduction,str31c,cross-function�v�fio30c�u%�fp-reduction
�t�paper�s#�concurrency�r%�fp-reduction�q�vra�p�int30c�o�int31c�n�int32c�m%�fp-reduction�l�str31c�k%�fp-reduction�j�vra�i�arr30c�h%�fp-reduction�g�testing
�f�build
�e�rules
�d�rules�c�ux�b�testing�a#�reliability
�`�build�_#�diagnostics�^#�performance	�]build�\A~fp-reduction,cert-c,exp15c�[A}fp-reduction,cert-c,pre07c�ZA|fp-reduction,cert-c,exp02c�YA{fp-reduction,cert-c,arr39c�XAzfp-reduction,cert-c,pre10c�WAyfp-reduction,cert-c,flp00c�VAxfp-reduction,cert-c,msc37c�UAwfp-reduction,cert-c,mem05c%�TOvfp-reduction,cert-c,exp33c,arr00c�SAufp-reduction,cert-c,mem30c%�ROtfp-reduction,cert-c,dcl07c,dcl31c%�QOsfp-reduction,cert-c,int32c,int10c(�PUrint31c,fp-reduction,cert-c,benchmark�O!pplan-id:49
�Nobenchmark�M!nplan-id:49�L!mplan-id:49�K!lplan-id:49�Jkchanged
�Ikbenchmark�Hkv0.3.104�Gkrelease�Fjchanged
�Ejbenchmark�Djv0.3.103�Cjrelease�Bichanged
�Aibenchmark�@iv0.3.102�?irelease�>hchanged
�=hbenchmark�<hv0.3.101�;hrelease�:gchanged�9gv0.3.100�8grelease�7fchanged
�6fbenchmark�5fv0.3.99�4frelease�3echanged
�2ebenchmark�1ev0.3.98�0erelease�/dchanged
�.dbenchmark�-dv0.3.97�,drelease�+cchanged
�*cbenchmark�)cv0.3.93�(crelease�'bchanged
�&bbenchmark�%bv0.3.92�$brelease�#achanged
�"abenchmark�!av0.3.91� arelease�`task�`changed�`v0.3.90�`release�_changed	�_added�_v0.3.87�_release�^changed
�^benchmark�^v0.3.86�^release�]changed�]v0.3.85�]release�\changed�\v0.3.84�\release�
[changed�[v0.3.83�[releaseVtab on error per vtab contract) but genuine MEM30; sqc flagged correctly.
** FN dbstat.c:449 ARR30 (low conf): statDecodePage cell-ptr read aData[nHdr+i*2] for i<nCell; nCell(hdr byte3,<=65535) unbounded vs pgsz+256 buffer before loop -> corrupt-DB heap overread via SELECT*FROM dbstat. sqc emitted only INT32(FP) at 449. dbsqlfuzz-hardened so low conf, needs ASAN/HEAD confirm.
** FN vfstrace.c:897 EXP34 (low conf): pNew=sqlite3_malloc then memset no null-check = OOM null write; sqc fired EXP33(wrong rule) at line. debug VFS shim, OOM-only.
Noted-not-recorded: vtablog.c:96 trim off-by-one (in-bounds), unionvtab.c:758 isidchar c<'Z' typo (logic). sha1/memdb/unionvtab decode paths verified clean. NEXT: ~73 remaining smaller core/glue+ext/misc files.

BATCH 14 DONE (2026-06-14, 22 files, decoders + hardened-core/glue, 1 reviewer/file + integrity gate): intck/base64/totype/dbdump/fts5_varint/fts3_unicode/fts3_unicode2/fts5_unicode2/fts5_buffer/fts5_aux/checkfreelist/fts3view/percentile/randomjson + vdbeblob/delete/mem3/attach/malloc/carray/backup/random. 1338 findings -> 65 TP / 1273 FP, 3 FNs. Coverage 147 -> 169/220 (76.8%, three-quarters). FNs 17 -> 20, confirmed real bugs 16 -> 17.

** sqc-CAUGHT real bug #17: checkfreelist.c:277 EXP34 OOB read in sqlite_readint32(blob,offset). readint_function: signed int iOff (2nd SQL arg), guard nBlob>=(iOff+4) trivially true for negative offset (8>=-96) -> get4byte(&zBlob[-100]) reads before buffer; iOff+4 also int-overflows for iOff near INT_MAX. SQL-reachable once ext/repair/checkfreelist loaded. sqc flagged EXP34 @277 correctly. Loadable repair ext (not core) but genuine SQL-reachable read primitive.
** sqc-caught memory-safety TP fts3view.c:579 (standalone tool): decodeSegment memcpy(zTerm+iPrefix,aData+i,(size_t)nTerm) -- untrusted int64 varint nTerm, guard bypassable by overflow, src len unchecked vs nData. sqc fired INT31@579 + INT32@579/580. Dev tool, lower severity.
Integrity gate overrode 5 reviewer verdicts: checkfreelist idx9/10 TP->FP (sqc mislabeled u32 underflow as signed; unreachable b/c sqlite_dbpage always full page>=512); fts3view 157/158 TP->FP (ARR39 double-scaling wrong, offset/size are CLI args not data); fts5_buffer idx49 TP->FP ((t&0x80) short-circuits unsafe index).
FNs recorded (low conf): intck.c:322 intckGetToken quoted-string branch terminates only on matching quote NOT NUL -> unbounded OOB read on unterminated quoted identifier in corrupt sqlite_schema.sql; fts3view.c:568 getVarint past nData; percentile.c:291 32-bit doubling wrap (~16GB unreachable).
Hardened core (backup/malloc/mem3/attach/vdbeblob/delete/random) = ONLY decl/macro/recursion TPs, ZERO semantic. Bifurcation holds 14 batches. NEXT ~51 files: large core engines (vdbe/btree/where/select/expr/build/os_unix/os_win/json) + heavy ext decoders (fts5_index 991, sqlite3session 716, fts3 631, sqlite3rbu 524, rtree 450, spellfix 406, qrf 366, geopoly 272) warrant HIGH-effort framework.
DISCLOSURE BACKLOG ADD (b14): checkfreelist.c:277 sqlite_readint32 negative-offset OOB read (SQL-reachable, loadable repair ext) -- priority disclosure candidate; re-check live-at-HEAD.

BATCH 15 DONE (2026-06-14) -- CAMPAIGN COMPLETE 220/220 (100%). 46 files (all remaining), 1484 findings -> 134 TP / 1350 FP, 3 FNs. NEW confirmed real bug #18: prefixes.c:295 prefix_length() NULL deref (SQL-reachable loadable ext; sqc CAUGHT EXP34). FNs (low): scrub.c:442 varint OOB past page buffer, nextchar.c:184 OOB read, fts3_term.c:232 doclist varint OOB. No reviewer overrides needed. 5-file gap to 220 = platform headers (hash.h/msvc.h/os_setup.h/os_win.h/vxworks.h, 0 sqc findings, recorded 0-finding audited). CAMPAIGN TOTALS: 220/220 files, 24834 findings -> 1496 TP / 22154 FP / 23 FN / 48 uncertain, precision ~6.3%. TP by class DCL 769 + PRE 359 + MSC 214 = ~90% decl/macro/recursion; semantic minority mostly benign. 18 confirmed real bugs, all in untrusted-input/decode/corrupt-DB/tool paths, none in hardened core. Bifurcation proven across full shipped corpus.done2026-06-12T00:10:41Z2026-06-12T21:39:04Z2026-06-14T20:24:44Z
��������������~tj`VK@5*	������������n\J8, 
�
�
�
�
�
�
�
�
�
�
q
b
S
D
5
&

���������rcTE6'	���������sdUF7(

�
�
�
�
�
�
�
�
�
�
�
�
�
��
t
h
\
P
D
8
+


	�	�	�	�	�	�	�	�	�	�	u	h	[	N	A	4	'		
	���������~qiaUI=, ���������th\PD8�������������zpf\RH>4)�����������o]K9'�������saO=+������weSA/������jJ*%fp-reduction��fp-reduction,cert-c,exp15c\Afp-reduction,cert-c,exp02cZ&Ofp-reduction,cert-c,dcl07c,dcl31cRAfp-reduction,cert-c,arr39cY%fp-reduction�%fp-reductiont%fp-reductionn%fp-reductionj%fp-reductionh%fp-reductionf%fp-reductionc%fp-reductiona%fp-reductionC%fp-reduction1%fp-reduction,%fp-reduction$%fp-reduction%fp-reduction%fp-reduction%fpcert-c�%fp-reduction%fp-reduction�%fp-reduction�%fp-reduction�%fp-reduction�%fp-reduction�%fp-reduction�%fp-reduction�%fp-reduction�%fp-reduction�%fp-reduction�%fp-reduction�%fp-reduction~%fp-reduction{%fp-reductiony%fp-reductionu%fp-reductionr%fp-reductionm%fp-reductionk%fp-reductionh%fn-reductionp%fn-detection=%fn-detection9%fn-detection�%fn-detection�%fn-detection�
fixed�
fixed�
fixed�
fixed�
fixed�
fixed�
fixed�
fixed�
fixed�
fixed�
fixed�
fixed�
fixed�	fixed	fixed|	fixedy	fixedr	fixedm	fixedj	fixed^	fixedU	fixedR	fixedH	fixedE	fixedA	fixed:	fixed7	fixed4	fixed1	fixed-	fixed)	fixed#	fixedfio30cfio30cv#Ifio22c,fp-reduction,robustness�exp34c0exp34c�exp34c�exp34c�exp34c�exp33c�!evaluationG#diagnostics_deferreddeferreddeferred	curl�'cross-project�'cross-project�)cross-function%)cross-functionconfigI#concurrencyscon33c�con07c�con03cEci�ci�changedJchangedFchangedBchanged>changed:changed7changed3changed/changed+changed'changed#changedchangedchangedchangedchangedchanged
changed
changedchangedchanged�changed�changed�changed�changed�changed�changed�changed�changed�changed�changed�changed�changed�changed�changed�changedvchangedqchangedfchangedbchangedXchangedc99_c99[c99Mc99
c99c99
buildf
build`
build]bugUbugTbugSbugRbenchmarkubenchmarkYbenchmarkLbenchmarkDbenchmarkBbenchmark@benchmark5benchmark3benchmark/benchmark+benchmark*benchmark benchmarkbenchmark
benchmarkbenchmarkbenchmark�benchmark�benchmark�benchmark�benchmark�benchmark�benchmark�benchmark�benchmark�benchmark�benchmark�benchmark�benchmarkzbenchmarkxbenchmarkNbenchmarkIbenchmarkEbenchmarkAbenchmark=benchmark6benchmark2benchmark.benchmark*benchmark&benchmark"benchmarkbenchmark	benchmarkbenchmarkbenchmark�benchmark�benchmark�benchmark�
benchA
audit`arr38c-arr30c<arr30c8arr30c.arr30c�arr30ci%architecture�%architecture�%architecture�%architecture�api05capi00c�
analysis
added
added�
added�
added�
added�
added�
added�
added�
added�
added�
added�
added�
added�
added�
added�
added�	addedu	addedp	addedi	addede	addeda	added[	addedQ	addedN	addedK	addedD	added@	added=	added0	added,	added&	added"	added
�:(�������tbP>,F����l���yY9�����kN*
�
�
|
j
X
F
4
"
��������ti^J6"�������nZFX	
�
�
�
�
�
�
�
�
�
v
k
`
U
J
?
4
)


	�	�	�	�	�	�	�	�	�	�	�	�	y	n	c	X	M	B	7	,	!			�������k_SG;,��:��������~m^O@1"��������yj[L=.��������vgXI:�������wi[M?1#���������{m_QC5'�����release$release release
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refacmsc04c�%fp-reduction�)infrastructure�&Ofp-reduction,cert-c,exp33c,arr00cTAfp-reduction,cert-c,exp15c\Afp-reduction,cert-c,exp02cZ&Ofp-reduction,cert-c,dcl07c,dcl31cRAfp-reduction,cert-c,arr39cY%fp-reduction�%fp-reduction�%fp-reductiont%fp-reductionn%fp-reductionj%fp-reductionh%fp-reductionf%fp-reductionc%fp-reductiona%fp-reductionC%fp-reduction1%fp-reduction,%fp-reduction$%fp-reduction%fp-reduction%fp-reductionrealworld�realworld�realworld�realworld�realworld�)raise-evidence�prescan7prescan)%preprocessore%preprocessor
plan-id:9	plan-id:8!plan-id:71!plan-id:70!plan-id:69!plan-id:68!plan-id:67!plan-id:66!plan-id:65!plan-id:64!plan-id:63!plan-id:62!plan-id:61!plan-id:60!plan-id:59!plan-id:53
!plan-id:51!plan-id:49O!plan-id:49M!plan-id:49L!plan-id:49K!plan-id:49!plan-id:47
!plan-id:37	!plan-id:27!plan-id:20!plan-id:10#performance(#performance^parser�
paperW
paper&
paper�
paper�
paper
papert'observability"mosquitto�mosquitto�mosquitto�mosquitto�mosquitto�mem30cmem30c�mem30c�mem12c�+macro-expansion+macro-expansion+macro-expansion�+macro-expansion�+macro-expansion�+macro-expansion�libcrc�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots�
knots~
knots|
knotsz
knotsxjuliet4int32c|int32cn)Uint31c,fp-reduction,cert-c,benchmarkPint31c�int31coint30c}int30cp0cinfrastructure,robustness,task-153-followup�)infrastructure�)infrastructure�)infrastructure�)infrastructure�)infrastructure�)infrastructureV)infrastructureH)infrastructure6)infrastructure)infrastructure�)infrastructure�)infrastructure�)infrastructure�)infrastructure�
infraQ
infraPhostap�%ground-truth^%ground-truth\%ground-truthN%ground-truth%ground-truth%ground-truth�%ground-truth�%ground-truth�%ground-truth�%ground-truth�%ground-truth�%ground-truth�%ground-truth�%ground-truth�'Qfp-reduction,str31c,cross-functionw9ufp-reduction,robustness,mem-family,task-153-followup�'Qfp-reduction,robustness,mem-family�#Ifp-reduction,robustness,int33c�#Ifp-reduction,robustness,dcl01c�;fp-reduction,robustness�;fp-reduction,robustness�;fp-reduction,robustness�;fp-reduction,robustness�;fp-reduction,robustness�;fp-reduction,robustness�;fp-reduction,robustness�Afp-reduction,cert-c,pre10cXAfp-reduction,cert-c,pre07c[Afp-reduction,cert-c,msc37cVAfp-reduction,cert-c,mem30cSAfp-reduction,cert-c,mem05cU&Ofp-reduction,cert-c,int32c,int10cQAfp-reduction,cert-c,flp00cW
#�+>/ ����zk\M>/Y��
�
�
�

q
c
U
G
9
+


���������ugYK=/!���������{ocWznbVJ�����
������
�ymaUI</"��������������������tgZMbUH;.!����������xk^QD7*����������{����:�����og7#�����K���xl`��E*������������wj]PC6)
�
�
�
�
�
�
�
�
�
�
u
h
[
N
A
4
'


	�	�	�	�	�	�	�	�	�	�	s	f	Y	L	?	2	%			�release*$taskrealworld�!robustness�release;release8release5release2release.releaseLreleaseIreleaseFreleaseBrelease>releasegreleasecrelease_release\releaseYreleaseVreleaseSreleaseOrelease�release�release�release}releasezreleasewreleasesreleasenrelease�release�release�release�release�release�release�release�release�release�release�recall�realworld�realworld�realworld�release�release�release�release�release�release�release�release�release�release�release�release�release�release�!robustness�!robustness�)rule-hardening�)rule-hardeningv
securitysrecall�r)rule-hardeningqresults�results�results�results�results�results�results�
researchF
research�removed�#reliabilityareleaseGreleaseCrelease?release;release8release4release0release,release(release$release releasereleasereleasereleasereleasereleasereleasereleaserelease�release�release�release�release�release�release�release�)rule-hardeningo
securitymrecall�l)rule-hardeningk)rule-hardeningi)rule-hardeningg)rule-hardeningd)rule-hardeningbrecall:X)rule-relevanceK�sqlite-realworld]realworldZrealworldOrealworldJrealworldrealworldrealworld�realworld�realworld�realworld�!robustnesssqlite	recall>sqlite�
�^windows�vraqvrajv0.3.995v0.3.981v0.3.97-v0.3.93)v0.3.92%v0.3.91!v0.3.90v0.3.87v0.3.86v0.3.85v0.3.84v0.3.83v0.3.82v0.3.81v0.3.80
v0.3.8?v0.3.79�v0.3.78�v0.3.77�v0.3.76�v0.3.75�v0.3.74�v0.3.67�v0.3.66�v0.3.65�v0.3.64�v0.3.63�v0.3.62�v0.3.61�v0.3.60�v0.3.59�v0.3.58�v0.3.57�v0.3.56�v0.3.52�v0.3.51�v0.3.50�
v0.3.5<v0.3.49�v0.3.48�v0.3.47�v0.3.46�v0.3.44�v0.3.43�v0.release'release$release release
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor�
refactor
refactor}
refactor{
refactory
refactor
refactor�recallwreleasek�testinggtestingbtech-debt�	task
strategy�
strategy�str31cl7sqlite-audit-followup�7sqlite-audit-followup�7sqlite-audit-followup�7sqlite-audit-followup�7sqlite-audit-followup�7sqlite-audit-followup�7sqlite-audit-followup�7sqlite-audit-followup�7sqlite-audit-followup�7sqlite-audit-followup�7sqlite-audit-followup�7sqlite-audit-followup�sqlite�sqlite�sqlite�sqlite�sqc�
spike�
security�
security�
rulese
rulesd!robustness�results�results�
v��
(
.
����!��555Real-world ground truth: libcrc file-at-a-time audited corpusConvert libcrc to the file-at-a-time audited-corpus model (task 160 infra). Step 0 (config) settled: conf/realworld/libcrc-rules��
u�555Real-world ground truth: sqlite remaining incrementsContinue the incremental sqlite oracle started in increment 1 (INT32-C, 15 labels; config conf/realworld/sqlite-rules.toml; scope = shipped src/+ext/, see data/precision_audit/sqlite/README.md). Adjudicate the remaining high-volume in-scope rules via the sampling loop (realworld-unlabeled -> read source -> import-labels): MEM30-C (2384, unlabeled), API00-C (1377, unlabeled), EXP34-C + DCL13-C (extend v0.4.22 samples), INT30-C, EXP33-C, INT14-C, ARR00-C/ARR30-C. Add categorical config disables as the audit justifies them. Goal: a representative measured-precision corpus per rule, grown over time.

[2026-06-14] DONE — subsumed by the full file-at-a-time audit (task 163): 220/220 in-scope files, 24,834 findings adjudicated in ground_truth, exact per-rule measured precision for ALL high-volume rules this task targeted (MEM30 2300 FP/0.0%, API00 1366/0.1%, EXP34 1496/0.5%, INT30 915/0.1%, EXP33 672/0.0%, INT14, ARR00/ARR30, etc.). A full census, not a sample. See data/precision_audit/sqlite/ANALYSIS.md + README.md.done2026-06-11T17:36:17Z2026-06-11T18:14:48Z2026-06-14T22:25:36Z�D�
a�u5Real-world ground truth: hostap full auditBuild the hostap (wpa_supplicant/hostapd) ground-truth oracle (template: libcrc/sqlite). Steps: (1) conf/realworld/hostap-rules.toml on benchmark base + categorical disables; wire manifest (entry already has -d src -d wpa_supplicant + includes). (2) Scope = src/ + wpa_supplicant/ + hostapd/ (exclude tests). (3) Sample-adjudicate top rules; hostap has EAP method tables / eloop callbacks (DCL13 FPs) and the known OSU XML length->malloc INT32 TP. (4) import-labels pinned to commit dcee60436; score.pending2026-06-11T17:58:10Z�
]�'5Real-world ground truth: curl full auditBuild the curl ground-truth oracle (template: libcrc/sqlite). Steps: (1) conf/realworld/curl-rules.toml on benchmark base + categorical disables; wire manifest. (2) Scope = lib/ + src/ (exclude tests/, docs, vendored). (3) Sample-adjudicate top rules reading source; curl has heavy callback/vtable signatures (DCL13 FPs) and protocol parsing (INT/EXP3��
]�Y555Real-world ground truth: curl full auditBuild the curl ground-truth oracle (template: libcrc/sqlite). DONE 2026-06-16: adjudication + 3-agent adversarial pass complete, all 427 in-scope files (329 adjudicated + 98 zero-finding FN-read). Result: 100 TP / 11100 FP = 0.89% precision, 5 confirmed FNs. WIN_MAC (14 Win/Apple files) excluded as separate build config. Artifacts: data/precision_audit/curl/ (README, adjudication_curl.csv, fns_curl_final.csv, adversarial/). REMAINING (kept in-progress): realworld-import-labels + audit-complete per-file + audit-coverage --set-total 427 + realworld-score (DB writes — run when benchmark DB free); apply WIN_MAC exclusion to curl benchmark scoring scope (task 189 sibling).done2026-06-11T17:58:10Z2026-06-16T17:43:46Z2026-06-16T19:38:54Z�T�
g�E555Real-world ground truth: mosquitto full auditBuild the mosquitto ground-truth oracle using the libcrc/sqlite template. mosquitto is the next-smallest after libcrc -> good first full(ish) audit. Steps: (1) tailor conf/realworld/mosquitto-rules.toml on the benchmark base + categorical disables; wire manifest in CODEBASES (entry already has includes). (2) Define scope (lib/ + src/ broker; exclude deps/, test/, examples). (3) Sample-adjudicate top rules (DCL13-C, EXP34-C, MEM30-C, INT32-C) from run sqc-0.4.22-1c94dc95, reading source. (4) import-labels pinned to commit d3ee5c5c; score. Existing v0.4.22 labels: DCL13 4, EXP34 3, INT32 2, MEM30 6.done2026-06-11T17:58:10Z2026-06-15T20:45:37Z2026-06-15T20:45:37Z
/
�/
 �f�#��e#55sqlite file-at-a-time: batches 2+ (191/220 files remaining)Continue sqlite file-at-a-time audited corpus vs config-correct run #40, denominator 220. Coverage 107/220 (48.6%) as of 2026-06-12. Done thru batch8: vdbeaux/select; b3 (8 decoders); b4 (json/geopoly/recover/fts5_hash/normalize); b5 (rbu/spellfix/qrf/fts3 tokenizers); b6 (rtree/date/amatch/checkindex/fuzzer/utf); b7 (changesetfuzz/fileio/series+build.c/os_unix.c); b8 (MEDIUM-effort core filler: os_win.c/main.c/util.c/vdbeapi.c, 1657 findings -> 31 TP/1626 FP, 0 semantic TP, 0 FN). 13 confirmed real bugs (ALL untrusted-input parsers), 13 FNs, still NO production hardened-core semantic TP (4 core files build/os_unix/os_win/main = 2828 findings, 0). EFFORT POLICY (user 2026-06-12): MEDIUM effort for pure hardened-core/glue filler, but KEEP HIGH effort + rigorous FN-hunt for the remaining genuine-untrusted-input files even though they're core: pager.c 429, wal.c 414, func.c 312, printf.c 249, vdbesort.c 223. Integrity gate (source-verify every semantic TP / FN candidate) is non-negotiable at any effort. Remaining in-scope ~113 files, mostly core/glue filler: expr.c 453, wherecode.c 226, window.c 216, analyze.c 211, vdbemem.c 193, insert.c 182, alter.c 178, sqliteInt.h 177, pragma.c 164, trigger.c 161, prepare.c 146, whereexpr.c 146, os_kv.c 138, fkey.c 123, vtab.c 110, utf.c done, ... Next: a HIGH-effort batch of pager/wal/func/printf/vdbesort, then resume medium-effort filler. Framework: /tmp/core_framework.md (core), /tmp/batch_framework.md (decoders). DISCLOSURE BACKLOG below.


DISCLOSURE BACKLOG (defer sqlite-team reports until FULL audit complete — user 2026-06-12): re-scan ground_truth verdict='FN' for live-at-HEAD items at report time. Only live-at-HEAD confirmed bug = amatch.c:1160 heap-overflow WRITE, but amat��!��555Real-world ground truth: libcrc file-at-a-time audited corpusConvert libcrc to the file-at-a-time audited-corpus model (task 160 infra). Step 0 (config) settled: conf/realworld/libcrc-rules.toml, 23 out-of-scope rules disabled (Windows-on-POSIX, chroot, TOCTOU, binary-data, advisory). Produce a config-correct sqc 0.4.24 run, reconcile the existing 372 labels (13 TP/359 FP) against it per file, read each file for FNs, mark files audited, pin in-scope file total, score + freeze. Replaces stale run #34 (v0.4.22, predates the disables -> 44 out-of-scope findings).done2026-06-11T20:39:48Z2026-06-11T20:39:58Z2026-06-11T22:14:07Z�g� ��O	555File-at-a-time audited corpus: schema + scorer + versioningRestructure task-156 approach from rule-sampling to file-at-a-time exhaustive audit. (1) audited_files table = per-file done-unit. (2) FN support in ground_truth (verdict=FN, provenance, confidence cols) for recall. (3) coverage+recall scorer restricted to audited-file set + per-project coverage view. (4) oracle DB version-stamp/freeze for the paper. Codebases are fixed at pinned commit; corpus grows monotonically toward full coverage, reusable across every future sqc version.done2026-06-11T20:04:31Z2026-06-11T20:04:34Z2026-06-11T20:19:34Z�\�"��3555Real-world ground truth: sqlite file-at-a-time audited corpusConvert sqlite to the file-at-a-time audited-corpus model against config-correct run #40 (sqlite-rules.toml, 45582 findings). Reconcile increment 1-5 labels (INT32/MEM30/API00/EXP34/DCL13, ~259 labels made vs base-manifest run #34) against #40. Establish in-scope file universe per data/precision_audit/sqlite/README.md scope (src/ core + ext/ shipped extensions; exclude autosetup/jimsh0.c, tool/, test/, src/test*.c, ext/jni, ext/wasm, tclsqlite.c, *_tcl/*test* glue). Pin coverage denominator. Sweep files: pull-all-findings-per-file, label TP/FP, read for FNs, audit-complete. Long campaign.done2026-06-11T23:33:02Z2026-06-11T23:35:53Z2026-06-12T00:08:03Z
;�;�#�
y�Q555Improve CWE-121/CWE-122 flaw-hit rates (cppcheck goal)Goal 2 remainder: CWE-121 flaw-hit 14.5%, CWE-122 10.5% (unchanged v0.4.18→v0.4.21). CWE-190 (19.7%) and CWE-191 (20.4%) parts are DONE. Known scoring geometry: CWE-129/CWE-135/CWE-805-wchar patterns place violations 4 lines after the flaw annotation, outside the +/-1 tolerance — decision made NOT to change benchmark tolerance (paper comparability). Gains must come from detection at the actual flaw lines and FP reduction: v0.4.21 FP counts ARR38-C/CWE-121 504, ARR30-C/CWE-121 442, ARR30-C/CWE-122 409, STR31-C/CWE-121 258.
2026-06-10: implement on top of the shared bounds/buffer-size API (task 149), not as rule-local patches — CWE-121/122 flaw-hit is the same buffer-size problem STR31-C/ARR30-C each solve privately.

--- 2026-06-18 progress (v0.4.46→v0.4.47; commits 9749f1d8, 18cbff53) ---
FP-reduction half DONE. ARR30-C string-copy content-length gate built on the
shared buffer_size API (memset_content_length consolidated there; STR31-C now
delegates). vs v0.4.45: ARR30-C FP 1103→729 (-374), TP unchanged (1814), ZERO
TP loss, ZERO cross-CWE regressions. CWE-121 FP 1134→930 (TP rate 66.6→70.8%);
CWE-122 FP 547→377 (71.6→78.5%). Gate scoped to Static (stack-array) dests
after fixing a 6-TP CWE-122 regression (file-wide buffers map conflates malloc'd
pointer sizes across functions).
FLAW-HIT RATE UNCHANGED (CWE-121 14.5%, CWE-122 10.5%): FP reduction does not
move the TP-on-flaw-line numerator. Remaining levers are alias-analysis-bound
(see follow-up), depend on task 150.

--- 2026-06-18 close ---
Closing: the actionable FP-reduction deliverable shipped (ARR30-C -374 FP,
0 TP loss, 0 regressions). The flaw-hit-rate increase is recall/alias-bound
and parked in task 206, which the task-150 decision deferred (no alias/SSA
infra investment now). No remaining actionable work under 144.done2026-06-10T03:51:31Z2026-06-18T17:15:40Z2026-06-18T20:23:31Z���#�555Investigate cross-function buffer-size propagation for STR31-C FP reductionSTR31-C still has ~611 FPs after v0.4.17 fixes. Remaining FPs are all cross-function: sink functions receive 'char * data' as a parameter, and the destination buffer was allocated in the caller (ALLOCA/malloc). Without knowing the caller's buffer size, STR31-C can't prove the copy is safe.

Known remaining FP patterns (from CWE-121/122/127/124 analysis):
- __dest_char_alloca_cpy_ (variants 41+): sink sees strcpy(data, source) where data is a parameter; source is char source[100] filled via memset. Buffer 100 vs dest unknown.
- __CWE805_wchar_t_alloca_ncat_ (variants 41+): wcsncat(data, source, 100) where data is a parameter.
- __c_CWE805_wchar_t_ncat_ (CWE-122): same wcsncat parameter pattern.
- CWE-127/124 alloca_cpy (variants 41+): strcpy(dest, data) where dest is char dest[200] but data is a parameter.

Approaches to investigate:
1. Parameter-size summary: during prescan, record the buffer size passed to a function for each call site (similar to callsite_param_const_int). If ALL callers pass a buffer of size >= N, seed the parameter with N.
2. Source-content heuristic: if source content length is deterministic (via memset) and destination is a parameter, suppress when content_len < some conservative threshold.
3. n-bounded copy suppression: for wcsncat(data, source, N) where N <= source_size, the copy is count-bounded — flag only if we can prove dest is too small, suppress if dest size unknown.

Estimated FP impact if solved: ~430 FPs across CWE-121 (258 remain), CWE-122 (241 remain), CWE-127 (90), CWE-124 (90).
2026-06-10: blocked on task 149 — cross-function buffer-size propagation should land in the shared API, not in str31_c.rs.done2026-06-09T21:46:07Z2026-06-18T12:32:01Z2026-06-18T14:20:20Zource` and
`returns_tainted` false. BFS with a visited set handles cycles and
multi-level forwarding chains (Juliet variants 52c/53d/54e have
intermediate clean pass-through sinks whose grand-caller holds the
recv/fgets).

Remaining gaps for CWE-78 (~50 ENV33-C FPs, plus ~324 ENV03-C FPs
and 140 STR02-C) and CWE-194/195 (~1224 INT31-C FPs):
  - Global/static pointer read tracking (v45-style `char *data =
    g_goodG2BData;` where `g_goodG2BData` was last written elsewhere)
  - Function-pointer cross-file calls (v65a/b, v67 variants — no
    call-graph edge for `funcPtr(data)`)
  - Extend the same clean-callee `rhs_is_safe` pattern to ENV33-C —
    same template as ENV03-C, likely similar 4:1 ratio (~500 FP
    candidates).
  - CWE-89 sinks: add SQL injection entry points (sqlite3_exec,
    mysql_query, PQexec) and the STR02-C or a new taint-sink rule.

Rule candidates that would benefit from the existing taint bits once
integrated: FIO30-C, STR02-C, FMT variants for format-string injection.

This task stays open as the coordinating umbrella; individual
rule-integration rounds are tracked as follow-ons to tasks 68/69/49A.


## Sub-task 113 — ENV03-C macro-value path check + CWE-426 caller-aware (DONE v0.3.113)

Replace ALL-CAPS heuristic in check_writes with macro-value absolute-path check
(is_safe_command_macro): GOOD_OS_COMMAND=/usr/bin/ls is safe, BAD_OS_COMMAND=ls is not,
and argument fragments like SAFE_CMD_ARGS=" -la" are also safe to strcat.
Add collect_string_literal_macros / is_safe_command_macro / is_relative_command_macro
to const_eval.rs; handles wide-string L"..." macros.
Add FunctionSummary.has_relative_command_write prescan bit: set when a function calls
strcpy/strcat with a macro expanding to a known relative-path command string.
callers_are_all_clean and call_is_clean now gate on both has_env03_taint_source AND
has_relative_command_write, blocking CWE-426 bad callers from passing the clean check.

Results: CWE-426 0 TP -> 132 TP / 0 FP; CWE-78 unchanged (2810 violations, 0 FPs).

Original status line: partial (v0.3.94-0.3.113 — tasks 67-69 + 49A/49B/49C/49D/113 delivered)

## Sub-task 115+116 — INT32-C/INT30-C goodG2B caller constant arg propagation (DONE v0.3.116)

Root cause: VRA initializes function parameters with full type range (e.g. [INT64_MIN, INT64_MAX])
even when ALL callers pass the same safe constant (e.g. data=2). So goodG2BSink(data=2) still
triggered data+1 may overflow because VRA could not prove the value was safe.

Fix (v0.3.115): Added callsite_param_const_int to FunctionSummary. prescan now walks each
function body to collect constant call-site arguments via collect_callsite_int_args_from_tree.
Two invalidation mechanisms: (1) pointer_expression &var in a call invalidates the variable
(fscanf pattern); (2) any non-literal assignment (data=LLONG_MAX, data=rand()) invalidates
the variable (v0.3.116 fix). aggregate_callsite_int_args stores param->const only when ALL
call sites agree. VRA then seeds [v,v] instead of full range. compute_vra_if_needed in
mod.rs runs this for same-file scans too.

v0.3.115 had TP -171 / FP -228 (+0.30pp) due to data=0LL followed by data=LLONG_MAX
leaving data=0 in map; v0.3.116 fixes by invalidating on any non-literal RHS assignment.

v0.3.116 CONFIRMED results (vs v0.3.114 baseline):
  Overall: TP +0 / FP -228 / TP rate +0.40pp — zero TP regression
  CWE-190 INT32-C: TP 1421->1421 (+0), FP 999->909 (-90)
  CWE-190 INT30-C: TP 403->403 (+0),  FP 291->261 (-30)
  CWE-191 INT32-C: TP 1151->1151 (+0), FP 810->738 (-72)
  CWE-191 INT30-C: unchanged
  CWE-369 / CWE-680: FP -24 / -12, TP +0 each (side benefit)
  228 FPs eliminated with no TP regression.

Status line update: v0.3.94-0.3.116
2026-06-10: paused pending ceiling decision (task 150). CWE-78 at 94.8% already exceeds clang-tidy; remaining residue (v42 return-tainted data=helper(data) chains, v45 global-static pointer reads, CWE-89 SQL sinks) is deliberately on hold until the post-75% strategy is decided from the task-148 real-world audit data.partial2026-04-20T16:45:55Z2026-04-20T16:45:55Z2ummaries` / `analyze_function` carries the pre-filtered
   alias list without widening the existing `MacroConstantMap` contract.

Results: Juliet TP 24,478 → **24,542** (+64), FP 13,632 → **13,498**
(−134), TP rate 64.2% → **64.5%** (+0.3pp). Zero other-rule
regressions.
  - CWE-78 TP rate 87.7% → **90.3%** (+2.6pp). ENV33-C FP 50 → **0**,
    TP 1438 → 1514 (+76) — the macro-alias fix recovered TPs previously
    missed because `GETENV(data)` etc. didn't poison the caller's
    summary, so helper-sink suppression over-applied.
  - ENV03-C: FP 324 → 300 (−24), TP 620 → 628 (+8). Clean win from the
    same macro-alias recognition.
  - INT31-C: FP 1452 → 1392 (−60), TP 2142 → 2122 (−20). CWE-194 TP
    rate +1.5pp, CWE-195 +0.6pp.

Real-world (curl / sqlite / mosquitto / libcrc / hostap): zero delta
v0.3.98 → v0.3.102. The fix is Juliet-specific — function-pointer
tables in real-world code don't match Juliet's helper-sink shape, and
no real-world codebase in the set macro-wraps a taint source.

Remaining CWE-78 gap (~280 FP across ENV03-C 300 + STR02-C 140): v42
return-tainted `data = helper(data)` chains and v45 global-static
pointer reads still need return-value propagation and global-write
tracking respectively. The function-pointer edge lands variant 65;
variant 67 wasn't in the measured FP contributors this round.

## Sub-task 49D — STR02-C caller-aware suppression (DONE v0.3.103)

Port the ENV33-C task 49B template to STR02-C. Previously STR02-C
tainted every parameter by default ("params are external input") and
flagged any `system()` / `popen()` whose arg resolved to a tainted
variable — so every Juliet `_goodG2BSink(char *data) { popen(data); }`
produced an FP. New gate: suppress iff (a) the arg is a function
parameter, (b) the enclosing body has no direct taint-source call,
and (c) every transitive caller's summary has both
`has_env03_taint_source` and `returns_tainted` false. BFS with
visited-set handles variants 52c/53d/54e exactly like ENV33-C.

Threading the scope required passing `func_scope: &Node` through
`check_sinks` → `check_dangerous_function_call` →
`check_command_injection_risk`; `check_single_function` seeds it
from the current `function_definition`.

Reused existing infrastructure: STR02-C now owns a
`function_summaries` + `callers` RefCell pair populated from
`ProjectContext.call_graph` in `set_project_context`. No new summary
bits needed — the `has_env03_taint_source` + `returns_tainted` pair
from v0.3.99 / v0.3.102 covers exactly the shape STR02-C wants.

Results: Juliet TP 24,542 → **24,518** (−24), FP 13,498 → **13,358**
(−140), TP rate 64.5% → **64.7%** (+0.2pp). **5.83:1 FP:TP** — best
ratio in the task 49 series so far (prior bests 4.5:1 at 49A, 4.02:1
at 49B, 4.1:1 at task 67). Zero other-CWE regressions.
  - CWE-78 TP rate 90.3% → **94.8%** (+4.5pp). STR02-C FP 140 → **0**,
    TP 560 → 536 (−24). STR02-C now contributes zero FPs to CWE-78.
  - CWE-78 TP rate (94.8%) now **exceeds clang-tidy's 91.6%** on the
    overlapping-CWE competitor benchmark — CWE-78 is no longer a
    parity gap.
  - Remaining 140 CWE-78 FPs are all on ENV03-C: v42-style
    `data = helper(data)` chains (return-tainted propagation) and v45
    global-static pointer reads. STR02-C structurally can't hit these
    because its taint tracking starts from "params = tainted" rather
    than from externally-read buffers.

Real-world: not rerun. No new `FunctionSummary` fields; STR02-C
consumes the same bits that v0.3.102 already populates.

## Sub-task 49B — ENV33-C caller-aware suppression (DONE v0.3.101)

ENV33-C FP 500 → **50** (−450), TP 1550 → 1438 (−112). **4.02:1
FP:TP** — matches the task 49 umbrella 4:1 projection. CWE-78 TP
rate 76.6% → **87.7%** (+11.1pp). Zero other-rule regressions.

Approach: mirror the ENV03-C task 68 / 49A pattern. Replace the
blanket "pointer parameter → flag" check with a caller-aware
transitive walk of the reverse call graph. Suppress iff every
reachable ancestor's summary has both `has_env03_taint_s
}	����y^C(�����whYJ	=0#

�
�
�
�
�
�
�
�
�
�
z
n
b
V
J
>
2
&

�����������th\PD8, 	����������|obUH;0#	
�
�
�
�
�
�
�
�
�
�
z
m
`
S
F
9
,


	�	�	�	�	�	�	�	�	�	�	x	k	^	Q	H	?	2	%tech-debt�wontfixXwindows�vraqvrajv0.3.995v0.3.981v0.3.97-v0.3.93)v0.3.92%v0.3.91!v0.3.90v0.3.87v0.3.86v0.3.85v0.3.84v0.3.83v0.3.82v0.3.81v0.3.80
v0.3.8?v0.3.79�v0.3.78�v0.3.77�v0.3.76�v0.3.75�v0.3.74�v0.3.67�v0.3.66�v0.3.65�v0.3.64�v0.3.63�v0.3.62�v0.3.61�v0.3.60�v0.3.59�v0.3.58�v0.3.57�v0.3.56�v0.3.52�v0.3.51�v0.3.50�
v0.3.5<v0.3.49�v0.3.48�v0.3.47�v0.3.46�v0.3.44�v0.3.43�v0.3.42�v0.3.39�v0.3.38�v0.3.37�v0.3.36�v0.3.35�v0.3.34�v0.3.33�v0.3.32~v0.3.31{v0.3.30x
v0.3.39v0.3.28tv0.3.27ov0.3.26lv0.3.25hv0.3.24dv0.3.23`v0.3.22]v0.3.21Zv0.3.20Wv0.3.19Tv0.3.18Pv0.3.17Mv0.3.15Jv0.3.14Gv0.3.13C
v0.3.104H
v0.3.103D
v0.3.102@
v0.3.101<
v0.3.1009v0.2.256v0.2.223v0.2.21/v0.2.20+v0.2.17(v0.2.16%v0.2.15!v0.2.13uxc
upstreamr
upstreaml
upstream�
upstream�
upstream�
upstream�
upstream�
upstream�triagetriage�triage�tooling!toolingtestinggtestingbtech-debttech-debttech-debt�8stask-153-followup,msc04c,recall,realworld-benchmark�/task-153-followup�/task-153-followup�	task
strategy�
strategy�str31c'str31c#str31cl7sqlite-audit-followup?7sqlite-audit-followup;7sqlite-audit-followup27sqlite-audit-followup�7sqlite-audit-followup�7sqlite-audit-followup�7sqlite-audit-followup�7sqlite-audit-followup�
ZZ
k
����
E�w555Close CWE-680 gap vs Frama-Cv0.4.21: tp_rate 63.2% vs Frama-C 82.6% (their best CWE). 494 TP / 288 FP. Rules involved: INT32-C + INT30-C on malloc(n*sizeof) overflow-to-BOF patterns. The v0.4.20 replay change traded -63 TP for -84 FP here; check whether the lost TPs are recoverable with narrower-type tracking like the char/short fixes.
2026-06-10: blocked on task 149 — CWE-680 (int overflow → buffer overflow) spans the integer and buffer layers; build on the shared bounds API.

--- 2026-06-21 RESULT (v0.4.58, commit fa49d057) ---
Reframed: CWE-680 was never a precision problem (already 100% CWE-matched precision, 0 FP). The gap vs Frama-C (82.6%) is RECALL: per-file detection was 37.2% (125/336). The note's 'char/short narrow-type' guess didn't apply -- all 336 files use 'int data; malloc(data * sizeof(int))'; variation is the SOURCE of data + Juliet flow variant.

Fix: INT32-C check_allocation_overflow skipped any size arg whose product provably fit 64-bit signed, missing the 'fixed' pattern (data = INT_MAX/2 + 2 -> 4294967300, fits 64-bit but wraps 32-bit size_t). Now skips only when fits-64 AND not a definite 32-bit size_t wrap (expression_overflows_unsigned_vra(...,32,...)). Good 'data = 20' -> 80 stays clean.

Full fast benchmark sqc-0.4.57 -> sqc-0.4.58: overall TP +10 (22615->22625), FP +0 (4607), tp_rate 83.1% flat. ZERO CWE/rule regressions. Timing -0.8%. CWE-680: INT32-C 125->135 TP, per-file 37.2%->40.2%, still 0 FP.

Residual gap (40.2% vs 82.6%) needs interprocedural integer-range propagation = infra task 150 deferred. Tracked as task 215. Closing the no-infra portion here.done2026-06-10T03:51:31Z2026-06-21T17:10:08Z2026-06-21T18:59:01Z����s	555Real-world benchmark refresh + sampled precision audit at v0.4.21Real-world validation is ~80 versions stale (latest comparison: v0.3.5 in REALWORLD_RESULTS.md; latest DB run: v0.3.34 sqc-only). Two parts: (1) re-run the 5-project suite (libcrc, mosquitto, curl, sqlite, hostap) at v0.4.21 on the home machine; (2) manually adjudicate a random sample (~50 findings each from the top 3 noisiest rules, e.g. EXP34-C on mosquitto) to produce a MEASURED real-world precision number. This is the missing datum for the paper (answers the 8,657-EXP34-C-findings objection) and tells us whether the Juliet-driven FP fixes since v0.3.5 generalized. Output feeds the ceiling-decision task and task 147.done2026-06-10T12:32:35Z2026-06-10T13:26:51Z2026-06-10T20:18:10Z�j�
a�w555Refresh paper benchmark numbers to v0.4.21Paper table (tab:competitor) cites v0.4.17: CWE-190 66.8→67.8, CWE-191 63.3→65.9 (now beats Frama-C 63.1 by 2.8pp), CWE-680 60.0→63.2, CWE-121/122 unchanged. Overall-74-CWE TP rate 72.7% (was 72.6% at v0.4.17); recompute the 15-CWE-overlap overall (was 67.6). Also update prose claims about CWE-191 being the close row.
2026-06-10: now depends on task 148 — the refreshed paper numbers should include the v0.4.21 real-world results AND the sampled real-world precision figure, not just Juliet.done2026-06-10T03:51:31Z2026-06-10T22:06:12Z2026-06-11T12:19:24Z����k5Medium-tier FP cleanups: EXP33-C, FIO42-C, ARR39-C, WIN04-CGoal 3 (raise medium precision tiers). From v0.4.18 analysis: EXP33-C on CWE-123 (159 FP) and CWE-665 (212 FP); FIO42-C on CWE-773 (59 FP); ARR39-C on CWE-468 (32 FP); WIN04-C on CWE-319 (16 FP). Re-verify counts against sqc-0.4.21-62d93999 before starting; v0.4.21 also shows FIO30-C/CWE-134 696 FP (covered by task 142) and INT33-C/CWE-369 408 FP + FLP03-C/CWE-369 270 FP as additional candidates.
2026-06-10: demoted to P3. Note overlap with task 151 (CON/WIN triage) — if WIN04-C/ARR39-C signal stays weak after triage, consider demotion over FP-fixing.pending2026-06-10T03:51:31Z

�
���R��%555ARR30 FN 2b: param-decoder index over-read (os_kv kvvfsDecode class)Follow-up to task 172. The disclosed sqlite §2a FNs are mostly param-based index decoders, NOT blob-pointer walks, so the v0.4.52 conservative detector (blob/value-accessor pointer + varint/terminator chase) catches 0/14. Target shape: a function whose input buffer is a (cast of a) const char*/const unsigned char* PARAMETER with NO sibling length parameter, containing a while/for loop that indexes that buffer with an in-expression increment (aIn[++i], aIn[i++]) or while(1)+break, where the index is never bounded against any length in the function. Canonical: src/os_kv.c:469 kvvfsDecode(const char *a, char *aOut, int nOut) — dest aOut bounded by j+n>nOut but source aIn[i]/aIn[++i] unbounded (disclosed heap over-read). FP risk: plain while(*s)/while(s[i]) NUL-terminated C-string walks — must gate those out (stop-at-NUL is the caller contract). Requires full Juliet benchmark to tune; revert broadening if it regresses Juliet char*-walker precision. Detector scaffolding (collect_blob_tainted_pointers, check_unbounded_decode_loop, pointer_walk_is_bounded, UNTRUSTED_BLOB_ACCESSORS, VARINT_READERS) already in src/rules/cert_c/ARR/ARR30-C/arr30_c.rs.done2026-06-19T12:48:23Z2026-06-19T13:57:00Z2026-06-19T16:17:56Z
	{�	�t,��{��>�
U�+555Add TOML validation to build processbuild.rs merges individual rule TOML files but does not validate the output. Syntax errors, schema violations, and malformed fields go undetected until runtime. Originally P1-001 in AGENTS/PROPOSALS/BACKLOG.done2026-05-07T18:45:22Z2026-06-18T02:54:07Z2026-06-18T03:06:48Z����#	555Every rule violation should report where and why it failedRules should include precise source location and human-readable explanation in their output. Originally P0-003 in AGENTS/PROPOSALS/BACKLOG.done2026-05-07T18:45:18Z2026-05-19T00:48:42Z2026-05-19T01:22:21Z��
o�#	555Optimize runtime performance on real repositoriesTool is too slow for practical use on real codebases. Needs profiling and optimization pass. Originally P0-002 in AGENTS/PROPOSALS/BACKLOG.done2026-05-07T18:45:17Z2026-05-15T13:42:31Z2026-05-18T00:26:28Z�M�
E�Y555Add mutex poisoning recoveryMultiple lock().unwrap() calls in src/progress.rs and src/rules/cert_c/integration.rs have no poisoning recovery. A thread panic while holding a lock cascades to crash the entire run. Originally P1-002 in AGENTS/PROPOSALS/BACKLOG.done2026-05-07T18:45:24Z2026-05-07T19:31:22Z2026-05-07T19:31:22Z�E
�	555Eliminate compiler warnings (clean build generates noise)Clean build generates excessive warnings from stub rules, masking real issues. Root causes: unused imports in stub rules, missing allow attributes. Originally P0-001 in AGENTS/PROPOSALS/BACKLOG.done2026-05-07T18:45:15Z2026-05-07T19:24:17Z2026-05-07T19:24:17Z�u~�-�?555EXP15-C: do not fire on empty loop body when condition polls a volatile variable6 FPs in e_bms_primcu3124_scud — spin-poll busy-waits like while(_txif0==0); and while(!_hircf); flagged as likely accidental empty bodies. All are intentional hardware peripheral-ready/clock-stable polls. Also: sqc message says semicolon is 'on the same line' but it is consistently on the next line in this codebase. Fix: if loop condition operand is a volatile variable or has form while(volatile_var op constant), treat empty body as intentional and suppress EXP15-C.done2026-04-30T15:42:09Z2026-04-30T20:01:38Z2026-04-30T20:01:38Z�T}��555PRE07-C: do not flag trigraph sequences inside // or /* */ comments2 FPs in e_bms_primcu3124_scud — sys.c:319,340 have ?- sequences inside // comments where Chinese text is garbled/truncated (变量初始??? etc.). Even if it were a real trigraph (expands to ~), trigraphs in C99+ comments have no semantic effect. Fix: skip PRE07-C when the trigraph-like sequence appears inside a comment.done2026-04-30T15:42:09Z2026-04-30T20:01:38Z2026-04-30T20:01:38Z�@|��c555EXP02-C: allow hardware-flag && countdown-decrement short-circuit pattern3 FPs in e_bms_primcu3124_scud — while((_iar2 & 0x04) && (--timeout)) pattern: left operand is hardware register flag check (volatile), right is bounded countdown --timeout. Short-circuit is intentional: if hw condition clears, timeout is not decremented. Same pattern documented in d_lib_common FP-016/FP-019. Fix: extend EXP02-C exemption to cover VOLATILE_FLAG_CHECK && (--counter) pattern, not just NULL_CHECK && fn_call.done2026-04-30T15:42:09Z2026-04-30T20:01:38Z2026-04-30T20:01:38Z�w{�G�)555ARR39-C: do not flag sizeof-bounded loop when pointer type is u8*/uint8_t* (element size = 1)1 FP in e_bms_primcu3124_scud — sys.c:372: for(i=0;i<sizeof(bsm_data_log);i++) with (u8*)bsm_data_log.CELL_MAX+i. Pointer cast to u8* so +i advances exactly 1 byte. sizeof() and pointer step are in same unit. Fix: ARR39-C should not fire when pointer type is u8*/uint8_t* since element size is 1 byte and no scaling mismatch exists.done2026-04-30T15:42:09Z2026-04-30T20:01:38Z2026-04-30T20:01:38Z
/���
��1	�r,2�"���
	5Investigate residual INT32-C/INT31-C/INT30-C FPs despite VRAINT32-C: CWE-190 1,287 FP / CWE-191 1,020 FP (v0.4.21). INT31-C: CWE-195 690 + CWE-194 330 + CWE-197 ~228 FP. INT30-C: CWE-191 306 FP. UPDATE 2026-06-09: the switch-case-guards-not-in-CFG hypothesis was CONFIRMED and fixed in v0.4.20/21 (process_opaque_region in value_range.rs + mid-block replay via get_all_var_ranges_at in��Q���k	5Investigate residual INT32-C/INT31-C/INT30-C FPs despite VRAINT32-C: CWE-190 1,287 FP / CWE-191 1,020 FP (v0.4.21). INT31-C: CWE-195 690 + CWE-194 330 + CWE-197 ~228 FP. INT30-C: CWE-191 306 FP. UPDATE 2026-06-09: the switch-case-guards-not-�r�
]�555Add folder nesting to interactive clientInteractive client should support navigating rules organized by folder/category. Originally P1-004 in AGENTS/PROPOSALS/BACKLOG.done2026-05-07T18:45:29Z2026-06-18T03:33:36Z2026-06-18T03:47:36Z�[�
O�k555Improve test debugging experienceGenerated test names are opaque, failure output lacks source location, debug prints get overwritten on rebuild. Need better linkage between failing test name, .c file, and CERT C wiki example. Originally P1-003 in AGENTS/PROPOSALS/BACKLOG.done2026-05-07T18:45:26Z2026-06-18T03:20:14Z2026-06-18T03:27:37Z�B�
s�	555Investigate and fix STR31-C false positive patternsSTR31-C has 1,671 FPs (53.3% rate) — the single largest FP contributor. Does NOT use VRA. Uses text-pattern matching for strlen/sizeof/strncat guards. Need to: (1) run get_cwe_detail on CWE-121/CWE-122 to identify which Juliet variants are failing, (2) inspect the actual failing files to understand the pattern, (3) implement targeted fixes. VRA may not apply directly since this is about string lengths, not integer arithmetic — investigate first.done2026-05-17T15:29:05Z2026-06-09T18:26:34Z2026-06-09T21:45:57Z�5�

u�{	555Add VRA suppression to ARR30-C index bounds checkingARR30-C has 1,121 FPs (38.2% rate) and does NOT use VRA at all. VRA infrastructure is mature (value_range.rs). For static arrays like int arr[10], when VRA proves the index variable's range at the access point is within [0, array_size-1], suppress the violation. This is the most direct VRA extension possible — a clean intersection of index_range ⊂ [0, N-1]. See int32_c.rs for how to call needs_vra/set_vra_results/vra_var_ranges_at.done2026-05-17T15:29:05Z2026-05-17T15:29:16Z2026-05-17T17:33:55Z��	��E5Fix wiki parser to exclude output examples from test generationWiki scraper creates test .c files from runtime output blocks (not actual C code), producing unparseable test files. Example: MSC32-C tests/fail/wiki_posix_2.c. Parser needs to distinguish code examples from output documentation. Originally P2-WIKI-PARSER in AGENTS/PROPOSALS/BACKLOG.pending2026-05-07T18:45:40Z�e�
u�Y555Automate mod.rs rule registry generation in build.rsEvery new rule requires two manual edits to src/rules/cert_c/mod.rs (pub mod declaration + registry.register call). Should be auto-generated from directory scan in build.rs. Originally P2-AUTO-REGISTRY in AGENTS/PROPOSALS/BACKLOG.done2026-05-07T18:45:37Z2026-05-07T19:25:40Z2026-05-07T19:25:40Z�M�
�555Implement FIO30-C: Exclude user input from format stringsHigh-priority CERT C rule (P18 severity). Requires interprocedural taint analysis framework — significant architectural work, estimated 40-60 hours. Originally P1-FIO30-C in AGENTS/PROPOSALS/BACKLOG.done2026-05-07T18:45:33Z2026-05-07T19:24:17Z2026-05-07T19:24:17Z�@�
s�555Implement EXP34-C: Do not dereference null pointersHigh-priority CERT C rule (P18 severity). Requires scope-aware control-flow analysis — significant architectural work, estimated 25-60 hours. Originally P1-EXP34-C in AGENTS/PROPOSALS/BACKLOG.done2026-05-07T18:45:32Z2026-05-07T19:24:17Z2026-05-07T19:24:17Z�
]�5Add folder nesting to interactive clientInteractive client should support navigating rules organized by folder/category. Originally P1-004 in AGENTS/PROPOSALS/BACKLOG.pending2026-05-07T18:45:29Z
TQ
�xQ�6�^�'�G555SIG31-C double-emits per shared-object reference instead of per (object,line)SIG31-C reports the same 'accesses shared object X which is not volatile sig_atomic_t' finding twice for some accesses. Repro: sqc --rules SIG31-C on CWE364_Signal_Handler_Race_Condition__basic_01.c -> line 32:9 emitted 2x and 40:9 emitted 2x (identical message), while 30:9 and 38:9 emit once. Run sqc-0.4.58-fa49d057: 108 total / 72 distinct, ratio 1.5. Looks like it emits per textual reference/occurrence rather than deduping on (object, line). Engine has no dedup backstop (mod.rs:312). Fix: dedup per (shared-object, access-statement).done2026-06-22T22:36:25Z2026-06-23T03:35:05Z2026-06-23T03:44:39Z�E�]
q�555POS37-C emits each finding twice (exact duplicate)POS37-C reports the identical finding twice on the same line:col with the same message. Repro: sqc --rules POS37-C on CWE273_Improper_Check_for_Dropped_Privileges__w32_ImpersonateNamedPipeClient_01.c -> two byte-identical hits at 53:9 ('ImpersonateNamedPipeClient() return value not checked'). Confirmed across every CWE273 testcase (run sqc-0.4.58-fa49d057: 72 total / 36 distinct file:line, ratio 2.0). Same bug CLASS as DCL02-C (task 220) but a distinct root cause -- the check() likely visits the call node via two traversal paths or matches two patterns. Engine does NOT dedup (analyze_project only sorts, mod.rs:312), so the dup reaches output and inflates FP counts. Fix: emit one finding per (call-site).done2026-06-22T22:36:25Z2026-06-22T22:38:32Z2026-06-22T22:47:29Z$��5Engine-level duplicate-finding backstop i� �`��A555Engine-level duplicate-finding backstop in analyze_projectanalyze_project (src/analyze/mod.rs:312) only SORTS violations before returning -- there is no dedup, so any rule that double-emits silently inflates findings (and FP counts in the benchmark DB). Confirmed offenders: DCL02-C (task 220, fixed), POS37-C (221), SIG31-C (222); FIO42-C (223) is a misclassification a plain dedup won't fix. Add a cheap defensive dedup at the per-file collection point: collapse exact duplicate (rule_id, file_path, line, column, message) within a file before pushing to file_violations. Also add a debug_assert / opt-in warning that fires when a rule emits an exact dup, so future rules can't regress unnoticed. This is a BACKSTOP, not a substitute for fixing the rules (a dup usually signals a real traversal/classification bug worth fixing at the source). Keep it after suppression filtering and before the sort. Verify Juliet TP/FP deltas are dup-only (recall unchanged).
RESOLUTION (won't-do, 2026-06-23): Closing without implementing. Rule-level fixes (220 DCL02-C, 221 POS37-C, 222 SIG31-C) address the root causes; 223 FIO42-C was a misclassification a dedup wouldn't fix anyway. An engine-level dedup backstop would MASK future double-emit bugs rathe�-�\
o�o555DCL02-C emits duplicate findings (100x same line)Lua oracle b12 (lgc.c) found DCL02-C fired the identical n/h identifier-similarity finding 100x on line 793 and 100x on line 811 (200 of 203 DCL02-C hits are exact dupes of 2 lines). Finding dedup is failing for DCL02-C — inflates finding counts and FP volume in benchmarks. Repro: sqc on lgc.c @ Lua 40b76de2 with lua-rules.toml. Likely the similar-identifier pairwise scan re-emits per comparison instead of per declaration site.done2026-06-22T13:33:13Z2026-06-22T22:02:24Z2026-06-22T22:21:16Z�S�[�
�555sqc DB result reports whole-repo c_files/loc, ignoring --excludeWhen sqc runs with --exclude globs (e.g. Lua: onelua.c/ltests.c/testes), the benchmark DB row reports c_files/loc for the FULL repo set (counted via cppcheck source_dirs), not the reduced fileset sqc actually scanned. E.g. Lua showed c_files:40 loc:34183 though sqc scanned 33 files. The LOC/file-count metric should reflect the post-exclude set sqc analyzed. Cosmetic but skews per-codebase density/normalization. Surfaced during Lua baseline (task 191).done2026-06-21T23:44:21Z2026-06-23T14:30:20Z2026-06-23T14:32:57Z
�WW�	r���^�*�7�S	5Disposition the 37 zero-TP rules from sqlite audit (suppress / gate / raise-evidence)ANALYSIS.md §1: 37 rules fired >=20�V�&
{�5Explore: optional local AI-assisted review model in sqcExploration spawned by the file-at-a-time real-world audit (task 163). The audit empirically shows sqc's SEMANTIC rules (MEM30/INT30-32/ARR/EXP33-34/API00) are ~0% precise on hardened production C — the FP mass is exactly the class a Claude-subagent adjudication pass reliably filters (and which also surfaced a real FN, the matchinfo OOB write). Investigate baking an OPTIONAL, opt-in local/on-device AI-assisted review stage into sqc itself: (1) a post-analysis triage that scores/suppresses likely-FP semantic findings before they reach the user (could lift real-world precision from single digits toward usable); (2) optionally an FN-assist that reads high-risk untrusted-input decode routines. Design considerations: must be OPTIONAL and local (privacy / no code leaves the host — BISSELL Data Protection principle); model packaging/size; latency budget; determinism/reproducibility for benchmarks; how to present AI-adjudicated verdicts (confidence + rationale) without overclaiming (Data Quality principle, human-review). Tie-in: the audited-corpus oracle (data/benchmarks.db ground_truth) is the natural eval set to measure whether an AI-review stage improves precision without tanking recall. Decide build-vs-skip after more of the real-world suite is audited.pending2026-06-12T14:54:42Z�;�'��[	555MEM30-C freed-context-arg FP suppression (2300 FP / 0 TP in sqlite audit)ANALYSIS.md (commit fd942348) §1: MEM30-C = 2300 FP / 1 TP across the 24,834-finding sqlite corpus (0.0% precision), the #2 FP source. Dominant misfire: sqc reads the CONTEXT arg of sqlite3DbFree(db,x) / sqlite3*Delete(db,x) / robust_close(pFile) as the freed object — the live handle is never freed (the real freed arg is read first). Also %z mprintf-accumulator frees misread as double-free. Fix: when a free-like call has a (handle,target) signature, treat only the target operand as freed. Related mechanism task: 1 (field-level free tracking).done2026-06-14T22:19:35Z2026-06-15T11:51:10Z2026-06-15T12:36:59Z_t�;�(��e	555EXP34-C guarded-null FP suppression (1496 FP / 7 TP in sqlite audit)ANALYSIS.md §1: EXP34-C = 1496 FP / 7 TP (0.5%), #3 FP source. Misfire: null-deref already dominated by an assert / rc==SQLITE_OK / explicit if(p) guard, or OOM paths that set rc before deref. Fix: suppress when a guard (assert/rc-check/if) on the pointer dominates the deref. NOTE the flip side is FN task (EXP34 OOM null-deref AFTER malloc) — keep the guard-aware suppression from also masking the unguarded-malloc pattern.done2026-06-14T22:19:35Z2026-06-15T12:45:53Z2026-06-15T13:55:37ZO
{�5	5GATE: sqlite FP reduction before new-codebase expansionUser decision (2026-06-14): tamp down sqlite FPs BEFORE auditing new codebases — the misfire patterns (ANALYSIS.md §1) are codebase-independent and will recur in mosquitto/curl/hostap, inflating their FP counts and audit cost. This milestone is met when the high-volume ~0% rules are gated: INT32/31/30 (140), MEM30 freed-context-arg, EXP34 guarded-null, API00 internal-contract, and the 37 zero-TP rules dispositioned. Re-run the sqlite audit subset to confirm precision lift, THEN unblock the new-codebase audits (157/158/159).pending2026-06-14T22:19:35Z�W�)��	555API00-C internal-contract FP suppression (1366 FP / 1 TP in sqlite audit)ANALYSIS.md §1: API00-C = 1366 FP / 1 TP (0.1%), #4 FP source. Misfire: flags params that an internal contract guarantees non-null (mutex held / caller invariant / asserted) — not a trust boundary. Fix: API00 should fire only at actual external trust boundaries (public API entry, untrusted input), not internal callees.done2026-06-14T22:19:35Z2026-06-15T15:04:54Z2026-06-15T16:04:55Z
�T���&�4�?�555Shared root-cause FP: external function-like macro opacity (utlist/uthash) -> EXP33/EXP34PHASE 1 COMPLETE + VALIDATED (0.4.35, commit a6275b1b). Shared positional registry src/analyze/macro_semantics.rs (iterator table + HASH_FIND*/HASH_REPLACE* prefix family). Consumers: init_state (EXP33 init), EXP33 read-check skip, EXP34 iterator-body non-null. SAME-VERSION A/B on mosquitto (0.4.33 baseline vs 0.4.35, pinned commit d3ee5c5c, identical harness cmd): TOTAL 12534->12105 (-429); EXP33 488->176 (-312); EXP34 503->386 (-117); ZERO net-new findings. Juliet recall IDENTICAL (CWE-457 TP506/FP31; CWE-476 TP370/FP175) -> recall-safe. sqlite ~unchanged (no utlist/uthash). Full lib suite green; pass fixtures for DL_FOREACH/HASH_ITER/HASH_FIND/HASH_FIND_BYHASHVALUE. Family-prefix fix closed the one gap the A/B surfaced (HASH_FIND_BYHASHVALUE @ subs.c:520).done2026-06-16T12:35:56Z2026-06-16T13:49:40Z2026-06-16T15:30:18Z�K�3�%�=5File mosquitto Phase-2 OOM-robustness PRs (03/04/06/07/08/10) + defensive 09After Phase-1 lands. Drafts in data/precision_audit/mosquitto/upstream_prs/: 03 http_client leak, 04 options TLS-setter strdup leaks, 06 net_mosq verify_hostname SSL+socket leak, 07 net.c socks realloc fd leak, 08 handle_connect BIO_new NULL deref, 10 websockets lws_create_context leak. Most are injection-only (OOM) -> provide fault-injection harness + expected output. 09 (websockets size_t underflow) is defensive-only/not-attacker-reachable -> low-priority hardening. 05 tls_opts_set WITHDRAWN (not a bug). One atomic PR per fix, phased. Branches not yet built (only Phase-1 + SRV built so far).pending2026-06-16T12:32:34Z�(�2
i�55File mosquitto PR: persist_write double-fcloseBranch fix/persist-write-double-fclose (off origin/master, signed barrendo@gmail.com). PR body: data/precision_audit/mosquitto/upstream_prs/pr_bodies/pr-11-persist-double-fclose.md. Error-path double fclose; repro via harness/fwrite_fail_dotnew.c (LD_PRELOAD fails fwrite to .new temp). Push+gh pr create as for #3666; AI-disclosure footer.pending2026-06-16T12:32:34Z
EE��7�5��q555Shared root-cause FP: free-state precision (free->reassign / conditional / struct-field / loop conflation) -> MEM30/MEM12CROSS-VALIDATION FINDING (mosquitto+sqlite, see memory mosquitto-cross-validation.md): the dominant shared MEM30/MEM12/MEM31 FP mass comes from imprecise free-state tracking, NOT the (handle,target) free-arg pattern already fixed (task 167). Mosquitto-confirmed patterns (~96% FP across MEM30 657/MEM31 131/MEM12 118): (1) free-then-reassign: mosquitto_FREE(x); x=alloc(); if(!x){} -> sqc flags the reassignment/check as UAF (missing the reassign); (2) conditional free treated as unconditional: if(c){FREE(p);} then later p->m flagged UAF; (3) struct-field-free cascade: FREE(s->a) makes sqc flag all s->* (incl other fields) as UAF; (4) loop-iteration conflation: FREE(item) inside DL_FOREACH_SAFE frees a DIFFERENT node each iter, sqc conflates as same object -> double-free/UAF FP. Relates to deferred capability tasks 1 (MEM30 field-level free) and 2 (MEM31 ownership) but these are the concrete recall-safe precision fixes. Moves BOTH oracles. Validate on Juliet (preserve CWE-415/416/401 recall) + mosquitto + sqlite.
PATTERN 3 SHIPPED (2026-06-17, v0.4.39 commit 10a5ee48): struct-field-free cascade fixed in MEM30-C by gating union member-aliasing on genuinely union-typed bases (typedef-union names per TU + union-typed locals/params per fn); struct/struct-pointer bases no longer poison siblings/base. GATES PASSED: Juliet every completed CWE Δ0 (CWE-415 TP342/FP246, CWE-416 TP156/FP12, 401/590/762 all Δ0 — fix inert on Juliet by design); curl+mosquitto MEM30 oracle FP 732->412 (-44%), recall 0/3->0/3 (no regression). REMAINING (still open under this task): (1) free-then-reassign, (2) conditional-free-as-unconditional, (4) loop-iteration conflation.
PATTERN 1 GATE (v0.4.40 5a9d90be): NOT inert on Juliet (commit msg claim was wrong). Cast-unwrap of RHS alloc also fixes the pervasive Juliet idiom 'data=NULL; data=(cast)malloc(); free; free' — 0.4.39 left data flagged nullified (cast-malloc unrecognized), SUPPRESSING the genuine double-free. So pattern-1 fix IMPROVES recall: Juliet CWE-415 TP+126/FP+96, CWE-416 TP+78/FP+12 (net +204 TP / +108 FP; new-flag precision 65%, ABOVE MEM30 baseline => raises precision). curl+mosquitto MEM30 oracle FP 412->372 (-40), recall 0/3->0/3. Net win on all axes (real-world FP down, recall up). Remaining patterns: (2) conditional-free, (4) loop-iter.
PATTERN 2 SHIPPED + GATED (2026-06-17, v0.4.41 commit d3ce8d09). Branch-merge now treats goto/break/continue as terminators (not just return); also fixed latent bug where a trailing comment node defeated the compound-statement terminator check (skip comment nodes). unconditionally_returns -> unconditionally_diverges. GATES PASSED: Juliet TP 22165/FP 5602 IDENTICAL 0.4.40->0.4.41 on every CWE (inert on Juliet, zero recall risk); MEM30 oracle FP 372->313 (-59, -16%), recall 0/3->0/3. Kills curl ldap.c/fopen.c + mosquitto ctrl_shell_* free-then-goto/break clusters. PATTERN 4 (loop conflation): determined to be a NON-ISSUE — zero oracle footprint (the 'in loop' detector fires 0 times on curl+mosquitto; sqc single-pass can't conflate iterations). The clusters filed under pattern 4 were all pattern 2. TASK COMPLETE: patterns 1 (v0.4.40), 2 (v0.4.41), 3 (v0.4.39) shipped; pattern 4 N/A. Follow-ups spun out: task 197 (block-level text-scan robustness) + new task (realloc-on-field cluster).done2026-06-16T12:35:56Z2026-06-17T14:10:15Z2026-06-17T23:24:47Z
��������?�8�m�555Macro-expansion Phase 0: tree-sitter parse feasibility spike (MACRO(args){block}, preproc_function_def recovery)Per docs/design/macro-expansion.md §6. Confirm how tree-sitter parses function-like macro invocations with a trailing block (call_expression+sibling compound vs ERROR node — note existing ERROR handling at init_state.rs:946), and how reliably preproc_function_def bodies/args are recoverable for utlist/uthash as vendored in real projects (sqlite/mosquitto). Decide splice representation for Phase 2 (re-parsed sub-tree vs synthetic dataflow events). Also answer §9 open Q: are utlist/uthash scanned-as-headers (Phase 2 can expand directly) or only transitively included (registry needed)? Output: go/no-go note appended to the design doc.done2026-06-16T13:25:06Z2026-06-16T13:37:14Z2026-06-16T13:41:16Z��=�C5Macro-expansion Phase 3: migrate ~51 rule files off ad-hoc macro logic onto shared infraPer docs/design/macro-expansion.md §6. Replace per-rule macro workarounds (FOR_EACH_MACROS, match_initializing_function/get_output_arg_indices, scattered preproc_* handling across ~51 of 290 rule files) with the Phase-1 registry + Phase-2 engine. Delete dead tables. Pay down the macro tech debt; ensure consistency. Heavy regression surface — gate on Juliet recall + real-world FP delta. Depends on Phase 2.pending2026-06-16T13:25:06Z���U5Macro-expansion Phase 2: in-tree function-like macro expansion enginePer docs/design/macro-expansion.md §5(B)/§6. General substitution engine over macro definitions present in scanned files (preproc_function_def in-file + prescanned sibling/included headers): argument substitution, #/## operators, __VA_ARGS__, recursive rescanning rules, ERROR-node robustness for MACRO(args){block}. Expanded snippet parsed and spliced into CFG/dataflow at the invocation site; source locations map back to original file:line. Generalizes beyond the Phase-1 registry to project-local + vendored single-header macros. Recall-gate Juliet; FP-delta sqlite+mosquitto. Depends on Phase 0 + Phase 1.pending2026-06-16T13:25:06Z��7�_�)5Re-scope task 170 follow-through: group-A noise is fixed by RULE HARDENING, not config-disable (reverted)The task-170 config-disable approach was reverted: conf/realworld/*.toml only drops categorically-INAPPLICABLE rules; per-finding FP is recorded in ground_truth oracle so the benchmark measures precision improvement, not hides it. None of the 19 group-A rules (EXP33,API02,EXP43,STR34,MSC37,FIO47,ARR01,DCL31,PRE32,STR30,FLP03,ARR36,FLP34,ARR39,FIO42,FIO50,EXP07,WIN04,EXP30) is platform/domain-inapplicable, so none belongs in a config disable set. libcrc proved it: EXP33 zero-TP on sqlite+mosquitto but 1 real TP / 9 FP on libcrc (macro-opacity noise). Route the noise reduction through existing hardening tasks: EXP33/EXP34 macro opacity=180 (+118/146), MEM30/MEM12 free-state=181, EXP34 contract=175, FN taint=172, group-B raise-evidence (EXP20/INT33)=182. This task is the umbrella/tracking item; close once those land or fold it into them. See data/precision_audit/mosquitto/adversarial_verification.md.pending2026-06-16T12:55:45Z��6�M�=5Group-B raise-evidence: gate EXP20-C !strcmp idiom + confirm INT33-C bridge.c:930 div-by-zero TPFollow-up from task 170 (group B = keep-but-strengthen). EXP20-C: ~half of its 8 mosquitto credits were the !strcmp/!strncmp idiom (http_serv.c:176/177/198, topic_tok.c:103, websockets.c:554) — real-world precision weaker than raw audit; add an evidence gate so the idiom doesn't count, do NOT disable (8 real TPs). INT33-C: adversarial pass flipped src/bridge.c:930 FP->TP (medium conf) — (high-low) used as divisor with no high>low guard; re-read, confirm TP, add guarded-divisor check. Other group-B rules (CON03,MEM31,INT00,MEM12,ENV01,EXP37) confirmed catching real bugs, left enabled as-is. See data/precision_audit/mosquitto/adversarial_verification.md.pending2026-06-16T12:42:51ZL$32ADEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcd78B15Cef/09+#%:;<= !n6$9himniwxloqr?p
p�z
G�1555Analysis capabilities roadmapDescription:
Track fundamental analysis limitations and potential improvements.

Details:
DONE. Updated docs/architecture.rst with comprehensive inventory of all 10
analysis modules, current capabilities table (17 entries), known limitations
table (8 entries with impact descriptions), per-CWE ceiling analysis, and
updated competitor landscape from 5-tool benchmark. Previous version was
heavily outdated (referenced "No VRA", "No whole-program analysis", 48% TP
rate — all now incorrect).

Original status line: done (v0.3.87)done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z�
%�Y5Docker imageDescription:
Containerized CI/CD distribution of sqc.

Details:
Dockerfile for sqc with all dependencies. Enables drop-in CI/CD usage without
local Rust toolchain installation. Part of Tier 2 production quality definition
of done.pending2026-04-20T16:45:55Z�K
I�Q555Inter-procedural .c test casesDescription:
Multi-file C test cases for prescan/call-site propagation.

Details:
DONE. Added 13 multi-file CLI integration tests exercising 4 cross-file
prescan capabilities:

  1. Callsite null propagation (EXP34-C): NULL arg detected across files,
     no detection without -d, safe caller not flagged. (3 tests)
  2. can_return_null (EXP34-C): unchecked nullable return detected,
     checked return safe. (2 tests)
  3. frees_params (MEM31-C): cross-file free suppresses leak, no
     suppression without -d, actual leak still detected. (3 tests)
  4. header_declared_functions (DCL15-C): header-prototyped functions
     suppressed, all flagged without -d. (2 tests)

  Fixtures: tests/fixtures/cli/{crossfile_callsite_null, crossfile_frees,
  crossfile_header}. Each scenario tests with-d, without-d, and safe
  variants.

Original status line: done (v0.3.87)done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z�
9�5DCL13-C alias trackingDescription:
Reduce DCL13-C FPs (12,138 real-world) via alias/points-to analysis.

Details:
Const correctness violations where pointer params flow through struct fields.
Example: ringbuffer.c:275 ptrBuffer — pointer stored into struct field, then
memset writes through struct member. Requires alias/points-to tracking.
Possible shortcut: if a pointer param is stored into a struct field, treat it
as potentially modified.

Original status line: deferredpending2026-04-20T16:45:55Z�
;�5MEM31-C ownership modelDescription:
Reduce MEM31-C FPs (5,440 real-world) via ownership tracking.

Details:
Cross-function ownership patterns (strdup -> struct field -> custom_Delete)
require an ownership model to track which function is responsible for freeing
allocated memory. New analysis capability, high effort.

Original status line: deferredpending2026-04-20T16:45:55Z�M
O�5MEM30-C field-level free trackingDescription:
Reduce MEM30-C FPs (15,330 real-world) via field-level free tracking.

Details:
Sequential struct/member frees and cross-function free propagation cause high
FP count. Requires field-level free tracking — a new analysis capability beyond
current architecture. Deferred until ownership model (task 9) or field-sensitive
analysis is implemented.

Original status line: deferredpending2026-04-20T16:45:55Z
{
!e$
qP{�%��W�u555MEM03-C/MEM30-C/MEM31-C: branch-sensitive dataflow analyzers recurse unbounded through nested if/elseTask 153 batch 3: MEM03-C's analyze_block/process_statement, MEM30-C's MemoryAnalyzer::analyze_node/analyze_function/analyze_function_body/analyze_if_statement chain, and MEM31-C's MemoryLeakAnalyzer chain all thread branch-sensitive state (e.g. per-scope cleared-pointer sets) through recursion that mirrors nested if/else structure -- same stack-overflow risk class as the original hostap ARR00-C/MEM33-C bug, and can't be mechanically flattened via substrate::query since state must fork/merge per branch. Also MEM30-C's GlobalTracker::scan_function_body has an order-dependent has_recursive_call flag plus a #if 0 subtree prune, flagged as a secondary bounded-depth concern. Needs bespoke explicit-stack rewrites that preserve per-branch state forking.done2026-07-03T21:14:17Z2026-07-06T13:42:23Z2026-07-06T13:54:14Z�=��C�9555INT33-C: has_early_return_for_zero / collect_assignments_all_nonzero residual overflow riskTask 153 batch 2: these two INT33-C helpers prune by statement position/kind combination that substrate::query can't mechanically replace, and can still stack-overflow on pathologically nested if/else-if or block chains (same risk class as the original hostap ARR00-C/MEM33-C bug). Float-typing predicates (division_is_floating/expr_is_float) are unaffected/untouched. Needs bespoke explicit-stack rewrite.done2026-07-03T20:25:05Z2026-07-06T13:34:21Z2026-07-06T13:39:08Z�g��E�555INT32-C/INT30-C: resolve_identifier_call_name residual overflow risk via nested if/while/forTask 153 batch 2: INT32-C and INT30-C's resolve_identifier_call_name recurses through nested if/while/for blocks within a function body (row-position + kind-allowlist pruned), narrower than the original file-wide hostap-style risk but not eliminated. Needs a bespoke explicit-stack walk or restructuring to close fully.done2026-07-03T20:25:05Z2026-07-06T13:28:22Z2026-07-06T13:33:41Z���G�u555DCL30-C: find_static_address_assignment / has_alloc_assignment_in_body residual overflow riskTask 153 batch 3: these two DCL30-C helpers recurse through nested if/else chains with kind-gated descent (only compound_statement/if_statement/preproc_* children), which can't be flattened to substrate::query without changing which nested declarations/assignments are found. Same stack-overflow risk class as the original hostap bug. Needs bespoke explicit-stack rewrite.done2026-07-03T21:14:17Z2026-07-06T13:23:19Z2026-07-06T13:27:17Z�,��%�5555DCL01-C: check_scope_for_shadowing recurses unbounded through else-if chainsTask 153 batch 3: DCL01-C's check_scope_for_shadowing threads a HashMap of outer-scope variables through node-kind-dependent recursion (new scope vs merge), which substrate::query::find_descendants can't replicate. Its if_statement arm recurses into consequence/alternative, and a long else-if chain nests if_statement as the alternative of the previous one -- same statement-kind-chained-recursion shape as the original hostap ARR00-C/MEM33-C bug. Needs a bespoke explicit-stack rewrite that still tracks per-scope shadowing state.done2026-07-03T21:14:17Z2026-07-06T13:16:23Z2026-07-06T13:21:00Z�[��Q�15CON34-C/CON40-C: byte-position/expression-depth pruning leaves residual deep-nesting overflow riskDuring task 153 batch 2 migration, CON34-C::collect_local_vars_before prunes by start_byte() position (not node kind), and CON40-C::count_var_references prunes only call_expression subtrees while still walking full binary/conditional-expression nesting depth. Neither can be mechanically replaced by substrate::query::find_descendants (no skip mechanism), and both retain a pathological-nesting stack-overflow path analogous to the original hostap ARR00-C/MEM33-C bug (deeply nested statement prefix / deeply nested binary-expression chain, respectively). Needs bespoke explicit-stack rewrites.pending2026-07-03T20:25:05Z
 � �k��/�)555FIO22-C: process_statement still recurses unbounded through nested if/else chainsDuring task 153 batch 1 migration (commit c7bf7fc4), FIO22-C's process_statement/check_compound_statement/check_node mutual recursion was intentionally left recursive because its default arm (_ => {}) prunes descent for unhandled statement kinds (switch/labeled/case), which substrate::query::find_descendants can't replicate without changing which violations fire. However, that pruning is by statement KIND, not depth -- an else-if chain is not pruned, so the same hostap-style multi-thousand-deep else-if stack overflow that originally motivated task 153 (ARR00-C/MEM33-C) is still reachable through this rule. Needs a bespoke fix: either a stateful explicit-stack walker that replicates the kind-based pruning, or restructure process_statement to unwrap else-if chains iteratively before falling back to recursion for genuinely nested blocks.done2026-07-03T19:55:27Z2026-07-06T13:01:10Z2026-07-06T13:14:02Z�N�~�I�U555Migrate remaining 61 CERT-C rule files off recursive AST descendant-search to substrate::queryContinuation of task 252. lang-parsing-substrate 0.1.7 fixed find_descendants/find_first_descendant to be iterative (stack-based); 24/85 files already migrated in this pass (ARR02-C, CON35-C, DCL18/19-C, ERR34-C, EXP11/14/19-C, FIO06/09/17/46-C, FLP37-C, INT10-C, MSC41-C, POS52-C, PRE00/10/12-C, STR01/03/04/11-C, WIN00-C) — build/tests(3417)/clippy all clean after every batch, zero regressions.

Recipe: for each file's recursive helper, replace with query::find_descendants_of_kind(s)/find_first_descendant/find_descendants(node, |_| true) depending on whether the predicate reduces to a kind match or needs a closure. Do NOT touch recursion that is bounded by declarator/expression nesting (not source/statement depth) — e.g. pointer/array declarator unwrapping, cast-expression pruning walks (find_descendants can't replicate early-return pruning). Verify build + cargo test --lib + clippy -D warnings after every 3-4 file batch.

Remaining 61 files (from the original 85-file survey): CON31-C, CON37-C, CON39-C, CON43-C, DCL05-C, DCL17-C, DCL21-C, DCL22-C, DCL23-C, DCL31-C, DCL36-C, DCL37-C, DCL38-C, DCL40-C, DCL41-C, ENV01-C, ENV02-C, ENV30-C, ERR01-C, ERR02-C, ERR32-C, EXP37-C, EXP42-C, EXP44-C, EXP45-C, EXP47-C, FIO13-C, FIO15-C, FIO19-C, FIO21-C, FIO23-C, FIO32-C, FIO38-C, FIO41-C, FIO44-C, FIO50-C, FLP02-C, FLP04-C, FLP06-C, FLP07-C, INT00-C, INT02-C, INT05-C, INT08-C, INT13-C, MEM05-C, MEM06-C, MEM07-C, MEM35-C, MEM36-C, MSC33-C, MSC40-C, POS01-C, POS38-C, POS44-C, POS50-C, POS53-C, SIG34-C, STR32-C, STR34-C, STR37-C.

Note: EXP45-C and STR03-C(done) both had an 'unclear' flagged is_ancestor_of/is_ancestor helper from the survey that turned out to be a false positive (bounded containment check, not real recursion) — check EXP45-C's is_ancestor_of the same way before assuming it needs migration.done2026-07-02T16:18:55Z2026-07-02T17:37:18Z2026-07-02T18:33:48Z��}�Q�15lang-parsing-substrate 0.1.5 CFG builder not adopted: missing macro-constant folding + switch/gotosubstrate::cfg::build_function_cfg (v0.1.5) mirrors sqc's own BasicBlock/CfgEdge/FunctionCfg types by design but only handles c/cpp/rust v1 shapes: no switch/goto decomposition and no constant-condition dead-branch folding. sqc's src/analyze/cfg.rs has both, notably build_function_cfg_with_constants which folds branches using MacroConstantMap (C-preprocessor-specific, out of scope for the substrate per its own commit message). Swapping would regress dead-branch handling silently unless a compat shim is built first. Needs a design decision (keep sqc's CFG, or build the macro-folding as a post-pass on top of substrate's cfg) before attempting the swap.pending2026-07-02T02:21:30Z
���j	
W�K5Paper — finalization and submissionDescription:
Final paper revisions, formatting, and submission preparation.

Details:
Current state:�n}��55Paper — taint tracking for CWE-78/CWE-89 (future work)Description:
Expand cross-function taint tracking for injection CWEs,
  referenced in paper future work section.

Details:
Partial delivery via tasks 67-69 plus v0.3.99 (49A), v0.3.101 (49B),
v0.3.102 (49C), and v0.3.103 (49D). CWE-78 62.8% → **94.8%** (+32.0pp,
now exceeds clang-tidy), CWE-194 58.4% → **69.4%** (+11.0pp), CWE-195
48.7% → 52.5% (+3.8pp).

Delivered infrastructure:
  - `FunctionSummary.has_env03_taint_source` — body text scan for ~25
    taint sources (recv, fgets, scanf, getenv, Win32 I/O, etc.)
  - `FunctionSummary.returns_tainted` + `returns_from_callees`
    (v0.3.99, task 49A) — seeded from `has_env03_taint_source` on non-
    void returns, then propagated to fixpoint via
    `propagate_return_taint` so wrapper chains
    (`char *wrap() { return readIt(); }`) inherit the bit.
  - Reverse call graph built in each consuming rule from
    `ProjectContext.call_graph`.
  - Same-named static function merging in prescan (any tainted def
    poisons the merged summary; OR-merges both taint bits).

Rule integrations so far:
  - ENV03-C: parameter path → caller summary lookup (task 68); local
    command var `data = helper(...)` → callee clean-summary check
    (task 49A).
  - ENV33-C: pointer-parameter helper-sink path → transitive caller
    summary walk (task 49B). Mirrors ENV03-C task 68, with a BFS
    over the reverse call graph for Juliet variants 52c/53d/54e.
  - INT31-C: signed→size_t inside upper-bound guards → caller / callee /
    local-assignment summary lookups (task 69); `call_rhs_has_taint_source`
    now also treats `returns_tainted` callees as tainted (task 49A).
  - STR02-C: tainted-parameter → caller summary lookup (task 49D).
    Mirrors ENV33-C's BFS pattern; gated on "scope has no direct taint
    source" so local-recv paths stay flagging.

## Sub-task 49A — Return-value taint (DONE v0.3.99)

ENV03-C FP 468 → **324** (−144), TP 652 → 620 (−32). **4.5:1 FP:TP**
— cleanest ratio since task 67. CWE-78 TP rate 74.1% → **76.6%**
(+2.5pp). CWE-426 side benefit: FP −24 (1:1). Zero other-rule
regressions. INT31-C was neutral on Juliet; the wrapper pattern
exists in real-world code but Juliet CWE-194/195 v42 templates call
taint sources directly inside `badSource`, so the new transitive
bit had no additional TPs to catch there.

## Sub-task 49C — Function-pointer call graph + macro-aliased taint (DONE v0.3.102)

Two linked prescan fixes targeting Juliet v65a/b helper-sink variants.

1. `collect_callees` resolves function-pointer aliases. The function body
   is scanned once to build a local `pointer_var → target_function` map
   from init declarators (`void (*fp)(char *) = target;`) and later
   rebinds (`fp = target;`), then callees are emitted with aliases
   rewritten. Juliet v65a `caller → sink` edges are now first-class
   instead of landing as a `funcPtr` dead-end callee.

2. `has_env03_taint_source` also matches per-file macro aliases whose
   target is in `ENV03_TAINT_SOURCE_FUNCTIONS`. Juliet macro wrappers
   (`#define GETENV getenv`, `#define FGETS fgets`, etc.) are now
   caught, so callers of v65b-style sinks get correctly classified as
   tainted. New `taint_source_aliases: &[String]` parameter on
   `compute_s3
:�n���g�
Y�y555FIO30-C FP investigation and reductionFIO30-C has 696 FPs (36.7% rate, 1,200 TP). This is a format-string taint rule. No VRA. The Juliet benign variants use non-user-controlled format strings or use literal format strings. Need to investigate which Juliet CWE-134 variants are generating FPs. May be addressable through: literal format string detection, taint flow analysis, or const_eval for format string args.done2026-05-17T15:29:05Z2026-06-18T11:17:27Z2026-06-18T12:28:51Z����	555Investigate residual INT32-C/INT31-C/INT30-C FPs despite VRAINT32-C: CWE-190 1,287 FP / CWE-191 1,020 FP (v0.4.21). INT31-C: CWE-195 690 + CWE-194 330 + CWE-197 ~228 FP. INT30-C: CWE-191 306 FP. UPDATE 2026-06-09: the switch-case-guards-not-in-CFG hypothesis was CONFIRMED and fixed in v0.4.20/21 (process_opaque_region in value_range.rs + mid-block replay via get_all_var_ranges_at in INT32-C/INT30-C). Remaining FP sources to investigate: cross-function patterns (_61/_66/_67/_68 variants), compound expressions, and goodB2G guard styles not recognized by is_inside_bounds_checked_block. Use get_cwe_detail on CWE-190/191/194/195/197.
2026-06-10 strategic review: demoted from P1. Juliet INT FP work continues toward ~75%, but real-world audit (148) and bounds-API consolidation (149) take the P1 slots first.

[sqlite-audit 2026-06-14] ANALYSIS.md §1 quantifies this as the #1 FP source: INT32-C = 4420 FP / 15 TP (0.3%) = 20% of ALL FPs; INT30-C = 915 FP / 1 TP; INT31-C = 415 FP / 3 TP. Dominant misfire: 'signed overflow' on BOUNDED operands (i16 column counts asserted <=32767, SQLITE_LIMIT-bounded counters, i64 size math, power-of-two page sizes) and UNSIGNED values mislabeled as signed (e.g. u32 page arithmetic). Highest-leverage single FP fix. Bumped to P1 and gated under task 171 (FP reduction before new-codebase expansion).done2026-05-17T15:29:05Z2026-06-14T22:32:14Z2026-06-15T03:42:31Z�<�
w�	555Disable or fix CON33-C and CON07-C (97%/87% FP rates)CON33-C has 97% FP rate (2 TP, 64 FP). CON07-C has 87% FP rate (10 TP, 64 FP). These map to CWE-377 and CWE-366 respectively. Both are near-useless in current form and undermine paper credibility. Options: (1) investigate if they can be fixed with targeted logic, (2) disable them entirely in the default TOML config. Fix or disable before paper submission. The 128 FPs from these two rules alone drop the overall FP total from 10,590 to 10,462.done2026-05-17T15:29:05Z2026-05-17T17:35:17Z2026-05-17T18:43:40Z�
Y�y5FIO30-C FP investigation and reductionFIO30-C has 696 FPs (36.7% rate, 1,200 TP). This is a format-string taint rule. No VRA. The Juliet benign variants use non-user-controlled format strings or use literal format strings. Need to investigate which Juliet CWE-134 variants are generating FPs. May be addressable through: literal format string detection, taint flow analysis, or const_eval for format string args.pending2026-05-17T15:29:05Z
?�?�S��c�E555Ceiling decision: post-75% strategy — alias analysis vs SSA-lite use-def vs pivot to real-world hardeningPaper's own Limitations section estimates a 75-80% precision ceiling without alias analysis, SSA, or symbolic execution; v0.4.17 is at 72.6% and still climbing ~1-2.5pp per stretch. Decide explicitly BEFORE burning the per-rule FP backlog on the last 2pp: (a) declare victory at ~75% and pivot to real-world hardening + paper, or (b) invest in the next infrastructure layer. If (b), pick alias analysis vs SSA-lite use-def chains based on which the real-world audit (task 148) shows is the bigger FP source. Do not start the infra investment until the audit data is in.

--- 2026-06-18 DECISION (owner) ---
Resolved: this is a non-item right now. Do NOT commit to a major infra bet
(alias analysis / SSA-lite) at this point. Proceed tackling issues as they
arise from the backlog; re-evaluate major architectural decisions once the
todo bucket thins out again.

Supporting data at decision time (v0.4.47): Juliet CWE-matched precision
83.1% (22615 TP / 4607 FP) — already ABOVE the paper's predicted 75-80%
ceiling. Real-world adjudicated precision: curl 1.0%, libcrc 3.5%, sqlite
6.3%, mosquitto 13.4%, hostap 13.8%. Top real-world FP rules: INT32-C 4502,
MEM30-C 3793 (1 TP), DCL13-C 2401, API00-C 2150, EXP34-C 2098, EXP33-C 1260,
STR34-C 1186, ARR30-C 888 (0 TP) — all macro-expansion / INT-overflow /
caller-contract driven, NOT aliasing. => alias/SSA would lift Juliet a few pp
but not move real-world precision (the number the paper must defend), so no
infra investment is warranted now. Task 206 (alias-bound Juliet FPs) stays
low-priority accordingly.done2026-06-10T12:32:58Z2026-06-18T20:23:13Z2026-06-18T20:23:13Z��I�e5Paper: quarantine Juliet-specific tuning and hedge the 100%-precision claims (CWE-78, CWE-690)ENV03-C contains explicitly Juliet-tuned logic (goodG2BSink pattern, Juliet v34/v42/v45 handling in env03_c.rs); STR31-C hardcodes the Juliet memset(buf,'A',N) idiom. (1) Mark these in code comments as benchmark-idiom handling where not already done. (2) The 100%-precision/0-FP claims on CWE-78 (taint) and CWE-690 (inter-procedural null) are suspicious as generalization claims — hedge them in the paper, or back them with real-world evidence from the task-148 audit if it validates them.pending2026-06-10T12:32:58Z�q��=�q5Triage concurrency rules CON33-C/CON07-C: demote to manual-review or disabled-by-defaultCWE-377 (CON33-C) sits at 3% TP rate and CWE-366 (CON07-C) at 8% — race conditions are structurally beyond intra-procedural static analysis. Rather than spending fp-reduction effort here, demote both to manual-review severity or disabled-by-default in the TOML. Also cleans up headline precision honestly. Note d5e6a286 already cut their FP rates from 97%/87%, but the remaining signal is still too weak to report by default.
Catapult a�T��1�{	555Shared bounds/buffer-size API in src/analyze/ (consolidation before more FP tasks)Consolidation sprint before tasks 143/144/145 so fixes compound instead of accreting into 2,000-4,600-line rule files. Scope: (1) extract the duplicated vra_var_ranges_at() (identical in int32_c.rs:35-59 and arr30_c.rs:181-203) into src/analyze/; (2) unify buffer-size analysis behind one API — ARR30-C's BufferInfo enum and STR31-C's text-pattern memset/malloc-arithmetic parsing solve the same problem with private tooling; (3) have ARR30-C consume prescan's context.macro_constants instead of re-extracting macros/typedefs per file; (4) factor the copy-pasted RefCell CFG/VRA setup boilerplate shared by all VRA-consuming rules. Tasks 143, 144, 145 should be implemented ON TOP of this API.done2026-06-10T12:32:44Z2026-06-11T12:24:17Z2026-06-11T15:10:48Z
z�cz�f
M�555MEM31-C FP reduction for CWE-401Description:
Reduce MEM31-C FPs on CWE-401 (memory leak).
 CWE-401: 77.6% vs clang-tidy 83.9% (−6.3pp, 220 FP remaining)

Details:
DONE. MEM31-C: 786 TP/763 FP → 761 TP/220 FP (-543 FP, -25 TP, 21.7:1 ratio).
CWE-401 TP rate 50.7% → 77.6% (+26.9pp). Rule FP rate 49.3% → 22.4%.

  Three fixes:
  1. Prescan callee-frees-param: integrate FunctionSummary.frees_params.
  2. Transitive free propagation: param pass-through + fixpoint in prescan.
  3. If/else branch merge: UNION of freed memory from both branches.

  Remaining 220 FPs: switch constants, pointer-to-pointer, global variables.

Original status line: done (v0.3.86)done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z�-

E�555Binary distribution packagesDescription:
Generate AppImage, Windows .exe, .deb, and .rpm packages for sqc.

Details:
Packaging targets:
  - AppImage (Linux portable): use cargo-appimage or linuxdeploy with sqc binary +
    .desktop file + icon. Single self-contained executable for any Linux distro.
  - Windows .exe: cross-compile with x86_64-pc-windows-gnu or -msvc target.
    Optionally wrap in an MSI installer via cargo-wix.
  - .deb (Debian/Ubuntu): use cargo-deb. Include sqc binary in /usr/bin/,
    man page (task 52) in /usr/share/man/man1/, config examples in
    /usr/share/doc/sqc/. Set dependencies (libc6).
  - .rpm (Fedora/RHEL): use cargo-generate-rpm. Same file layout as .deb.

CI/CD integration: GitHub Actions matrix build with release artifacts uploaded
on tag push. Use cross for cross-compilation where needed.

Artifact bundle (per knots reference in ~/data/knots/.github/workflows/build.yml):
binary + LICENSE + THIRD_PARTY_LICENSES.txt + sqc.cdx.json (from task 71).done2026-04-20T16:45:55Z2026-05-07T19:21:05Z2026-05-07T19:21:05Z�j	
W�K5Paper — finalization and submissionDescription:
Final paper revisions, formatting, and submission preparation.

Details:
Current state: paper/sqc.tex compiles to 10 pages, two-column, with 5 figures,
8 tables, and 11 references.  Uses plain article class.

Remaining items:
  - Update numbers when tasks 46-47 complete
  - Choose target venue and switch to appropriate template:
    * IEEE S&P / USENIX Security / ACM CCS (top tier, competitive)
    * NDSS / ACSAC (strong security venues)
    * IEEE SecDev / SCORED (tools-focused, better fit)
    * ICSME / ASE (software engineering, tool papers track)
  - Add Eric and Tristan's institutional affiliation if not BISSELL
  - Review by co-authors
  - Proofread and style consistency pass
2026-06-10: also gated on task 152 (hedge/validate 100% claims) and task 147 (v0.4.21 numbers).pending2026-04-20T16:45:55Z
���0
m�w555INT30-C embedded guard/bound pattern recognitionDescription:
Reduce INT30-C FPs on bounded embedded arithmetic.

Details:
DONE. Work spread across v0.3.88, v0.3.89, v0.3.92, v0.3.93.

Patterns recognized across the four commits:

  1. **Bitmask wrapping** (`(x + 1) & MASK`): v0.3.88 via
     `is_addition_masked_by_bitand`. Applies to addition only — the mask
     bounds the result regardless of any wrap.
  2. **Narrow-pre-cast addition/multiplication**: v0.3.88 + v0.3.89 via
     `both_operands_narrow_pre_cast` /`is_narrow_cast_plus_small_const` /
     `is_narrow_cast_times_small_const` using `effective_operand_type`
     that peers through explicit casts to recover `uint8_t` / `uint16_t`.
  3. **(WIDE)(a - b) guarded by `a > b + POS`**: v0.3.89 via
     `is_cast_over_guarded_narrow_sub` + `cond_gt_b_plus_positive`.
  4. **Same-array subtraction / widened comparison**: covered by
     narrow-pre-cast + guarded-subtraction combination.
  5. **Wide-unsigned struct-field `++`/`--`** (`ctx->tick++`,
     `obj.seq--`): v0.3.92 direct skip in `check_increment_decrement`.
     Monotonic counter fields wrap at 2^32/2^64 and are benign; Juliet
     CWE-190/191 only exercises local-variable `++`, so no TP loss.
  6. **Thin calloc wrapper** (`calloc(nmemb, size)` where both args are
     function parameters): v0.3.92 via
     `calloc_args_are_function_params` — delegates overflow to C11
     calloc (§7.22.3.2).
  7. **Implicit-else early-exit guard** (`if (a < b) return; /* a - b */`):
     v0.3.92 via `preceding_early_exit_guards_subtraction` + the new
     `if_always_exits` helper.

Infrastructure fixes surfaced along the way:
  * v0.3.92: `get_function_arguments` now iterates named children, so
    `args[0]` is the real first argument instead of a `(` token. This
    unmasked a latent bug where malloc/realloc multiplication overflow
    detection was silently disabled and calloc messages read
    `calloc((, nmemb)`.
  * v0.3.93: dropped the dedicated malloc/realloc allocation-overflow
    check. `check_multiplication` already covers the inner `*` (with
    full VRA + SIZE_MAX-guard awareness), so the allocation-level check
    produced nothing but duplicate diagnostics and occasional FPs on
    provably-safe good-paths. Calloc keeps its dedicated check because
    its multiplication is implicit.
  * v0.3.92: `has_function_context_check` falls back to the translation
    unit for snippet-style tests without an enclosing function.

Empirical impact on target embedded codebases (INT30-C suppressions
stripped for measurement, -I include paths unchanged):
  d_lib_common:          1 → 0 INT30-C FPs
  d_lib_serial_leds:    12 → 8 INT30-C FPs
  d_lib_airpath:         2 → 2 (unchanged; bounded-shift compound
                                addition, see Remaining below)
  d_lib_networking:      0 → 0

Real-world (v0.3.91 → v0.3.93): **−187 INT30-C violations**
  curl:      -106   mosquitto:  -44
  sqlite:     -37   libcrc:       0

Juliet v0.3.93 vs v0.3.91: zero delta across all 74 CWEs (the v0.3.92
duplicate-diagnostic regression on CWE-680 was fully reversed by the
v0.3.93 dedupe).

Remaining serial_leds FPs need narrow-operand propagation through local
assignments (brightness arithmetic via `uint32_t range = (uint32_t)a -
(uint32_t)b` then `range * time`). Airpath FPs need shift-aware
effective-type recognition for compound accumulators (`ctx->ad_sum +=
(... >> SHIFT) + 1`). Both deferred — low FP count, risk of Juliet TP
regressions on CWE-190/191.

Original status line: done (v0.3.93)done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z
		�{
u�555EXP34-C null safety through if-guards and &stack_varDescription:
Reduce EXP34-C FPs where null safety is established by
 if-guard-with-early-return or &stack_variable callers (~16 FPs).

Details:
DONE. Patterns A and B were already fixed by cumulative EXP34-C work
(v0.3.82 AST-level null guard fallback, v0.2.20 &stack_var propagation).
Verified on all four target embedded codebases (d_lib_common,
d_lib_serial_leds, d_lib_networking, d_lib_airpath_debris_sensing):
zero EXP34-C FPs remain except one `Memory_Free(NULL)` wrapper case.

v0.3.90-0.3.91 broadened the fix to related idioms surfaced by the
realworld benchmark:

  1. `PARAM == 0` / `PARAM != 0` null-check detection (plus reversed-
     operand and all-spacing variants). sqlite/libcurl consistently use
     this idiom (e.g. `if(pStmt==0) return ...`) — previously unrecognized.
  2. EXP34-C: skip deref-function arg check when callee is in the
     null-safe list. `free(NULL)` and `realloc(NULL, n)` are defined
     per C11 7.22.3.3 / 7.22.3.5 — flagging them is incorrect.
  3. Alias null-check recognition: `TYPE *alias = param;` followed by
     a null-check on `alias` logically null-checks `param`. Common in
     libcurl wrappers (curl_easy_setopt, curl_multi_cleanup).

Benchmark (v0.3.89 → v0.3.91):
  Realworld: −321 violations total. EXP34-C −242, API00-C −79.
    sqlite −285, mosquitto −30, curl −3, libcrc −3, hostap 0.
  Juliet: TP −102 (all CWE-690 free() with potentially-null arg —
    by-design suppression, not a regression). FP unchanged.

Pattern C (callback `void *` params) remains open but is lower priority
(requires trust annotations or library modeling).

Original status line: done (v0.3.91)done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z
���
}�1555API00-C validation look-ahead past variable declarationsDescription:
Reduce API00-C FPs where parameter validation exists but
 is not detected due to intervening variable declarations (~12 FPs).

Details:
Three sub-patterns triaged:

  A. **Validation past var decls** — already handled pre-v0.3.97. The
     existing `check_validation_patterns` walks the entire body (not just
     the first N statements) and `collect_else_if_chain_validations`
     traverses full if/else-if/else chains, so cases like
     `Ringbuffer_read` (if/else-if/else with NULL checks after a
     `result_e result = …;` declaration) no longer FP. Verified on
     d_lib_common with API00-C suppressions stripped — zero FPs for this
     sub-pattern.

  C. **void\* container where NULL is valid** — implemented in v0.3.97.
     New type-aware suppression: a `void *` / `const void *` parameter
     that is never dereferenced locally (`*p`, `p->x`, `p[i]`) and
     passes through only to null-accepting stdlib sinks (free, realloc,
     Memory_Free, Memory_Realloc, cfree) or callees whose summary
     validates the corresponding argument is treated as a generic-
     container slot where NULL is a valid value.

     Helpers: `is_generic_void_pointer_type` (bare `void *`, rejects
     `void **` and array decls) + `is_void_ptr_storage_safe` (walks the
     body, collects every parent-kind, returns true only if every use is
     storage-like or a verified safe call).

     Results (Juliet v0.3.96 → v0.3.97):
       - API00-C: TP 90→84 (-6), FP 116→104 (-12). **2.0:1 FP:TP**.
       - CWE-476 TP rate 58.9% → **59.6%** (+0.7pp).
       - Overall TP rate unchanged at 63.4%.
       - Zero other-rule regressions.

     Real-world d_lib_common: 1 → 0 API00-C FP (ArrayList_Append).

  B. **Embedded API contract — no NULL check by design** (3 FPs in
     airpath, ~17 FPs in serial_leds). Deferred. All remaining real-
     world API00-C FPs are public-API functions that dereference `ctx`
     without validation by hardware-contract design (e.g.
     `DebrisSensor_AdcSample`, `SerialLeds_set_*`). No clean AST-level
     signal distinguishes these from genuine FPs — continuing to rely
     on `SQC-SUPPRESS: API00-C` at the function site. Options considered
     and rejected:
       * Skip all public API with `_set_` / `_Init` / `_update` prefixes
         — too broad; masks real bugs in other projects.
       * Require explicit header prototype + Doxygen `@pre` — no
         reliable way to parse `@pre` contracts from tree-sitter.
       * Switch API00-C severity to Low for non-static functions —
         doesn't reduce FP count, only its visibility.

Original status line: done (v0.3.97) — A already covered, C implemented, B deferreddone2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z

���
q�O555DCL19-C / DCL00-C scope and const-qualify FP fixesDescription:
Fix DCL19-C flagging public API functions and DCL00-C
 flagging loop counter variables (6 FPs in serial_leds).

Details:
DONE. Both fixes landed in v0.3.88 via commit 2c78eac2.

  A. **DCL19-C on public API** — `set_project_context` receives
     `header_declared_functions` from prescan; the "should be static"
     check now skips any function whose name appears in a header
     traversed via `-I`. serial_leds `SerialLeds_set`,
     `SerialLeds_set_rgb`, `SerialLeds_set_brightness`: 3 → 0.

  B. **DCL00-C on loop counters** — `is_in_for_loop_init` walks up
     the declaration's parent chain to detect when the declaration is
     itself the init clause of a `for_statement`. serial_leds
     `uint8_t g` across three for-loops: 3 → 0.

Original status line: done (v0.3.88)done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z�\
m�O555EXP02-C extended short-circuit guard recognitionDescription:
Extend EXP02-C guard pattern recognition beyond
 NULL_CHECK && fn_call to cover all common guard idioms (4 FPs).

Details:
DONE. Landed over two rounds.

v0.3.88 (task 64 initial): extended the NULL-guard exemption to `||`
and added `has_mutation_side_effects` so `p || (p = malloc(...))`
and `i++ > 10` still flag.

v0.3.98 (task 64 remaining): generalized the guard check from
null-specific substring matching to AST-based comparison detection.
`is_guard_pattern` now recognises any `binary_expression` whose
operator is `==`, `!=`, `<`, `>`, `<=`, or `>=`, plus compound
`&&` / `||` chains whose leaves are guards (recursive),
plus truthiness (bare identifier / `!x`) and parenthesized
wrappers. Combined with the preserved mutation check, the rule now
correctly suppresses:

  file_size > 0 && buflen >= file_size && fseek(...)
  self == NULL || IntSet_Contains(self, element)
  len == capacity && !growCapacity(self)
  arr->len == arr->cap && !ArrayList_growCapacity(arr)

while still flagging:

  p || (p = malloc(...))           — assignment in RHS
  a > 0 && ++count > 10            — update in RHS

Juliet: zero delta (all 4 EXP02-C tests still pass, CWE-taxonomy
totals unchanged). Real-world: EXP02-C delta below the top-5
per-rule threshold (task 64 targets d_lib_common, outside the
real-world benchmark set).

Original status line: done (v0.3.98)done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z�{
y�555MEM05-C / ARR32-C false VLA and stack allocation fixesDescription:
Fix false VLA detection and spurious stack allocation
 warnings (3 FPs across 2 codebases).

Details:
DONE. All three embedded FPs resolved by a single root-cause fix: the
MEM05-C VLA detector was text-matching `[...]` anywhere in a
declaration, so array subscripts inside initializers were
misclassified as variable-length sizes.

  1. **ARR32-C on header-defined constant** — `is_all_constant_expression`
     recursively walks binary_expression leaves, so
     `[MAX_LEDS * BYTES_PER_LED]` now passes as a constant expression
     when both identifiers are ALL_CAPS macros.
  2. **MEM05-C on array subscript** — `find_array_declarator_size`
     looks for an actual `array_declarator` node instead of bracket
     text, and `init_declarator`'s value field is explicitly skipped
     so `uint8_t x = arr[i]` is no longer a "VLA".
  3. **MEM05-C on 1-byte stack variable** — same AST-level fix. The
     "large stack allocation" message never fires; previous FPs were
     subscripts-in-initializers misclassified as VLAs. No size
     threshold was needed.

Empirical impact (serial_leds / airpath, suppressions stripped):
  serial_leds MEM05-C: 1 → 0
  serial_leds ARR32-C: 1 → 0
  airpath     MEM05-C: 1 → 0

Original status line: done (v0.3.88)done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z
����m
�_555ENV03-C locally-safe popen/system command var suppressionDescription:
Reduce ENV03-C FPs on Juliet CWE-78 goodG2B functions where
 the command variable is provably derived from string literals only.

Details:
DONE. ENV03-C FP 1272→612 (-660), TP 912→752 (-160). **4.1:1 FP:TP**,
cleanest ratio since v0.2.23.

Approach: new `is_command_var_locally_safe()` in env03_c.rs. Fixpoint over
char-array declarations and pointer aliases, then walks every write to the
command variable. Suppress only when every write is from a string literal,
a locally-initialized buffer, or strcat/strcpy with a literal source.

Short-circuits that still flag:
  - Direct string literal (defense-in-depth preserved for existing tests).
  - Function parameter (caller-supplied, handled by task 68).
  - Any taint-source call in scope (recv, fgets, scanf, getenv, etc.).

Required allowing macro-identifier initializers on char arrays — `char
buf[N] = FULL_COMMAND;` is legal C only for macros, so any identifier in
that position is treated as a literal.

CWE-78 TP rate 62.8% → 72.3% (+9.5pp). Overall TP rate 61.7% → 62.5%
(+0.8pp). Zero other-rule regressions.

Original status line: done (v0.3.94)done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z�v
e�555Miscellaneous embedded FP fixes (small wins)Collection of lower-count FPs that don't warrant individual tasks:

  1. **INT32-C sizeof(*ctx)** — DONE (v0.3.98)
  2. **INT33-C non-zero constant macro divisor** — DONE (v0.3.115)
  3. **DCL13-C direct call flagged as function pointer** (serial_leds 2 FPs): not reproducible in current scan
  4. **ARR00-C/ARR01-C bounded array access** (serial_leds 4 FPs): value-range-dependent, deferred
  5. **INT01-C protocol field types** (common 4 FPs): not appearing in current scan
  6. **DCL30-C struct member pointer** (serial_leds 1 FP): not appearing in current scan
  7. **INT00-C explicit uint32_t casts** (serial_leds 1 FP): not appearing in current scan
  8. **MEM30-C sequential frees** — DONE (v0.3.114)
  9. **EXP33-C for-loop init** — MOOT (sqc already handles correctly; code refactored to C99 style)
  10. **ARR36-C integer comparison** (common 1 FP): suppressed in d_lib_common, deferred

## Fix notes

### #1 INT32-C sizeof (v0.3.98)
check_memory_function_overflow early-returns when size arg is sizeof_expression.
INT32-C -239 realworld; Juliet zero delta.

### #8 MEM30-C sequential frees (v0.3.114)
is_freed() union_members loop: strip_prefix + check remainder starts with -> or .
Avoids matching base var itself. Juliet: zero delta. Fixes d_lib_common arraylist.c FP.

### #9 EXP33-C for-loop init — MOOT
sqc CFG puts for-loop initializer in pre-header block before first read.
d_lib_common intset.c refactored to C99 style anyway; no FP in current scan.

### #2 INT33-C non-zero constant macro divisor (v0.3.115)
is_divisor_checked() fast-path: try_evaluate_expr() + file_macros.
Non-zero integer constant macro (BRIGHTNESS_MAX=255) suppresses violation.
Requires -d prescan for cross-file header macros. Fixes 3 FPs in d_lib_serial_leds.
Juliet CWE-369: zero delta.done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-30T00:24:48Z
t	�t���555INT31-C taint-aware suppression for signed→size_t conversionsDescription:
Reuse ENV03-C's taint-source summary bit to suppress
 INT31-C FPs on Juliet CWE-194/195 helper-function variants.

Details:
DONE. INT31-C FP 2172→1452 (-720), TP 2608→2142 (-466). 1.54:1 FP:TP.

Approach: when the converted variable is inside an `if (var < LIT)`
upper-bound guard (positive literal), suppress iff:
  * the containing function's summary has no taint source, AND
  * no `var = fn(...)` assignment targets a tainted callee, AND
  * for parameters, every caller is taint-free too.

Local-variable case additionally requires evidence of at least one
call-return assignment from a clean callee — prevents over-suppression
of v45-style `int data = global_static;` reads where the global could
have been tainted elsewhere in the project.

Substring bug trap: `decl_text.contains(var_name)` matched `dataBuffer`
when looking for `data`. Fixed by walking the declarator tree to its
leaf identifier for an exact match.

Results: CWE-194 TP rate 58.4% → **67.9%** (+9.5pp). CWE-195 TP rate
48.7% → 51.9% (+3.2pp). Overall TP rate 62.7% → **63.4%** (+0.7pp).
Zero other-rule regressions.

Remaining INT31-C FPs are in v42-style `data = helper(data)` returning
tainted values, v45-style global pointers, and v65a/b function-pointer
cross-file patterns (no call-graph edge). Function-pointer and
return-value taint would be the next wins if pursued.

Original status line: done (v0.3.96)done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z�u
w�w555ENV03-C cross-function taint for helper-sink variantsDescription:
Suppress ENV03-C FPs in Juliet CWE-78 variants 41-45 where
 the popen/system call lives in a helper function receiving data as a
 parameter.

Details:
DONE. ENV03-C FP 612→468 (-144), TP 752→652 (-100). 1.44:1 FP:TP —
diminishing returns as the remaining target shrinks.

New infrastructure:
  * `FunctionSummary.has_env03_taint_source` bit — populated via body
    text scan for recv/fgets/scanf/getenv-style calls (~25 functions).
  * ENV03-C parameter path consults reverse call graph (callee → callers)
    built from `ProjectContext.call_graph`. Suppress only when every
    caller's summary is clean.

Prescan bug fix (affects other inter-procedural rules too):
  * `collect_call_graph` used `.insert()`, so multiple files with `static
    void goodG2B()` overwrote each other and dropped caller edges.
    Changed to `.entry().or_default().extend()` for call edges, and
    OR-merge for `has_env03_taint_source`. Same-named static merging is
    conservative (any tainted def poisons the merged summary).

Results: CWE-78 TP rate 72.3% → 74.1% (+1.8pp). Overall TP rate 62.5% →
62.7% (+0.2pp). Side effect: EXP34-C -6 FP / 0 TP (prescan merging
recovered a few missed caller links).

CWE-426 (Untrusted Search Path): -24 TP / -24 FP — neutral. Remaining
~468 ENV03-C FPs are v42/v22a-style (`data = helper(data)` return-tainted
assignments) and v45-style (global-static pointers) — need return-value
taint or global-write tracking to shrink further.

Original status line: done (v0.3.95)done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z
�
4��x
_�555Third-party licensing and SBOM generationDescription:
Generate THIRD_PARTY_LICENSES.txt (cargo-about) and a
 CycloneDX SBOM (cargo-cyclonedx) on every release build, following
 the knots pattern.

Details:
Port the knots setup (~/data/knots/about.toml, ~/data/knots/about.hbs,
and the licensing/SBOM steps in ~/data/knots/.github/workflows/build.yml)
into sqc once the repo is on GitHub.

Files to add:
  - `about.toml` — cargo-about license allowlist. Start from the knots
    set: MIT, Apache-2.0 (+ LLVM-exception), BSD-2/3, ISC, Unicode-3.0,
    Unicode-DFS-2016, Zlib, 0BSD, MPL-2.0, CC0-1.0.
  - `about.hbs` — Handlebars template for THIRD_PARTY_LICENSES.txt
    (one block per license with `used_by` crate list + verbatim text).
  - `LICENSE` or `LICENSE-MIT` + `LICENSE-APACHE` — per task 70
    decision.

GitHub Actions steps (on release / tag push):
  - `cargo install cargo-about --locked`
  - `cargo about generate about.hbs -o THIRD_PARTY_LICENSES.txt`
  - `cargo install cargo-cyclonedx --locked`
  - `cargo cyclonedx --format json --spec-version 1.5`
    → produces `sqc.cdx.json`.

Artifact integration:
  - Stage `THIRD_PARTY_LICENSES.txt` and `sqc.cdx.json` alongside the
    binary in the release artifact bundle (task 53).
  - In deb/rpm/AppImage: install to
    `/usr/share/doc/sqc/{THIRD_PARTY_LICENSES.txt,sqc.cdx.json}`
    and `LICENSE` → `copyright` (deb) / `%license` (rpm).

Optional pre-commit / PR check: run `cargo about generate` in CI
without output redirection so a new dependency with a disallowed
license fails the build before merge.done2026-04-20T16:45:55Z2026-05-07T19:21:05Z2026-05-07T19:21:05Z�I
[�;555Migrate sqc from Azure DevOps to GitHubDescription:
Move the sqc repository from ADO to GitHub. Prerequisite for
 any release workflow, external contribution, or public paper artifact.

Details:
sqc is currently hosted on Azure DevOps. Moving to GitHub unblocks:
  - GitHub Actions release workflows (task 53 binary distribution,
    task 71 licensing/SBOM).
  - `sqc-analysis.yml` (already checked in) — SARIF upload to GitHub
    Code Scanning requires the repo to live on GitHub.
  - External visibility for the paper (task 51) and public bug
    reports against real-world benchmark targets (task 47).

Decisions needed before the move:
  - **Licensing.** `Cargo.toml` declares `MIT OR Apache-2.0` but no
    LICENSE file is checked in. Decide between dual-license (ship
    `LICENSE-MIT` + `LICENSE-APACHE`, Rust convention) or pick one.
    Outcome feeds task 71 artifact layout.
  - **Repo name + org** (personal vs. corporate).
  - **History sanitization.** Review for internal paths, proprietary
    codebase references, or customer-specific fixtures that should
    not become public.
  - **Issue / proposal transfer.** AGENTS/PROPOSALS and planning docs
    can move with the repo; ADO work-item history probably cannot.

Move mechanics: mirror-clone ADO repo with full history, push to the
new GitHub remote, archive the ADO project (read-only) for a transition
period, redirect any CI hooks.done2026-04-20T16:45:55Z2026-05-07T19:21:05Z2026-05-07T19:21:05Z
�Td���
+�555Release v0.2.17[Release date not recorded in CHANGELOG — inherited 2026-03-11 from next-newer dated release]

### Fixed

- EXP34-C Phase 3: MEM10-C positive guard suppression (-38 FP). API02-C
  `const wchar_t *` exclusion. API00-C caller-aware suppression via function
  summaries. Prescan local variable tracking for callsite null state resolution.
- CWE-476: TP 313 -> 320 (+7), FP 542 -> 512 (-30), rate 36.6% -> 38.5%.
- CWE-690 bonus: +36 TP, -63 FP.done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z�2
+�=555Release v0.2.16[Release date not recorded in CHANGELOG — inherited 2026-03-11 from next-newer dated release]

### Added

- EXP34-C Phase 2: call-site null propagation. Call-site flagging for
  DefinitelyNull args. Callee param seeding via `infer_arg_null_state()`.
  Multi-pass aggregation with lattice join.
- CWE-476: +19 TP, +17 FP (rate 35.9% -> 36.6%).done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z�m
+�3555Release v0.2.15[Release date not recorded in CHANGELOG — inherited 2026-03-11 from next-newer dated release]

### Added

- EXP34-C Phase 1: CFG-based null state dataflow (`src/analyze/null_state.rs`).
  Forward dataflow with NullState lattice. EXP34-C rewritten from ~1200-line
  linear walk to CFG-based analysis.

### Fixed

- MEM10-C: parameter-only null check fix (-106 FP on CWE-476).
- d_lib_common FP round 2: resolved all 17 FP patterns (~51 violations). Key
  fixes: FIO46-C source-order stream tracking, INT32-C field_expression skip,
  FLP03-C scientific notation, EXP12-C parent-check, INT01-C sizeof skip.
- Juliet: -10,678 FP (-5.4%), TP rate 44.7% -> 44.2%.done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z�)
+�+555Release v0.2.13[Release date not recorded in CHANGELOG — inherited 2026-03-11 from next-newer dated release]

### Added

- INT31-C implicit narrowing assignment detection:
  `check_assignment_conversion()` for `init_declarator` and
  `assignment_expression`. Type width comparison with FP suppressions
  (double-flag, validated vars, bounds-check, literal-fits, bitmask).

### Fixed

- DCL19-C: `STATIC` macro recognition.
- INT32-C: skip unsigned operands in binary overflow checks.
- DCL15-C: skip functions with prototypes in `.h` headers.
- INT36-C: exclude struct field access and array subscript.
- PRE31-C: skip string literal arguments from side-effect analysis.
- EXP30-C: recognize `x = f(x)` as safe.
- INT30-C: detect `if (var > 0)` guard before unsigned decrement.
- DCL07-C/31-C: skip indirect calls and preprocessor-guarded blocks.
- Juliet: 44.6% -> 44.7% TP rate, -13,961 FP (-6.6%).

### Changed

- Prescan: `linkage_specification` (`extern "C" {}`) traversal in all walkers.
  `pointer_declarator` handling for pointer-returning prototypes.
  `header_declared_functions` field in `ProjectContext`.done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z
�L]-���h 
)�+555Release v0.3.3[Release date not recorded in CHANGELOG — inherited 2026-03-11 from next-newer dated release]

### Fixed

- POS49-C: `is_local_variable()` skips stack-local struct member assignments.
- EXP12-C: `connect() != 0` in binary_expression not flagged.
- INT30-C: `is_literal_one()` strips unsigned/long suffixes.
  `is_preceded_by_increment()` checks for `var++`/`++var`/`var += 1` before
  subtraction.done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z�#
+�555Release v0.2.25[Release date not recorded in CHANGELOG — inherited 2026-03-11 from next-newer dated release]

### Fixed

- STR04-C: binary buffer skip, only flag `unsigned char` arrays with string
  literal evidence.
- INT18-C: uint64_t recognition via `type_identifier` nodes.
- EXP05-C: AST-based const detection replacing text-based check.done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z�-
+�3555Release v0.2.22[Release date not recorded in CHANGELOG — inherited 2026-03-11 from next-newer dated release]

### Fixed

- ARR02-C: skip implicit bounds check for string-literal-initialized arrays.
- POS02-C: removed `socket`/`setsockopt` from privileged operations.
- PRE31-C: strip string literal content before function-call pattern checks.
- MEM05-C: ALL_CAPS macro constant VLA detection + word-boundary recursion
  matching.
- INT32-C: `is_inside_bounds_checked_block()` extended to while/for statements.
  `extract_mutation_target()` ensures loop-bounded variable matches operation.
- INT30-C: skip subtraction when either operand is `uint64_t`.
- Const-eval: `ValueRange::shl()` clamps negative shift-amount lower bounds
  to 0.done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z�l
+�1555Release v0.2.21[Release date not recorded in CHANGELOG — inherited 2026-03-11 from next-newer dated release]

### Added

- Const-eval / value-range analysis module (`src/analyze/const_eval.rs`, ~550
  lines). `MacroConstantMap` for `#define` constant collection.
  `ValueRange { min, max }` interval arithmetic. `try_evaluate_expr()` /
  `try_evaluate_range()` for recursive AST constant folding.
  `extract_loop_var_ranges()` for loop bounds. Integrated with INT32-C and
  INT30-C.

### Fixed

- Benchmark measurement: analysis script now outputs all rules (previously top
  10 only). 16 existing runs reanalyzed. Eliminated phantom regressions from
  top-10 truncation.done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z�1
+�;555Release v0.2.20[Release date not recorded in CHANGELOG — inherited 2026-03-11 from next-newer dated release]

### Added

- `-I`/`--include-path` flag: pre-pass extracts `#include` directives, resolves
  against search paths. Transitive include resolution with cycle prevention.

### Fixed

- MSC37-C: `STATIC void` macro prefix, `has_void_specifier()` scans all
  children for `void`.
- INT36-C: `(void)` discard cast, bare `void` no longer matched as pointer
  type.
- PRE02-C: trailing comment stripping in macro values.
- ERR33-C: `(void)` cast recognized as intentional discard.
- CON03-C: skip `const`-qualified variables and synchronization primitive types.
- DCL30-C: scalar value copy through pointer no longer flagged as address
  escape.
- FIO47-C: snprintf argument count corrected (subtract 3, not 1).
- EXP37-C: init_declarator skip for K&R-style declarations.
- API00-C: skip static functions + caller-aware suppression via NotNull.
- INT01-C: eliminated double-visit dedup fix (-3 duplicate violations).
- EXP34-C: array declarations tracked as NotNull in prescan.
- Juliet: -2,720 FP, TP rate 44.1% -> 44.2%.done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z
Hk5	���H�k'
+�/555Release v0.3.18### Added

- Fast benchmark mode: `generate_rule_cwe_map.py` generates 147 per-CWE
  manifest TOMLs. `run_juliet_parallel.sh --fast` uses per-CWE manifests.
  CWE-476 validation: noise 61.8% -> 0%, TP rate 39.5% -> 46.5%.
- INT31-C: `check_call_argument_conversion()` detects signed integer variables
  passed to functions expecting `size_t`. Covers 20 standard library functions.
  Suppressions for explicit cast, sizeof, literals, bounds check, non-negative
  guard.

### Fixed

- Various false positive reduction improvements.done2026-04-20T16:58:08Z2026-03-14T00:00:00Z2026-03-14T00:00:00Z�$&
+�!555Release v0.3.17### Added

- `collect_macro_aliases()` in const_eval.rs for `#define ALIAS identifier`
  patterns. ENV33-C, ENV03-C, STR02-C resolve aliases before matching dangerous
  functions. Windows exec/spawn variants added to ENV33-C.
- ERR33-C CWE-253: validates comparison correctness for functions classified by
  `ErrorReturnKind` (NullPointer, NegativeInt, Eof, NonZero, Count). Macro
  alias resolution + wchar_t variants. CWE-253: 178 TP, 0 FP, 100% precision.done2026-04-20T16:58:08Z2026-03-12T00:00:00Z2026-03-12T00:00:00Z�4%
+�A555Release v0.3.15### Added

- CWE-aware scoring system: 5 new metrics (FLAW-line hit rate, CWE-matched TP
  rate, per-file detection rate, noise ratio, incidental TP/FP).
  `generate_rule_cwe_map.py` produces `data/rule_cwe_map.json` (117 rules to
  144 CWEs). Integrated into analysis pipeline.
- CWE-124, CWE-126, CWE-127 mappings for ARR30-C, ARR38-C, STR31-C.done2026-04-20T16:58:08Z2026-03-12T00:00:00Z2026-03-12T00:00:00Z�$
+�]555Release v0.3.14### Fixed

- Juliet regression investigation: full-suite benchmark 126,106 TP, 158,036 FP,
  44.4% TP rate. Confirmed regression is cumulative effect of individually
  correct suppressions. Discovered scoring methodology issues (off-by-one in
  FLAW-line matching, incidental noise scored as TP).done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z�#
+�555Release v0.3.13[Release date not recorded in CHANGELOG — inherited 2026-03-11 from next-newer dated release]

### Added

- EXP34-C multi-pass prescan propagation: `propagate_param_null_states()`
  resolves relay chains across function call hierarchies.

### Fixed

- EXP33-C for-loop init recognition: `has_preceding_assignment_in_block()` walks
  ancestor scopes. `for_init_assigns_var()` recognizes init clauses as
  dominating assignments. Handles `for (i = 0; ...)`, `for (int i = 0; ...)`,
  and comma expressions.
- INT30-C: `is_subtraction_guarded_by_comparison()` detects `if (a >= b) { a -
  b }` patterns. Supports `>=`, `>`, `<=`, `<` and compound `&&` conditions.
  Generalized `1U`/`1u` suffix handling.done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z�3"
)�A555Release v0.3.8[Release date not recorded in CHANGELOG — inherited 2026-03-11 from next-newer dated release]

### Added

- API00-C: 4 new validation patterns for parameter checking.

### Fixed

- STR31-C: gated string-literal suppression on `!is_function_parameter()` in
  `check_strcpy_safety` and `check_strcat_safety`. Fixed
  `check_sequential_strcat_overflow` to scan only current function's line range.
- EXP33-C: field/subscript write no longer treated as read (-576 FP, -299 TP).done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z�!
)�555Release v0.3.5[Release date not recorded in CHANGELOG — inherited 2026-03-11 from next-newer dated release]

### Added

- Struct field type resolution: prescan collects struct definitions into
  `struct_field_types` in `ProjectContext`. `infer_type()` resolves
  `field_expression` types. Integrated with INT32-C and INT30-C.done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z
U�'
�gluU�.
+�555Release v0.3.25### Added

- EXP33-C ALLOCA/alloca tracking: `alloca()` and `ALLOCA()` allocations treated
  as uninitialized memory. +52 new TPs.

### Fixed

- EXP33-C conditional init heuristic: broadened from incomplete conditionals to
  any conditional body. New `inits_share_conditional` check. +18 new TPs.
- INT31-C VRA improvement: CWE-194 TP rate 41.7% -> 56.8% (+15.1pp, -310
  FP/-31 TP).
- Juliet (68/68 CWEs): 8,420 TP / 9,371 FP, 47.3% TP rate (+0.6pp).done2026-04-20T16:58:08Z2026-03-20T00:00:00Z2026-03-20T00:00:00Z�t-
+�A555Release v0.3.24### Added

- VRA Phase 5: inter-procedural return ranges. `FunctionSummary` gains
  `return_range: Option<ValueRange>` computed during prescan. VRA transfer
  function resolves `call_expression` RHS using callee return range.
- VRA Phase 6: INT31-C migration. Full VRA integration for
  signed->unsigned, unsigned->signed, and narrowing casts. VRA-based range
  narrowing supplements syntactic `is_inside_bounds_checked_block()`.

### Changed

- Prescan reordered: macro constants collected before function summaries.
- Juliet (67/68 CWEs): 7,393 TP / 8,433 FP, 46.7% TP rate (+2.4pp vs
  v0.3.21). ~6x speedup on large non-VRA CWEs via `compute_return_ranges` flag.done2026-04-20T16:58:08Z2026-03-19T00:00:00Z2026-03-19T00:00:00Z�x,
+�I555Release v0.3.23### Added

- CFG-based forward value-range analysis (`value_range.rs`). Worklist algorithm
  with interval lattice, edge refinement for all comparison/compound operators,
  type-aware initial ranges, widening after 3 back-edge iterations. Computed
  once per file per function, shared across rules via `set_vra_results()`.

### Changed

- INT33-C: `divisor_provably_nonzero()` tries VRA first, falls back to
  syntactic analysis.
- INT34-C: `check_shift_operation()` tries VRA first for shift amount range.
- INT32-C: all 6 `expression_fits_in_signed` call sites use VRA-backed version.
- INT30-C: all 4 `expression_fits_in_unsigned` call sites use VRA-backed
  version.done2026-04-20T16:58:08Z2026-03-19T00:00:00Z2026-03-19T00:00:00Z�+
+�555Release v0.3.22### Fixed

- ARR38-C: function-scoped alias resolution prevents cross-function
  contamination. Skip heuristic checks when buffer size is verified. CWE806:
  function-scoped `find_content_size_in_function()` tracks `memset(var, char,
  N)`. -183 CWE806 FP, -69 CWE805 FP.
- ARR30-C: multi-assignment constant resolution via
  `try_resolve_variable_to_constant`. Extract only condition from AST instead
  of searching full if-body text. -67 CWE129 FP.done2026-04-20T16:58:08Z2026-03-19T00:00:00Z2026-03-19T00:00:00Z�*
+�555Release v0.3.21### Added

- CWE-121/122 buffer overflow detection: ARR30-C gains literal loop bounds,
  ALLOCA tracking, pointer alias tracking. ARR38-C gains ALLOCA detection,
  strlen/wcslen overflow, snprintf variants, pointer alias resolution,
  N*sizeof(type) parsing.
- Juliet: CWE-121 39.3% -> 39.9% TP rate, CWE-122 41.7% -> 36.6%.done2026-04-20T16:58:08Z2026-03-19T00:00:00Z2026-03-19T00:00:00Z�`)
+�555Release v0.3.20### Changed

- Benchmark infrastructure overhaul: new `bench/` package replaces shell scripts
  with Python runner + SQLite. `bench/runner.py` with `ProcessPoolExecutor`,
  `bench/analyzer.py` for TP/FP classification, `bench/db.py` with 7-table
  schema in WAL mode. MCP server updated to query SQLite first with legacy
  fallback. `scripts/backfill_juliet_results.py` imported 21 Juliet + 7
  real-world runs. Fast mode default with resume support.
- First 68-CWE fast benchmark: 8,413 TP / 10,484 FP, 44.5% TP rate.done2026-04-20T16:58:08Z2026-03-18T00:00:00Z2026-03-18T00:00:00Z�s(
+�?555Release v0.3.19### Fixed

- ENV03-C: function-scoped clearenv() checks sanitization per-function instead
  of file-level.
- STR02-C: intra-function taint tracking (recv, fgets, fgetws, scanf, getenv,
  etc.) with cast handling and propagation.
- CWE-78 precision: 42.0% -> 45.5%, FP -330, TP -78.done2026-04-20T16:58:08Z2026-03-15T00:00:00Z2026-03-15T00:00:00Z
����G2
+�g555Release v0.3.30### Fixed

- EXP34-C: replaced lattice join in `aggregate_callsite_null_states()` with
  count-based voting. One PossiblyNull callsite no longer poisons parameters
  with 50 NotNull callers. EXP34-C: 26,457 -> 5,290 (-80.0%) across 5
  real-world codebases.
- Juliet: 8,285 TP / 9,180 FP, 47.4% TP rate. CWE-690 TP rate 83.8% -> 94.3%
  (+10.5pp). Zero regressions.done2026-04-20T16:58:08Z2026-03-22T00:00:00Z2026-03-22T00:00:00Z�q1
+�;555Release v0.3.28### Added

- `--save-prescan FILE` / `--load-prescan FILE` CLI flags for
  serializing/deserializing `ProjectContext` to binary cache (bincode format).
  Cache sizes: ~3.6 MB for hostap (12K functions), ~2.4 MB for sqlite.
  Per-worker speedup: hostap 11.2s -> 0.8s (93%), sqlite prescan 866s -> 0s.
  New dependency: `bincode = "1.3"`.
- Persistent prescan cache at `data/prescan_cache/{codebase}.cache` with
  `--rebuild-prescan` flag for regeneration.

### Changed

- Parallel scanner: balanced subdirectory splitting via recursive
  `find_scan_units()`, prescan cache integration, prescan timeout increased
  600s -> 1800s, graceful `TimeoutExpired` fallback.done2026-04-20T16:58:08Z2026-03-21T00:00:00Z2026-03-21T00:00:00Z�10
+�;555Release v0.3.27### Added

- `rules-benchmark.toml` manifest with 13 style/recommendation rules disabled
  (zero Juliet CWE contribution, ~114K realworld violations): EXP19-C, DCL08-C,
  DCL06-C, EXP02-C, EXP14-C, EXP12-C, EXP10-C, DCL04-C, INT02-C, INT01-C,
  INT17-C, INT16-C, PRE31-C.
- Parallel sqc scanner (`scripts/sqc_parallel_scan.py`): splits codebases by
  subdirectory, runs multiple sqc processes via `ProcessPoolExecutor`,
  auto-detects parallelism, deduplicates merged JSON outputs.

### Fixed

- POS49-C: restricted from all shared struct field writes to only actual
  bit-field writes. `collect_bitfield_names()` identifies fields with
  `bitfield_clause`. 15,693 -> 107 violations (-99.3%).

### Changed

- All benchmark infrastructure updated to use `rules-benchmark.toml`.
- MCP realworld server uses parallel scanner with `rebuild_prescan` parameter.done2026-04-20T16:58:08Z2026-03-21T00:00:00Z2026-03-21T00:00:00Z�l/
+�1555Release v0.3.26### Fixed

- EXP33-C: conditional init early-return detection. If/else-if/else chains
  where non-initializing branches have unconditional exits no longer flag as
  uninitialized. New `if_chain_covers_init_or_exit()` analysis.
- ERR33-C (CWE-253): `== 0` for NonZero functions and Count functions no longer
  incorrectly flagged.
- FIO47-C: fixed 100% FP rate (0 TP, 119 FP -> 0 FP). Root cause:
  `count_arguments()` miscounted non-data args for `sprintf`/`sscanf`/`dprintf`.
  Relaxed format validation: `%lf` valid in C99+, removed `'` flag and
  `+/space` with `%o/%u/%x` checks.
- PRE00-C: restricted from all function-like macros to only macros with
  multi-evaluation risk or side effects.
- EXP34-C: pointer function parameters default to NotNull when no
  inter-procedural call-site data exists.
- Juliet: 8,390 TP / 9,252 FP, 47.6% TP rate (+0.3pp). FIO47-C: 119 FP -> 0.
  CWE-134 TP rate 33.4% -> 47.9% (+14.5pp).
- Real-world: -5,366 violations (-1.5%). PRE00-C -4,274, EXP34-C -1,758.
  Cumulative from v0.3.5: -48,086 (-11.9%).done2026-04-20T16:58:08Z2026-03-20T00:00:00Z2026-03-20T00:00:00Z

���
5
+�m555Release v0.3.33### Changed

- EXP33-C: complete rewrite from AST-walk to CFG-based forward dataflow
  analysis. New `init_state.rs` (~1,200 lines) with `InitState` lattice (5
  states: `Uninitialized`, `MaybeUninitialized`, `Initialized`,
  `MallocUninitialized`, `MallocInitialized`), forward worklist algorithm, and
  point queries via `get_var_info_at()`. New capabilities: branch-sensitive
  analysis, loop-aware array init, malloc content tracking, realloc wrapper
  detection, conditionally-initializing function detection, ~30 initializing
  functions with per-argument output indices, non-initializing function list,
  file-scope static variable tracking, subscript read extraction through
  `field_expression` chains.
- API00-C refinements.
- CFG `condition_range` support.
- Realworld benchmark MCP server enhancements (SQLite-first pattern,
  `get_rule_trend`, `get_project_history`).
- bench/db.py improvements.

### Removed

- Legacy shell scripts: batch_analyze_sqlite, bench_mosquitto_versions,
  compare_tools, run_juliet_multi_cwe, run_juliet_parallel, test_single_file.done2026-04-20T16:58:08Z2026-03-23T00:00:00Z2026-03-23T00:00:00Z�s4
+�?555Release v0.3.32### Fixed

- DCL07-C/DCL31-C FP reduction (-11,556 real-world violations, -7.1%). Three
  root causes addressed:
  1. Prescan deep recursion: `collect_function_names` now recurses into ALL
     child nodes (not just `preproc_*` blocks), finding functions inside ERROR
     nodes from tree-sitter misparses.
  2. Macro alias integration: DCL rules now check `macro_aliases` from prescan.
  3. External library whitelist: OpenSSL, Tcl/Tk, Apple CoreFoundation,
     mbedTLS, cJSON, zlib, GnuTLS, wolfSSL prefixes. `defined` operator
     skipped.
- DCL07-C: 10,617 -> 4,765 (-55.1%). DCL31-C: 10,543 -> 4,840 (-54.1%).
- Juliet: zero change (47.0% TP rate preserved).done2026-04-20T16:58:08Z2026-03-22T00:00:00Z2026-03-22T00:00:00Z�y3
+�K555Release v0.3.31### Fixed

- INT07-C: skip `char *` pointer/array declarations in
  `is_plain_char_declaration`. 96.5% of violations were pointer arithmetic.
  6,230 -> 207 (-96.7%).
- ERR33-C: fixed duplicate violation bug (standalone calls emitted via both
  paths). Suppressed printf/puts/putchar/fputs/fputc/putc, `fprintf(stderr,
  ...)`, `signal(SIG*, SIG_IGN/SIG_DFL)`, `time(&t)` with output parameter.
  Recognized `==0`/`!=0` as NULL checks. Added `putenv`/`strdup`/`strndup`.
  7,182 -> 1,807 (-74.8%).
- MSC41-C: removed overly broad substring keywords (`db`, `connect`). Strict
  word boundaries for `key`/`token`. Leading boundaries for
  `auth`/`login`/`pwd`/`database`. Always apply `looks_like_sensitive_data()`
  heuristic. Added `looks_like_sensitive_in_context()`. 3,954 -> 293 (-92.6%).
- ARR00-C: rewrote `is_array_identifier()` from text-search to AST-based
  `has_array_declaration()`. Guarded checks with array-only. Fixed
  `check_array_assignment` to skip compound assignments. 7,341 -> 2,637
  (-64.1%).
- EXP33-C: added `scanf`/`fscanf`/`sscanf` `&var` argument initialization.
  Added 15 for-each macro patterns. 4,554 -> 4,189 (-8.0%).
- Juliet: 8,156 TP / 9,180 FP, 47.0% TP rate. -129 TP from intentional printf
  suppression. Zero FP change.
- Real-world: 182,020 -> 161,893 (-20,127, -11.1%).done2026-04-20T16:58:08Z2026-03-22T00:00:00Z2026-03-22T00:00:00Z
�O
��"9
+�555Release v0.3.37### Fixed

- FIO30-C CWE-134 format string taint improvements. Three fixes unlock
  detection across all taint source patterns:
  - recv/recvfrom/recvmsg taint tracking: socket receive functions added to
    `process_string_manipulation_call`, handles cast expressions in buffer arg.
  - Macro alias resolution: integrated `const_eval::collect_macro_aliases` for
    `#define GETENV getenv` indirection. All function name lookups go through
    `resolve_func_name()`.
  - `get_base_variable` expression handling for `cast_expression`,
    `parenthesized_expression`, and `binary_expression`.
- Juliet (v0.3.35-v0.3.37 combined vs v0.3.34): TP 8,300 -> 8,508 (+208),
  FP 9,157 -> 9,067 (-90), TP rate 47.5% -> 48.4% (+0.9pp). Zero regressions.
- Real-world: 152,590 -> 153,568 (+978, +0.6%). ARR36-C +2,727 (strchr fires
  broadly on real-world pointer arithmetic). Excluding ARR36-C, net -1,749 FP.
- Source commits pinned in BENCHMARK_INSTALL.md for all 5 codebases.done2026-04-20T16:58:08Z2026-03-23T00:00:00Z2026-03-23T00:00:00Z�8
+�c555Release v0.3.36### Added

- ARR36-C CWE-469: strchr/wcschr cross-array subtraction detection.
  `PointerAnalyzer` tracks `strchr`, `strrchr`, `wcschr`, `wcsrchr`, `memchr`,
  `strstr`, `wcsstr`, `strpbrk`, `wcspbrk` return values as pointing into
  first argument. Array declarations treated as own base. Assignment expressions
  tracked for pointer origin resolution. 36/36 TP, 0 FP.
- STR03-C CWE-464: `(char)atoi()` null sentinel detection. Covers `strtol`,
  `strtoul`, `atol` with char cast. 38/38 TP, 0 FP.
- API07-C CWE-843: void* type confusion detection. Tracks `void*` assignments,
  detects dereference with incompatible cast where cast type is larger than
  source type. 40/40 TP, 0 FP.done2026-04-20T16:58:08Z2026-03-23T00:00:00Z2026-03-23T00:00:00Z�B7
+�]555Release v0.3.35### Added

- API07-C CWE-761: free-pointer-not-at-start detection. Tracks
  `malloc`/`calloc`/`realloc` assignments, detects `ptr++`/`ptr+=N`/`ptr--`
  modifications, flags subsequent `free(ptr)`. Handles reassignment and
  reallocation resets.

### Fixed

- EXP33-C: `extract_nested_base_ex()` recurses through nested subscript/field
  chains (`arr[0].field` -> `arr`). `MallocUninitialized` + subscript-in-chain
  -> `MallocInitialized`. `match_initializing_function()` suffix-matches wrapper
  functions (`os_memset` -> `memset`). `*zalloc()` recognized as
  zero-initializing allocator.
- ARR00-C: `find_pointer_source_array()` recursively resolves pointer
  derivation chains (depth limit 5). Eliminates FPs on `end - pos` buffer
  arithmetic.
- ERR33-C: printf-family return value checks suppressed (`fprintf`, `sprintf`,
  `snprintf`, `vprintf`, `vfprintf`, `vsprintf`, `vsnprintf`).

### Changed

- BENCHMARK_INSTALL.md: updated sqc examples from `rules-all.toml` to
  `rules-benchmark.toml`.done2026-04-20T16:58:08Z2026-03-23T00:00:00Z2026-03-23T00:00:00Z�.6
+�5555Release v0.3.34### Fixed

- EXP33-C critical bug: functions inside `#ifdef`/`#ifndef`/`#if` preprocessor
  blocks were silently skipped. The guard condition `node.kind() !=
  "translation_unit"` excluded all non-top-level parents. Removed incorrect skip
  condition.
- EXP33-C: field-write `MallocUninitialized` preservation re-applied. Field
  writes on malloc'd pointers no longer upgrade to `MallocInitialized`. Stack
  struct field writes still upgrade `Uninitialized` -> `Initialized`.
- Reverted `extract_field_base` nested subscript resolution (caused premature
  `Initialized` marking on first element write).
- Juliet (vs v0.3.32): TP 8,156 -> 8,300 (+144), FP 9,180 -> 9,157 (-23),
  TP rate 47.0% -> 47.5%. EXP33-C: 294/561 -> 431/559.
- Real-world (vs v0.3.32): 150,337 -> 152,590 (+2,253). EXP33-C +2,899
  (hostap +2,525) from `arr[0].field` limitation.done2026-04-20T16:58:08Z2026-03-23T00:00:00Z2026-03-23T00:00:00Z
���*��s=
+�?555Release v0.3.43### Added

- MSC12-C dead code / no-effect detection (CWE-561) with 4 detection patterns:
  no-effect expression statements (comparisons as statements, bitwise/shift with
  discarded result, wasted dereferences, bare identifiers), duplicate conditions
  in if/else-if chains, redundant sub-expressions in logical operators, and
  meaningless `continue` at end of loop body. Exceptions for `(void)` casts,
  function calls in conditions, and function calls in logical sub-expressions.
  12 wiki tests (5 fail + 7 pass).
- Wildcard suppression in `.sqc-suppress.toml` via `[[wildcard]]` TOML section.
  Supports `file_glob`, `rule`, `rule_glob`, `function_prefix`, and
  `justification` fields (all ANDed). Hash-matched suppressions take priority.
  Glob patterns compiled to regex at load time.done2026-04-20T16:58:08Z2026-03-25T00:00:00Z2026-03-25T00:00:00Z�5<
+�C555Release v0.3.42### Fixed

- const_eval.rs: double-nested parens now handled via loop-based stripping.
- DCL02-C: function-scope declarations checked via `init_declarator` +
  root-node traversal.
- EXP40-C: per-scope const variable tracking (was only double-pointer).
- STR34-C: `init_declarator` path + parameter tracking + per-function scoping.
- CON34-C: thread-unsafe function detection via banned function list.
- CON07-C: unprotected shared variable access via file-scope global collection.
- MSC38-C: test reclassified to SIG30-C (already detected).
- ERR01-C: errno-setting function detection for strtol/sqrt.
- MEM10-C: `sizeof(pointer)` misuse detection in alloc/memory calls.
- POS50-C: TOCTOU race detection (`stat()` then `fopen()` on same path).
- DCL17-C: K&R style function declaration + empty param list detection.
- CWE-480 (EXP16-C): AST-based function name collection + NULL recognition.
- CWE-482 (EXP16-C): dead comparison detection.
- CWE-367 (FIO01-C): `access()`/`stat()` + `open()` TOCTOU detection.

### Changed

- Benchmark analyzer: `parse_c_file_sections()` now performs call-graph analysis
  to reclassify helper functions defined outside `#ifndef OMITBAD`/`#ifndef
  OMITGOOD` guards. +52 TP, +5 FP across all runs. 18 historical runs
  retroactively corrected (969 total violations reclassified).
- Coverage gate raised from 79% to 80%. Current: 80.06%.done2026-04-20T16:58:08Z2026-03-25T00:00:00Z2026-03-25T00:00:00Z�L;
+�q555Release v0.3.39### Fixed

- ARR36-C real-world FP reduction (-82%). Per-function scoping fixes
  cross-function variable name collisions. Identifier chain resolution follows
  `variable_arrays` for known identifiers. Compound assignment (`+=`/`-=`) no
  longer overwrites array base. `os_*` wrapper recognition for `os_strchr`,
  `os_strstr`, `os_strrchr`, etc. Allocation functions get unique per-call
  bases. Address-of vs dereference distinction. File-scope + bare declaration
  tracking.
- Juliet: zero delta (8,508 TP, 9,067 FP, 48.4% TP rate).
- Real-world: 157,688 -> 153,156 (-4,532, -2.9%). ARR36-C 4,685 -> 829
  (-3,856, -82.3%).done2026-04-20T16:58:08Z2026-03-24T00:00:00Z2026-03-24T00:00:00Z�L:
+�q555Release v0.3.38### Fixed

- EXP33-C: conditional-init, cast unwrap, and array arg fixes for real-world
  FP reduction.

### Changed

- DCL31-C/DCL07-C: removed library-specific whitelists, added `-I` include
  paths for system-installed third-party headers.done2026-04-20T16:58:08Z2026-03-24T00:00:00Z2026-03-24T00:00:00Z

��I?
+�k555Release v0.3.46### Changed

- P3214-driven FP reduction: 17 rules improved across 5 rounds. Validated
  against P3214 Secondary MCU firmware (8051, Keil C51). Zero Juliet
  regressions across both v0.3.45 and v0.3.46 benchmark runs (51.1% held).
- DCL18-C: skip zero with type suffix (0U, 0u, 0L, 0UL) — not octal confusion.
- DCL08-C: skip enums with consecutive integer sequences (0,1,2 or 1,2,3).
- PRE02-C: skip do{...}while(0) macros and (type)(expr) cast-wrapped macros.
- EXP35-C: arrow operator (->) means pointer return, not temporary struct.
- INT36-C: distinguish bitwise AND (&) from address-of; skip *ptr dereference.
- EXP07-C: skip bit-position shifts (0-7) — standard bit manipulation idioms.
- DCL19-C: skip volatile variables (ISR-shared) and STATIC macro declarations.
- INT17-C: skip hex constants ≤0xFFFF — portable across all C implementations.
- EXP10-C: skip || and && operators — C guarantees left-to-right evaluation.
- PRE08-C: skip self-matches (same filename compared to itself).
- DCL30-C: only flag pointer/array locals assigned to globals, not integer copies.
- EXP02-C: treat func()->field as pure getter read, not a side effect.
- INT34-C: recognize modulo expression (% N) as shift-amount bounds check.
- API00-C: recognize any token containing "STATIC" as static-equivalent macro
  (covers LIN_STATIC_INLINE, MY_STATIC_FUNC, etc.).
- EXP14-C: only flag ~ (bitwise NOT) and << (left shift) for promotion risk;
  skip &, |, ^, >> which are safe with unsigned operands.
- DCL17-C: skip simple volatile reads/writes; only flag compound operations
  (++, --, +=, -=) where read-modify-write may be non-atomic.
- INT14-C: skip 2-char loop index variables (bi) for mixed bitwise+arithmetic.
- INT30-C: skip narrow unsigned types (uint8_t, uint16_t) — promoted to int
  (≥32-bit) before arithmetic, cannot overflow promoted type. Preserved actual
  declared type from type_map instead of returning generic "unsigned".

### Results

- Juliet: 8,383 TP / 8,020 FP, 51.1% TP rate (unchanged from v0.3.44).
  Zero delta on all 69 CWEs across both v0.3.45 and v0.3.46 runs.
- P3214 Secondary MCU: 1,372 → 476 violations (-896, -65.3%).done2026-04-20T16:58:08Z2026-03-28T00:00:00Z2026-03-28T00:00:00Z�1>
+�;555Release v0.3.44### Changed

- ENV33-C: taint-source heuristic suppression for system()/popen(). Functions
  with no tainted input sources (recv, fgets, getenv, scanf, etc.) and no
  pointer/string parameters are suppressed. String literal arguments and
  cross-function sinks with char* params remain flagged. Macro aliases
  (#define SYSTEM system) resolved via project context.
- FLP03-C: removed overbroad check_fp_conversion() that flagged all
  float/double cast expressions. Added divide-by-zero guard detection:
  fabs/fabsf/fabsl magnitude checks, != 0, > 0, < 0 conditions suppress
  guarded divisions.

### Results

- Juliet TP rate: 48.4% -> 51.1% (+2.7pp). **P0 milestone achieved.**
- Total: TP 8,508->8,383 (-125), FP 9,067->8,020 (-1,047). 8.4:1 FP:TP ratio.
- ENV33-C: -818 FP/-139 TP (5.9:1). FP rate 58%->24.6%.
- FLP03-C: -234 FP/-70 TP (3.3:1). FP rate 69%->58.2%.
- CWE-78: TP rate 45.5%->63.0% (+17.5pp).
- CWE-369: TP rate 33.6%->36.9% (+3.3pp).
- Bonus: CWE-367 +15 TP, CWE-479 +36 TP, CWE-480 +10 TP, CWE-482 +7 TP
  (from v0.3.43 MSC12-C/wildcard rules newly matched to CWEs).
- Realworld: 154,598->154,603 (+5, flat). FLP03-C -164 (-43%, clean).
  ENV33-C -1. EXP16-C +160 regression in sqlite (unrelated, needs investigation).done2026-04-20T16:58:08Z2026-03-26T00:00:00Z2026-03-26T00:00:00Z
ii�A
+�555Release v0.3.48### Fixed

- analyze: resolve_includes now runs even when --load-prescan is set. Previously
  -I include paths were silently ignored during parallel scans (sqc_parallel_scan.py),
  causing DCL31-C/DCL07-C to flag functions declared in system headers.
  Realworld impact: DCL31-C+DCL07-C 14,657 → 3,772 (-10,885, -74%).
  Overall: 154,603 → 142,185 (-12,418, -8.0%).
- MEM04-C: sizeof() expressions now recognized as always non-zero in
  is_potentially_zero(). malloc(sizeof(int)) no longer falsely flagged.
- FIO10-C: POSIX rename() with return value check accepted as compliant.
  On POSIX, rename() atomically replaces the destination, so checking the
  return value is sufficient handling (task 18).

### Added

- test infra: `// sqc-test: prescan` marker for .c test files (task 19).
  build.rs detects the marker and generates tests that build intra-file
  prescan context (function summaries + call-site null states + CFGs) before
  calling rule.check(). Enables testing inter-procedural analysis patterns
  within a single translation unit.
- prescan: added prescan_single_tree() — builds ProjectContext from a single
  parsed tree for use in integration tests.
- analyze: collect_function_cfgs() now public for test use.
- EXP34-C: 3 intra-file null deref tests moved from pass/ to fail/ using
  prescan marker (func_param, list_null, callback_null). All correctly detect
  violations via call-site null state propagation.
- FIO10-C: added pass/testcases_posix_rename.c for POSIX error-checked rename.

### Changed

- WIN30-C: NULL security attributes test reclassified as out of scope.
  CreateFileA/CreatePipe security attributes are not related to WIN30-C
  (alloc/dealloc pairing). Test comment updated.done2026-04-20T16:58:08Z2026-03-29T00:00:00Z2026-03-29T00:00:00Z�~@
+�U555Release v0.3.47### Changed

- FIO24-C: added double-close detection for fclose/close/CloseHandle/closesocket.
  Tracks closed variables per function; flags duplicate close without intervening
  reopen. Resolves CWE-675 (224 Juliet files, 93.0% TP rate).
- POS37-C: added unchecked Windows privilege API return value detection
  (ImpersonateNamedPipeClient, RpcImpersonateClient, ImpersonateLoggedOnUser,
  CoImpersonateClient, ImpersonateSelf, SetThreadToken). Resolves CWE-273
  (36 Juliet files, 100% TP rate).
- DCL30-C: skip return of pointer to static local address. When a local pointer
  is assigned from &static_var[i], returning it is safe. Eliminates CWE-562 FP.
- MSC37-C: skip phantom functions from preprocessor-broken else-if chains.
  tree-sitter misparses disconnected else-if as function definitions.
- MSC37-C: recognize else_clause nodes in all-branches-return check. if/else
  where both branches return was falsely flagged.
- INT33-C: recurse into nested blocks for zero-guard detection. Guards inside
  outer if-blocks (e.g., null-check wrapping a zero-check) now recognized.
- INT34-C: recognize (mask >> var) != 0 loop condition as shift-amount bound.
  while ((mask >> bi) != 0u) implicitly constrains bi to < bit width.
- rule_cwe_map: added MSC12-C → CWE-561 mapping.
- INT32-C: scope type_map per function definition. Two functions declaring
  same variable name with different types (float X_pred vs int32_t X_pred)
  no longer collide — each function gets its own type map.
- DCL06-C: accept float zero literals (0.0f, 1.0f, etc.) as non-magic.
  Strip float/unsigned suffixes before checking acceptable values.
- FLP02-C: skip equality comparisons against exact zero (0.0, 0.0f). Zero
  is exactly representable in IEEE 754 — divide-by-zero guards are valid.
- bench/analyzer.py: fixed CSV parser regex for version:HASH suffix that broke
  line number extraction when commit hash started with a digit.

### Results

- 3 formerly zero-detection CWEs now detecting: CWE-675 (80 TP, 93.0%),
  CWE-273 (72 TP, 100%), CWE-562 (2 TP, 66.7% → 100% after DCL30-C fix).done2026-04-20T16:58:08Z2026-03-29T00:00:00Z2026-03-29T00:00:00Z
]
��	�P]�pF
+�9555Release v0.3.56### Added

- EXP34-C: variant 63 pointer-to-pointer null propagation. When caller passes
  &data where data=NULL, prescan tracks the pointee null state through
  callsite_param_pointee_null_states in FunctionSummary. Null state analysis
  seeds "*paramName" into initial state; transfer function propagates *ptr
  dereference. +6 TP, 0 FP across all 6 data types in CWE-476 variant 63.
- EXP34-C: variant 64 void pointer cast propagation. Cast expressions
  (dataPtr = (int**)dataVoidPtr) preserve "*" state keys. Parenthesized
  dereference form (*dataPtr) unwrapped for variant 63/64. +6 TP, 0 FP.
- EXP34-C: variant 66 array element null propagation. Prescan tracks
  subscript_expression assignments (arr[idx] = expr) as "arr.idx" dotted
  keys, reusing the struct field mechanism. Transfer function handles
  subscript_expression lookups. +6 TP, 0 FP.
- 6 new EXP34-C regression tests for variants 63, 64, and 66.done2026-04-20T16:58:08Z2026-04-01T00:00:00Z2026-04-01T00:00:00Z�E
+�{555Release v0.3.52### Changed

- EXP33-C: partial init array detection. Track allocation element count from
  malloc/ALLOCA calls; compare for-loop bound vs allocation count. If loop
  bound < allocation count, content stays MallocUninitialized (partial init).
  Detects 6 partial_init array types across all 18 Juliet variants (+102 TP).
- init_state: dead-branch elimination for constant conditions. Collect
  file-scope static [const] constants; evaluate branch conditions at analysis
  time; skip impossible edges. Handles literal (if(1)), const expr (if(5==5)),
  and static const/var conditions (if(STATIC_CONST_TRUE), if(staticTrue)).
  Eliminates opaque predicate FPs in Juliet variants 02-07 (-198 FP).
- const_eval: added comparison operators (==, !=, <, >, <=, >=) to
  try_evaluate_expr(). Enables constant condition evaluation.
- prescan: collect global constants from prescanned directories. Non-static
  const/non-const globals with compile-time values stored in
  ProjectContext.global_constants. Merged with macro_constants into EXP33-C
  file_scope_constants for cross-file dead-branch elimination (variants 09-14).

### Results

- CWE-457: 422 TP/715 FP (37.1%) → 524 TP/517 FP (50.3%). +102 TP, -198 FP,
  +13.2pp TP rate. Per-file detection 68.5% → 85.1%.
- Overall: 51.6% → 51.9% (+0.3pp). +101 TP, -200 FP. Zero regressions.done2026-04-20T16:58:08Z2026-03-31T00:00:00Z2026-03-31T00:00:00Z�D
+�555Release v0.3.51### Added

- MSC07-C: unreachable code detection (BRULE-034 gap). AST-based detection of
  statements after unconditional return/break/continue/goto and noreturn calls
  (exit, abort, _Exit, longjmp, quick_exit, thrd_exit, ExitProcess, ExitThread).
  Reports only first unreachable statement per terminal. CWE-561 mapping.
  11 tests: 7 fail, 4 pass.
- MSC04-C: bounded recursion suppression. If a recursive function has a
  parameter-dependent base case (conditional return checking a parameter),
  the violation is suppressed. CWE-674: 2 TP/2 FP → 1 TP/0 FP (100% TP rate).done2026-04-20T16:58:08Z2026-03-30T00:00:00Z2026-03-30T00:00:00Z�8C
+�I555Release v0.3.50### Changed

- prescan: detect (type *)param cast pattern as dereference in function
  summaries. Enables EXP33-C variant 64 (void* → cast → deref) detection.
  CWE-457: +10 TP, +10 FP (void pointer indirection types).done2026-04-20T16:58:08Z2026-03-30T00:00:00Z2026-03-30T00:00:00Z�@B
+�Y555Release v0.3.49### Changed

- EXP33-C: cross-file inter-procedural init tracking via set_project_context().
  build_read_only_deref_fns(): dereferences_params - modifies_params.
  InitAnalysisConfig.read_only_deref_fns prevents &var from being marked
  initialized when callee only reads through the pointer.
  check_cross_file_uninit_calls: flags calls passing &uninit_var to functions
  that read the pointed-to value (variant 63 pattern).
  CWE-457: +10 TP, +10 FP (10 simple scalar/pointer types).done2026-04-20T16:58:08Z2026-03-30T00:00:00Z2026-03-30T00:00:00Z
�R��I
+�a555Release v0.3.59### Added

- MSC42-C: new rule for CWE-327 broken/weak crypto algorithm detection. Blacklist:
  CALG_DES, CALG_3DES, CALG_RC5, CALG_RC2, CALG_RC4 in CryptDeriveKey/CryptGenKey.
  Also detects weak OpenSSL ciphers (EVP_des_*, DES_*, EVP_rc4, EVP_rc2_*).
  54 TP/0 FP (100%).
- WIN05-C: new rule for CWE-272 unquoted CreateProcess path detection. Two
  sub-patterns: unquoted paths with spaces in CreateProcessA/W/AsUser (path
  interception), HKEY_LOCAL_MACHINE in registry operations (excessive privilege).
  254 TP/64 FP (79.9%).
- ARR39-C: CWE-468 incorrect pointer scaling fix. Case-insensitive pointer name
  matching, added "pointer" keyword. Detects double-scaling pattern.
  19 TP/32 FP (37.3%).
- MSC41-C: CWE-259 hard-coded password improvements. Added "logon" to sensitive
  function keywords, added #define macro detection for sensitive-named macros.
  0 TP/0 FP on Juliet (tree-sitter preprocessor limitation).

### Results

- Juliet v0.3.59: 23,678 TP / 21,117 FP — 52.9% TP rate (+0.3pp from v0.3.58).
  +327 TP, +96 FP. 74 CWEs covered (up from 70).done2026-04-20T16:58:08Z2026-04-01T00:00:00Z2026-04-01T00:00:00Z�:H
+�M555Release v0.3.58### Added

- SIG31-C + SIG34-C: CWE-364 signal handler race condition detection. Mapped
  existing rules to CWE-364. 54 TP/51 FP (51.4%).
- MSC12-C: CWE-398 poor code quality — extended with 7 new patterns: empty
  control flow bodies, empty function bodies, standalone empty blocks, empty
  switch cases, stray semicolons, arithmetic no-effect, self-assignment.
  181 TP/2 FP (98.9%).
- MSC13-C: new rule for CWE-563 unused variable detection. Detects unused
  initialized/uninitialized local variables and dead stores. Struct field write
  not counted as read. 289 TP/0 FP (100%).

### Results

- Juliet v0.3.58: 23,351 TP / 21,021 FP — 52.6% TP rate (+0.5pp from v0.3.56).
  +524 TP, +53 FP. Zero regressions on 70 existing CWEs.done2026-04-20T16:58:08Z2026-04-01T00:00:00Z2026-04-01T00:00:00Z�+G
+�/555Release v0.3.57### Fixed

- STR03-C, INT00-C, INT16-C: resolved 3 remaining implementation bugs.done2026-04-20T16:58:08Z2026-04-01T00:00:00Z2026-04-01T00:00:00Z
���M
+�y555Release v0.3.63### Added

- BRULE-065: pointer indirection depth check. Flags declarations with excessive
  pointer indirection (e.g., `int ***p`). Handles parameter declarations,
  init_declarators, and nested declarator chains. First non-CERT rule —
  established `src/rules/brules/` directory structure.
- `expected_fail/` test directory for known analysis limitations. build.rs
  generates tests with `#[ignore = "Known limitation: ..."]`. Run with
  `cargo test -- --ignored` to check for improvements.

### Fixed

- MSC13-C: compound assignment LHS (`+=`, `-=`, etc.) now recognized as a read.
  `is_read_context()` checks assignment operator type; `collect_all_assignments()`
  only collects simple `=` assignments.
- INT34-C: AST-based unsigned type detection from function parameter declarations.
  Replaced string matching with `decl_has_unsigned_var()` and correct
  `find_parameter_list()` traversal.
- Number of additional fixes (see commit history).done2026-04-20T16:58:08Z2026-04-01T00:00:00Z2026-04-01T00:00:00Z�SL
+�555Release v0.3.62### Fixed

- Resolved all 5 pre-existing test failures (CON08-C, DCL20-C, INT08-C, EXP15-C).
  Zero test failures remain.done2026-04-20T16:58:08Z2026-04-01T00:00:00Z2026-04-01T00:00:00Z�K
+�	555Release v0.3.61### Added

- Man page (`docs/sqc.1`) covering all 16 CLI options, exit codes, rules manifest
  and suppression file config, 7 usage examples, and cross-references.
  View with: `man -l docs/sqc.1`.
- Test coverage gate raised from 80% to 81% (1,350 additional lines covered).
  75+ new `.c` test files across 10 rules.done2026-04-20T16:58:08Z2026-04-01T00:00:00Z2026-04-01T00:00:00Z�rJ
+�=555Release v0.3.60### Added

- EXP39-C: CWE-188 struct memory layout assumption detection. Two new checks:
  (1) struct field pointer arithmetic — flags *(T*)(ptr + offset) where ptr was
  assigned from &struct.field, (2) union type punning — flags sub-field access
  into struct member of union after writing to a different scalar member.
  36 TP/0 FP (100%). All 36 Juliet files detected.
- FIO42-C: CWE-459 incomplete temp file cleanup. Detects mkstemp/mktemp/MKSTEMP
  /MKTEMP calls without corresponding unlink/remove/DeleteFile cleanup in the
  same function. 34 TP/0 FP (100%). 34/36 files (variant-12 mixed branches missed).
- POS55-C: new rule for CWE-666 socket operation ordering. State machine enforces
  bind() → listen() → accept() order. Flags accept before listen/bind, listen
  before bind. 162 TP/0 FP (100%). All 90 Juliet files detected.
- MEM03-C: CWE-226 sensitive data not cleared before release. Detects pointer/array
  variables with sensitive names (password, secret, credential, passphrase) not
  cleared with SecureZeroMemory/memset/explicit_bzero before function exit.
  68 TP/0 FP (100%). 68/72 files (variant-12 missed).
- MEM35-C: CWE-789 unbounded memory allocation from untrusted input.
  Intra-procedural taint analysis flags malloc/calloc/realloc in functions with
  taint sources (recv, fgets, fscanf, rand) and no upper-bound check (< constant).
  190 TP/0 FP (100%). Cross-function variants need inter-procedural taint.
- ERR07-C: CWE-114 untrusted library path / process control. Intra-procedural
  taint analysis flags LoadLibraryA/W/dlopen in functions with taint sources.
  126 TP/0 FP (100%). Cross-function variants need inter-procedural taint.

### Results

- Juliet v0.3.60: 24,408 TP / 21,117 FP — 53.6% TP rate (+0.7pp from v0.3.59).
  +730 TP, 0 FP. 31 CWEs at 100% precision (up from 25). Per-file rate 40.9%.
  Only 2 zero-detection CWEs remaining (CWE-259, CWE-328).
- Bonus: CWE-680 +80 TP/0 FP (MEM35-C taint caught integer-overflow-to-buffer-
  overflow), CWE-244 +34 TP/0 FP (MEM03-C sensitive data caught heap inspection).done2026-04-20T16:58:08Z2026-04-01T00:00:00Z2026-04-01T00:00:00Z
�$"
���IQ
+�k555Release v0.3.67### Fixed

- resolve_local_var_range returned first assignment instead of last. For
  `data = 0; data = INT_MAX; result = data + 1;`, resolved data to [0,0]
  instead of [INT_MAX,INT_MAX], causing INT32-C/INT30-C false suppression.
- Unevaluable assignments (data = rand(), fscanf(&data)) left stale range
  from prior assignment. New stmt_modifies_var() invalidates range on
  unevaluable assignment or pointer-modifying call.
- Juliet benchmark runner: -d JULIET_BASE prescanned 58K files per CWE
  (~4 min each × 74 CWEs). Changed to CWE-scoped prescan and -j 1.
  Benchmark time: hours → 7 min.

### Results

- CWE-190: 1,763→2,322 TP (+559), per-file 35.0%→43.3% (+8.3pp)
- CWE-191: 1,563→1,973 TP (+410), per-file 40.5%→47.7% (+7.2pp)
- CWE-680: 404→559 TP (+155), TP rate 48.7%→51.4% (+2.7pp)
- Overall: +1,144 TP, +1,290 FP. TP rate 53.6%→53.3% (-0.3pp).done2026-04-20T16:58:08Z2026-04-02T00:00:00Z2026-04-02T00:00:00Z�
P
+�s555Release v0.3.66### Added

- LPT file-size scheduling for parallel analysis. Graham's LPT heuristic
  (1969): files sorted by size descending, dispatched via rayon par_bridge()
  (demand-driven). Reduces worst-case runtime variance by 52-99% and improves
  CPU efficiency from 83% to 96% on skewed workloads (sqlite, curl).done2026-04-20T16:58:08Z2026-04-02T00:00:00Z2026-04-02T00:00:00Z�O
+�W555Release v0.3.65### Fixed

- Sequential mode (`-j 1`) now creates a fresh RuleRegistry per file, matching
  parallel mode behavior. Previously, rules with RefCell state (DCL31-C, DCL07-C,
  ERR01-C, ERR33-C, ENV33-C, ENV03-C, ENV02-C, API00-C, INT30-C, SIG00-C,
  SIG02-C, WIN03-C, WIN05-C, WIN30-C) accumulated data across files, causing
  false suppressions in later files. Sequential and parallel modes now produce
  identical output.done2026-04-20T16:58:08Z2026-04-02T00:00:00Z2026-04-02T00:00:00Z�YN
+�555Release v0.3.64### Added

- Built-in parallel analysis with rayon (`-j`/`--jobs` flag). Default `-j 0`
  auto-detects CPU count. Per-file parser and rule registry instances avoid
  RefCell/Send issues. Results sorted deterministically. Python parallel wrapper
  (`scripts/sqc_parallel_scan.py`) removed — no longer needed.
  Performance: curl 9m38s → 59s (9.8x), mosquitto 2m42s → 34s (4.8x).done2026-04-20T16:58:08Z2026-04-02T00:00:00Z2026-04-02T00:00:00Z
���+V
+�/555Release v0.3.78### Changed

- STR31-C: is_string_memcpy() now checks next 3 lines for manual null-termination
  (dest[...] = '\0').  If programmer explicitly null-terminates after memcpy,
  STR31-C concern is addressed; buffer overflow is a separate ARR38-C concern.

### Benchmark

- −306 FP, −220 TP (1.4:1 ratio). CWE-126 +1.2pp, CWE-121 +0.3pp.done2026-04-20T16:58:08Z2026-04-04T00:00:00Z2026-04-04T00:00:00Z�EU
+�c555Release v0.3.77### Changed

- ARR38-C: is_dangerous_size_calculation() exempts strlen(x)*sizeof(T) —
  legitimate byte count, not sizeof double-scaling.

### Benchmark

- −1012 FP, −728 TP (1.4:1 ratio). CWE-121 48.8% → 49.9%, CWE-126 +1.5pp.done2026-04-20T16:58:08Z2026-04-04T00:00:00Z2026-04-04T00:00:00Z�/T
+�7555Release v0.3.76### Changed

- STR31-C: find_buffer_size() follows `data = dataBuffer` pointer aliases
  (function-scoped, excludes pointer arithmetic).  Recognizes ALLOCA(N*sizeof(T))
  and ALLOCA(N).  Array size arithmetic (N*M, N+M, N-M) also supported.

### Benchmark

- −272 FP, −8 TP (34:1 ratio). CWE-127 55.6% → 64.4%, CWE-124 52.1% → 55.0%.done2026-04-20T16:58:08Z2026-04-04T00:00:00Z2026-04-04T00:00:00Z�RS
+�}555Release v0.3.75### Added

- bench/competitors.py: benchmark runner for Infer and Frama-C on Juliet.
  Runs competitor tools on overlapping CWE subsets, classifies TP/FP using
  Juliet ground truth (OMITBAD/OMITGOOD guards + procedure names).
  Infer: 11 CWEs (memory safety). Frama-C EVA: 6 CWEs (value analysis).
- playbooks/install-static-analyzers.yml: Ansible playbook for installing
  Infer v1.2.0 (prebuilt) and Frama-C 32.0 Germanium (via opam) on Debian 12.
- docs/benchmark-setup.rst: Infer and Frama-C installation instructions.
- docs/benchmark-running.rst: competitor benchmark usage, timing, classification.
- paper/sqc.tex: preliminary Infer/Frama-C comparison data (CWE-476 pilot).
- PLAN.md: split task 33 into 33a (Infer) and 33b (Frama-C) with run commands.done2026-04-20T16:58:08Z2026-04-03T00:00:00Z2026-04-03T00:00:00Z�dR
+�!555Release v0.3.74### Added

- is_full_range_return_function() denylist in std_functions.rs: atoi, atol,
  atoll, strtol, strtoul, strtoll, strtoull, strtoimax, strtoumax, wcstol,
  wcstoul, wcstoll, wcstoull, wcstoimax, wcstoumax, rand, random, lrand48,
  mrand48, rand_r, RAND32, ntohl, ntohs. Functions whose return values can
  span the full integer range are no longer suppressed by the opaque
  increment heuristic in INT32-C and INT30-C.
- resolve_identifier_call_name() in INT32-C/INT30-C: traces the callee
  function name through switch, case, for, while, if, compound, and preproc
  blocks. Enables the denylist check for deeply nested call assignments.
- VRA collect_local_decl_types(): records declared types for uninitialized
  local variables (e.g. `int data;`). Prevents fallback to [i64::MIN,
  i64::MAX] when the variable is later assigned from an unevaluable call.
- VRA local_types lookup in process_expression_range(): uses declared type
  as fallback when existing VRA entry has no type info.

### Fixed

- INT32-C/INT30-C: is_small_increment_of_opaque no longer blanket-suppresses
  `atoi(buf) + 1`, `rand() + 1`, and similar patterns. Known full-range
  functions bypass suppression. Local functions with wide VRA return ranges
  also bypass. strlen()+1 and other bounded-return patterns remain suppressed.
- VRA: `int data; data = atoi(buf);` now correctly uses [INT_MIN, INT_MAX]
  instead of [i64::MIN, i64::MAX] for the fallback range. Fixes incorrect
  VRA suppression of overflow checks for uninit-declared variables.

### Results

- CWE-190: 2,322→2,538 TP (+216), FP -6. TP rate 45.1%→47.4% (+2.3pp).
- CWE-191: 1,973→2,091 TP (+118), FP -6. TP rate 44.0%→45.5% (+1.5pp).
- CWE-680: 559→617 TP (+58), FP unchanged. TP rate 51.4%→53.9% (+2.5pp).
- Overall: +392 TP, -12 FP. TP rate 54.4%→54.8% (+0.4pp). Per-file 45.4%→45.7%.
- Zero CWE regressions. INT32-C: +360 TP / -12 FP (30:1 improvement ratio).done2026-04-20T16:58:08Z2026-04-03T00:00:00Z2026-04-03T00:00:00Z
f�
�R�:[
+�M555Release v0.3.83### Changed

- INT32-C/INT30-C: VRA now consulted for increment/decrement operations.
  check_increment_decrement() uses expression_fits_in_signed/unsigned_vra()
  to suppress data++ when VRA proves the operand is safely within bounds.
- const_eval: try_evaluate_range() handles update_expression nodes (++/--)
  by resolving the argument range and adding/subtracting 1.
- const_eval: try_evaluate_text() resolves sizeof(type) via resolve_sizeof_type()
  and sizeof(variable) conservatively as 1 (sizeof >= 1 on all platforms).
  Enables CHAR_ARRAY_SIZE = (3 * sizeof(data) + 2) macro resolution.
- CWE-190: 47.4% → 58.6% (+11.2pp). CWE-191: 45.5% → 53.9% (+8.4pp).
- Overall: -2,760 FP, -1,388 TP. TP rate 56.8% → 59.0% (+2.2pp).done2026-04-20T16:58:09Z2026-04-05T00:00:00Z2026-04-05T00:00:00Z�tZ
+�A555Release v0.3.82### Changed

- CFG: constant condition pruning for if(0)/if(1)/while(1)/for(;;).
  Only the feasible branch edge is emitted, eliminating infeasible-path FPs.
  Also evaluates literal comparisons (5==5, 5!=5) in conditions.
- null_state: walk switch_statement bodies for declarations and assignments.
  Previously the switch was treated as a single opaque statement in the CFG.
- EXP34-C: AST-level null guard fallback — walk ancestors for enclosing
  if(var != NULL) blocks to suppress dereferences inside null guards that
  the CFG cannot model (e.g., inside switch case bodies).
- API00-C: relay function suppression — skip validation warning when a
  pointer parameter is only passed to callees that check for null.

### Benchmark

- Overall: +3 TP, −378 FP (56.3% → 56.8%). Zero regressions.
- CWE-476: +3 TP, −70 FP (50.8% → 56.3%).
- CWE-690: −38 FP (94.6% → 100.0% TP rate).
- Spillover: CWE-195 −150 FP, CWE-369 −60 FP, CWE-680 −30 FP.
- Per-rule: INT31-C −180 FP, EXP34-C −90 FP, INT33-C −60 FP, API00-C −18 FP.done2026-04-20T16:58:08Z2026-04-05T00:00:00Z2026-04-05T00:00:00Z�lY
+�1555Release v0.3.81### Changed

- ARR38-C: extract_strlen_from_sizeof_expr() helper extracts strlen/wcslen
  argument from strlen(x)*sizeof(T) patterns.  Added to check_buffer_size_mismatch
  and check_string_size_parameter: compares source vs dest buffer sizes.
  When source > dest, flags overflow (recovers TPs lost by Fix 2 blanket exemption).

### Benchmark

- +200 TP, +48 FP (4.2:1 ratio). CWE-121 54.3% → 55.7%.done2026-04-20T16:58:08Z2026-04-05T00:00:00Z2026-04-05T00:00:00Z�+X
+�/555Release v0.3.80### Changed

- ARR38-C: is_size_within_known_buffer() helper — when check_size_exceeds_buffer
  confirms size fits, skip is_hardcoded_large_size/count heuristics.
  Applied to check_string_size_parameter, check_buffer_function,
  check_wide_string_function.

### Benchmark

- −272 FP, −48 TP (5.7:1 ratio). CWE-121 51.6% → 54.3%.done2026-04-20T16:58:08Z2026-04-05T00:00:00Z2026-04-05T00:00:00Z�W
+�555Release v0.3.79### Changed

- STR31-C: get_memset_content_length() scans enclosing function for
  memset/wmemset initialization + null-termination pattern.  Infers strlen(data)
  from fill count.  Max-across-branches for control flow variants.

### Benchmark

- −204 FP, 0 TP (pure FP elimination). CWE-121 +1.4pp, CWE-122 +1.7pp.done2026-04-20T16:58:08Z2026-04-04T00:00:00Z2026-04-04T00:00:00Z
�����`^
+�555Release v0.3.86### Changed

- MEM31-C: prescan-based callee-frees-param detection. When a callee function
  is known (via FunctionSummary.frees_params) to free a parameter, mark the
  allocation as freed at the call site instead of flagging a leak.
- FunctionSummary: param pass-through tracking. Detects when function params
  are forwarded directly to callees (AST-based). Used for transitive free
  propagation across relay function chains (A→B→C→free).
- prescan: propagate_transitive_frees() fixpoint. After all summaries are
  merged, propagates frees through pass-through chains up to 10 levels deep.
- MEM31-C: if/else branch merge fix. Use UNION of freed memory from both
  branches instead of only true branch state. Prevents FPs where free() is
  in the else clause of constant-condition if/else blocks.
- MEM31-C converted from unit struct to stateful struct with
  set_project_context() for prescan integration.

### Benchmark

- CWE-401: 50.7% → 77.6% (+26.9pp). MEM31-C: -543 FP, -25 TP (21.7:1 ratio).
- MEM31-C rule FP rate: 49.3% → 22.4%.
- Overall: 25,456 TP / 15,768 FP. TP rate 61.0% → 61.8% (+0.8pp).
  Zero regressions across all 74 CWEs.done2026-04-20T16:58:09Z2026-04-06T00:00:00Z2026-04-06T00:00:00Z�h]
+�)555Release v0.3.85### Changed

- MEM01-C: CFG-based forward reachability replaces naive "next statement is
  NULL?" check. For each free(ptr), BFS through CFG successor blocks — only
  flags when ptr is actually used or freed again on a reachable path. Suppresses
  when ptr goes out of scope or is reassigned. Declaration-as-reassignment
  handling for loop-scoped variables. Inline CFG building fallback for tests.
- CWE-415: 43.4% → 58.2% (+14.8pp). CWE-416: 43.9% → 92.9% (+49.0pp).
- MEM01-C: -654 FP, -204 TP (3.2:1 ratio). Rule TP rate 41.7% → 71.8%.
- Overall: 25,481 TP / 16,311 FP. TP rate 60.2% → 61.0% (+0.8pp).
  Zero regressions across all 74 CWEs.done2026-04-20T16:58:09Z2026-04-05T00:00:00Z2026-04-05T00:00:00Z�q\
+�;555Release v0.3.84### Changed

- INT33-C: all-assignments-nonzero check for divisor variables. If ALL
  assignments to the divisor in the containing function are non-zero constants,
  the division is safe. Loop update detection (i--, i++) prevents false
  suppression of loop variables.
- INT33-C: fabs()/fabsf()/fabsl() magnitude guard recognition. Float
  divide-by-zero guards like `if(fabs(data) > 0.000001)` now suppress.
- FLP03-C: constant-aware divisor non-zero detection. Two-strategy approach:
  all-assignments-nonzero, and feasible-branch walk using file-scope constants
  to determine last reaching assignment.
- CFG builder: resolve static const int variables as constant conditions.
  Enables dead-branch pruning for `if(STATIC_CONST_TRUE)` patterns.
- const_eval: collect file-scope `static const int` declarations as constants.
- const_eval: float literal to i64 fallback (e.g., 2.0F → 2) for VRA tracking.
- CWE-369 TP rate 37.9% → 53.9% (+16.0pp). -882 FP, -8 TP overall.
  Bonus: INT31-C -144 FP, EXP34-C -24 FP from CFG constant resolution.done2026-04-20T16:58:09Z2026-04-05T00:00:00Z2026-04-05T00:00:00Z
{{�a
+�555Release v0.3.91### Changed

- FunctionSummary: recognize alias null-checks as param null-checks.
  Pattern: `TYPE *alias = param;` followed by a null check on `alias`.
  Common in libcurl/sqlite wrappers that cast-copy the pointer param first
  (e.g. `struct Curl_easy *data = d; if(!data) ...`). Without this,
  `d` was not detected as null-checked, causing caller-side EXP34-C FPs
  on curl wrappers.

### Benchmark

- Addresses v0.3.90 curl EXP34-C regression (+45 FPs from unmasked short
  param-name substring matches revealing previously-hidden violations on
  curl wrapper patterns).done2026-04-20T16:58:09Z2026-04-17T00:00:00Z2026-04-17T00:00:00Z�`
+�c555Release v0.3.90### Changed

- FunctionSummary.checks_null_params: recognize `PARAM == 0` / `PARAM != 0`
  and reversed-operand variants as null checks. Previously only the `== NULL`
  / `!= NULL` spellings matched, so idioms like `if(pStmt==0)` (common in
  sqlite, libcurl) did not register the param as null-checked. The new
  `body_matches_null_check()` helper also handles arbitrary whitespace
  between tokens and uses word-boundary checks to avoid matching substrings.
- EXP34-C: skip deref-function arg check when callee is in the null-safe
  list (free, realloc). `free(NULL)` is defined as no-op per C11 7.22.3.3
  and `realloc(NULL, n)` per C11 7.22.3.5; flagging them as null-deref sites
  is incorrect.
- EXP34-C null-safe function list: added `realloc`.

### Task

- Task 61 (partial): EXP34-C FP reduction for null-safe wrappers and the
  `== 0` null-check idiom. The originally-listed 16 FPs in d_lib_common
  (Patterns 9 + 18) were already addressed by earlier EXP34-C work
  (v0.3.82 AST-level null guard + v0.2.20 &stack_var propagation). This
  changeset targets the remaining `Memory_Free(NULL)` wrapper FP and the
  sqlite-style `== 0` null-check idiom surfaced by the realworld benchmark.done2026-04-20T16:58:09Z2026-04-17T00:00:00Z2026-04-17T00:00:00Z�^_
+�555Release v0.3.87### Added

- 13 multi-file CLI integration tests for cross-file prescan capabilities:
  callsite null propagation (EXP34-C), can_return_null (EXP34-C),
  frees_params (MEM31-C), header_declared_functions (DCL15-C).
  Each scenario tests with-d, without-d, and safe variants.
  (Task 20)
- Test fixtures: crossfile_callsite_null/, crossfile_frees/, crossfile_header/
  with manifests for MEM31-C and DCL15-C.

### Changed

- docs/architecture.rst: comprehensive rewrite. Inventory of all 10 analysis
  modules, capabilities table expanded from 10 to 17 entries, limitations
  table updated (8 entries with impact), per-CWE ceiling analysis, updated
  competitor landscape from 5-tool benchmark. Removed outdated claims
  ("No VRA", "No whole-program analysis", 48% TP rate). (Task 37)
- README.md: benchmark table updated (48.4% → 61.8% TP rate, 16 → 32
  perfect CWEs, added per-file detection rate 42.6%).
- docs/sqc.1: man page version 0.3.61 → 0.3.87.
- docs/cli-usage.rst: prescan collection list expanded from 4 to 9 items
  (added header prototypes, call graph, call-site arg states, struct field
  types, global constants, global null states).done2026-04-20T16:58:09Z2026-04-07T00:00:00Z2026-04-07T00:00:00Z
����#c
+�555Release v0.3.93### Changed

- INT30-C: drop the dedicated `malloc()` / `realloc()` multiplication
  overflow check. The inner `*` expression is already covered by the
  generic `check_multiplication` walker (which correctly skips under
  VRA / constant-folding / SIZE_MAX-guard conditions), so the
  allocation-level check only produced duplicate diagnostics on every
  hit and occasional false positives on good-path cases where the
  inner check had proved the multiplication safe (e.g. Juliet
  `malloc(data * sizeof(int))` with `data = 20`). Calloc's dedicated
  check remains — its multiplication is implicit and not visible to
  the binary-expression walk.
- INT30-C: removed now-dead `flag_allocation_overflow` and
  `contains_multiplication` helpers.

### Benchmark

- Follow-up to v0.3.92: the v0.3.92 get_function_arguments fix
  restored the previously-broken malloc/realloc check, adding 525
  duplicate diagnostics on CWE-680 (TP +207, FP +318, TP rate
  −4.7pp). Deduplicating the check brings CWE-680 back to baseline
  while preserving the v0.3.92 embedded FP reductions and the
  calloc-wrapper / message-cleanup improvements.
- Juliet v0.3.93 vs v0.3.91 (baseline): zero delta across all 74
  CWEs — TP 25354, FP 15768, TP rate 61.7%, unchanged. The v0.3.92
  CWE-680 regression is fully reversed.
- Real-world v0.3.93 vs v0.3.91: **−187 INT30-C violations** across
  four codebases (hostap's pre-existing stack overflow unrelated).
    curl:      -106 INT30-C
    mosquitto:  -44 INT30-C
    sqlite:     -37 INT30-C, -1 FIO05-C
    libcrc:       0
  Total: -188 violations overall. Closes task 60.done2026-04-20T16:58:09Z2026-04-17T00:00:00Z2026-04-17T00:00:00Z�cb
+�555Release v0.3.92### Changed

- INT30-C: three targeted FP reductions on embedded codebases:
  1. Skip plain `++`/`--` of a wide-unsigned struct/union field
     (`ctx->tick++`, `obj.seq--`). Monotonic counter fields wrap at 2^32
     or 2^64 — practically never in real systems. Juliet CWE-190/191
     only exercises local-variable increments, so TP detection is
     preserved.
  2. Skip the calloc overflow warning when both `calloc` arguments are
     function parameters of the enclosing function (thin-wrapper
     pattern). Overflow detection is delegated to C11 calloc itself
     (§7.22.3.2).
  3. Extend subtraction guard detection to preceding
     early-exit `if` siblings. `if (a < b) return; /* ... a - b */`
     places the subtraction on an implicit else-path where `a >= b`.
- INT30-C: `get_function_arguments` now iterates named children of the
  argument list instead of all children. Previously it returned
  punctuation tokens (`(`) as the first "argument", which silently
  suppressed `malloc`/`realloc` multiplication overflow detection and
  produced malformed `calloc((, nmemb)` messages. Added missing
  `SIZE_MAX / size` guard recognition for `malloc` and `realloc`
  (calloc already had it) so the fix does not regress pass tests.
- INT30-C: `has_function_context_check` falls back to the translation
  unit when the call has no containing function, so top-level wiki-
  snippet tests continue to recognize overflow guards.

### Benchmark

- Targets task 60 follow-up: embedded FPs identified after v0.3.88
  library benchmark. On the 4 target embedded codebases (suppressions
  stripped for measurement):
    d_lib_common:          1 → 0 INT30-C FPs
    d_lib_serial_leds:    12 → 8 INT30-C FPs (−3 tick increments,
                                             −1 implicit-else guard)
    d_lib_airpath:         2 → 2 (unchanged — bounded-shift compound
                                 addition, out of scope)
  All 3319 existing tests still pass; new
  `testcases_embedded_patterns.c` pass test covers the three new
  patterns.done2026-04-20T16:58:09Z2026-04-17T00:00:00Z2026-04-17T00:00:00Z
A�A�	e
+�k555Release v0.3.98### Changed

- EXP02-C: extend guard-pattern recognition beyond null-checks. Any
  comparison (`==`, `!=`, `<`, `>`, `<=`, `>=`) on the LHS of `&&` or
  `||`, or a compound `&&`/`||` chain whose leaves are comparisons,
  is now treated as a short-circuit guard. The RHS is still required
  to be mutation-free (no `=`, `+=`, `++`, `--`) so patterns like
  `file_size > 0 && buflen >= file_size && fseek(...)` and
  `arr->len == arr->cap && !growCapacity(arr)` are no longer flagged,
  while `p || (p = malloc(...))` and `a > 0 && ++count > 10` still
  trigger. Closes task 64.
- INT32-C: skip `sizeof(...)` arguments to `memcpy` / `memmove` /
  `memset` size positions. `sizeof(*ctx)` always yields `size_t` and
  has no signed overflow risk, but the text-based `contains_arithmetic`
  helper false-matched the `*` inside the sizeof. Closes task 66 item 1.

### Benchmark

- Juliet v0.3.97 → v0.3.98: **zero delta** across all 74 CWEs —
  TP 24,622, FP 14,226, TP rate 63.4% (unchanged). The EXP02-C guard
  extension and INT32-C sizeof skip target real-world idioms (sizeof
  in memset, compound comparison chains, equality-plus-call patterns)
  that Juliet does not exercise.
- Real-world v0.3.93 → v0.3.98: **−343 violations** (spans v0.3.94-
  0.3.98 work combined). INT32-C −239 is almost entirely v0.3.98's
  sizeof fix (v0.3.94-0.3.97 did not touch INT32-C); API00-C −111
  and INT31-C −2 come from tasks 68/69/62C. Per-project INT32-C
  deltas: sqlite −169, curl −67, mosquitto −3. MSC04-C +8 minor
  regression carried over from the v0.3.94-0.3.97 range.done2026-04-20T16:58:09Z2026-04-19T00:00:00Z2026-04-19T00:00:00Z�0d
+�9555Release v0.3.97### Changed

- API00-C: suppress `void *` / `const void *` parameters that are never
  dereferenced locally and only pass through to null-accepting stdlib
  sinks (free/realloc/cfree/Memory_Free/Memory_Realloc) or callees
  whose summary validates the argument. NULL is a valid value for
  generic-container slot parameters (e.g., `ArrayList_Append(self,
  void *item)`).

### Benchmark

- Juliet v0.3.96 → v0.3.97: TP 24,628→24,622 (-6), FP 14,238→14,226
  (-12). API00-C was the only affected rule (2.0:1 FP:TP ratio).
  CWE-476 (null deref) TP rate 58.9% → 59.6% (+0.7pp). Overall TP
  rate unchanged at 63.4%. Zero other-rule regressions.
- Real-world d_lib_common: API00-C 1 → 0 FP with
  suppressions stripped.done2026-04-20T16:58:09Z2026-04-19T00:00:00Z2026-04-19T00:00:00Z
�����3h
-�=555Release v0.3.101### Changed

- ENV33-C: walk the reverse call graph transitively in
  `callers_are_all_clean`. v0.3.100 only checked direct callers, which
  lost TPs on Juliet CWE-78 variants 52c/53d/54e where intermediate
  forwarding sinks are clean pass-throughs but a grand-caller holds the
  recv/fgets. BFS-style walk with a visited set guards against cycles.

### Benchmark

- Juliet v0.3.99 → v0.3.101: TP 24,590 → 24,478 (−112), FP 14,082 →
  13,632 (**−450**), TP rate 63.6% → **64.2%** (+0.6pp). ENV33-C is
  the only affected rule: TP 1550 → 1438, FP 500 → **50** — a
  **4.02:1 FP:TP ratio**, matching the PLAN.md task 49 projection for
  CWE-78 helper-sink suppression. CWE-78 TP rate 76.6% → **87.7%**
  (+11.1pp). Zero other-CWE regressions. The remaining 50 ENV33-C FPs
  are all v65b function-pointer variants where the call graph has no
  edge for `funcPtr(data)` — future work requires function-pointer
  call-graph edges (same limitation noted in task 49A).done2026-04-20T16:58:09Z2026-04-19T00:00:00Z2026-04-19T00:00:00Z�g
-�555Release v0.3.100### Changed

- ENV33-C: replace blanket "pointer parameter → flag" suppression
  with caller-aware lookup. When the containing function has
  pointer/string parameters and no direct taint-source call in its
  body, defer to the reverse call graph: suppress only when every
  caller's prescan summary shows both `has_env03_taint_source` and
  `returns_tainted` are false. Unknown callers stay flagging.
  Mirrors the ENV03-C task 68 pattern.done2026-04-20T16:58:09Z2026-04-19T00:00:00Z2026-04-19T00:00:00Z�f
+�555Release v0.3.99### Changed

- FunctionSummary: new `returns_tainted` bit and
  `returns_from_callees` set. Seeded in prescan from
  `has_env03_taint_source` on non-void returns, then propagated to
  fixpoint via a new `propagate_return_taint` pass so wrapper chains
  (`char *wrap() { return readIt(); }`) inherit a callee's taint bit.
  Same-named static merging ORs the new bits (mirrors the existing
  `has_env03_taint_source` merge).
- ENV03-C: extend `rhs_is_safe` with a `call_expression` arm. A
  `data = helper(...)` assignment is now treated as safe when
  `helper`'s summary is known and has neither
  `has_env03_taint_source` nor `returns_tainted`. Unknown callees stay
  conservative. Suppresses Juliet CWE-78 v42-style goodG2B(Source)
  patterns while still flagging the corresponding `data =
  badSource(...)` bad paths (badSource contains `recv`).
- INT31-C: `call_rhs_has_taint_source` now recognises callees whose
  summary has `returns_tainted` set. Catches transitive wrappers
  without requiring a direct taint-source call in the immediate
  callee's body.

### Benchmark

- Juliet v0.3.98 → v0.3.99: TP 24,622→24,590 (−32), FP 14,226→14,082
  (**−144**), TP rate 63.4% → **63.6%** (+0.2pp). ENV03-C is the only
  affected rule: TP 652→620, FP 468→**324** — a **4.5:1 FP:TP
  ratio**, the cleanest ratio for ENV03-C since task 67 (v0.3.94's
  4.1:1). CWE-78 TP rate 74.1% → **76.6%** (+2.5pp). CWE-426 side
  benefit: FP 188→164 (−24, 1:1 with TP drop). Zero other-rule
  regressions. INT31-C was neutral on Juliet — the transitive-wrapper
  pattern exists in real-world code but not in the Juliet v42 CWE-194/
  195 templates, which use direct taint-source calls inside their
  `badSource` helpers.done2026-04-20T16:58:09Z2026-04-19T00:00:00Z2026-04-19T00:00:00Z
RkR�j
-�555Release v0.3.103### Changed

- STR02-C: port the ENV03-C / ENV33-C caller-aware suppression template.
  When `system()` / `popen()` is called with a function parameter that's
  only tainted by the default "params are untrusted" rule — i.e. the
  enclosing body contains no direct taint-source call — walk the reverse
  call graph and suppress iff every transitive caller's summary shows
  `has_env03_taint_source` and `returns_tainted` both false. BFS with a
  visited set, matching the ENV33-C pattern that handles Juliet's
  variant 52c/53d/54e multi-level forwarding chains. New fields
  `function_summaries` + `callers` on `Str02C` populated from
  `ProjectContext.call_graph` in `set_project_context`.

### Benchmark

- Juliet v0.3.102 → v0.3.103: TP 24,542 → 24,518 (−24), FP 13,498 →
  **13,358** (−140), TP rate 64.5% → **64.7%** (+0.2pp). Zero
  other-CWE regressions; every non-CWE-78 cell in the delta report is
  exactly zero.
  - CWE-78 TP rate 90.3% → **94.8%** (+4.5pp). STR02-C FP 140 → **0**,
    TP 560 → 536 (−24). **5.83:1 FP:TP ratio** — best ratio so far in
    the CWE-78 taint-aware series (prior bests: 4.5:1 at task 49A, 4.1:1
    at task 67). STR02-C now contributes zero FPs to CWE-78; all 140
    remaining CWE-78 FPs are on ENV03-C (v42-style return-tainted
    helpers and v45 global-static pointer reads).
  - CWE-78 TP rate (94.8%) now exceeds clang-tidy's 91.6% shared-CWE
    average — CWE-78 is no longer a competitor-parity gap.
- Real-world (curl / sqlite / mosquitto / libcrc / hostap): not rerun.
  The change reuses existing `FunctionSummary` fields (no new summary
  bits, no schema change), so real-world behaviour matches v0.3.102
  which had zero delta from v0.3.98.done2026-04-20T16:58:09Z2026-04-19T00:00:00Z2026-04-19T00:00:00Z�i
-�{555Release v0.3.102### Changed

- prescan (`collect_callees`): resolve function-pointer aliases when
  building the call graph. The function body is now walked twice — the
  first pass captures `void (*fp)(char *) = target;` init declarators
  and `fp = target;` rebinds into a local alias map, the second pass
  emits callees with aliased identifiers rewritten to the target
  function. Juliet v65a/b sinks now surface a real caller edge instead
  of a dangling `funcPtr` entry.
- prescan (`has_env03_taint_source`): also match per-file macro aliases
  whose target is in `ENV03_TAINT_SOURCE_FUNCTIONS`. Juliet's
  `#define GETENV getenv` wrappers now correctly poison the caller's
  summary, so ENV03-C / ENV33-C / INT31-C caller-aware suppression
  treats `GETENV(ENV_VARIABLE)` as a real taint source.
- `function_summary::compute_summaries` gains a `taint_source_aliases`
  parameter plumbed through `analyze_function` and
  `collect_function_summaries`. Per-file alias collection in prescan
  (and header resolution) pre-filters aliases to those resolving to a
  taint source before calling summarize.

### Benchmark

- Juliet v0.3.101 → v0.3.102: TP 24,478 → **24,542** (+64), FP 13,632
  → **13,498** (−134), TP rate 64.2% → **64.5%** (+0.3pp). Zero
  other-CWE regressions.
  - CWE-78 TP rate 87.7% → **90.3%** (+2.6pp). ENV33-C FP 50 → **0**,
    TP 1438 → 1514 (+76). ENV03-C FP 324 → 300 (−24), TP 620 → 628
    (+8). 50 FP → 0 for variant 65b, plus +76 TPs recovered in other
    helper-sink variants where the bad caller used a macro-wrapped
    taint source (GETENV, FGETS, etc.) previously missed by the text
    scan.
  - CWE-194 TP rate 67.9% → **69.4%** (+1.5pp), FP −30, TP −10.
  - CWE-195 TP rate 51.9% → **52.5%** (+0.6pp), FP −30, TP −10.
  - INT31-C: FP 1452 → 1392 (−60), TP 2142 → 2122 (−20). 3:1 ratio.
- Real-world v0.3.98 → v0.3.102 (curl, sqlite, mosquitto, libcrc,
  hostap): zero delta. Change is Juliet-specific — these codebases
  don't use Juliet's function-pointer-across-files pattern or macro
  aliases that resolve to taint sources.done2026-04-20T16:58:09Z2026-04-19T00:00:00Z2026-04-19T00:00:00Z
[��[�Rn
o�955549G: ENV03-C v34 union-field-alias FP suppressionEliminated ~20 ENV03-C v34 FPs (OMITGOOD union-alias pattern). walk_for_taint case-insensitive for UPPERCASE macro aliases (GETENV->getenv). rhs_is_safe + walk_pointer_aliases handle dot field_expression. v0.3.107.done2026-04-22T19:22:42Z2026-04-22T19:22:51Z2026-04-22T19:22:51Z�Rm
o�955549G: ENV03-C v34 union-field-alias FP suppressionEliminated ~20 ENV03-C v34 FPs (OMITGOOD union-alias pattern). walk_for_taint case-insensitive for UPPERCASE macro aliases (GETENV->getenv). rhs_is_safe + walk_pointer_aliases handle dot field_expression. v0.3.107.done2026-04-22T19:22:38Z2026-04-23T15:04:45Z2026-04-23T15:04:45Z�-l
w�g55549E: ENV03-C v45 global-static pointer write trackingLast remaining major CWE-78 FP contributor (~140 FPs). Juliet v45 pattern: static global pointer is written in function A (good path: clean data) and read in function B (goodG2BSink pattern) before SYSTEM(data). Currently FPs because char *data = g_static is seen as untrusted identifier init. Fix: prescan collects writers of file-scope static variables, ENV03-C seeds clean globals (all writers have has_env03_taint_source=false AND returns_tainted=false) into safe_sources. Symmetric to caller-aware taint check but inverted (writers instead of callers).done2026-04-20T17:24:37Z2026-04-20T17:25:17Z2026-04-20T18:17:29Z�Hk
-�g555Release v0.3.104### Changed

- ENV03-C: extend caller-aware suppression to local command variables
  derived from a function parameter. When the `system()` / `popen()`
  argument is a local like `char *data = *dataPtr` (variant 63),
  `char *data = dataArray[2]` (variant 66), `char *data =
  myStruct.structFirst` (variant 67), or a chain through a cast such as
  `char **dataPtr = (char **)dataVoidPtr; char *data = *dataPtr;`
  (variant 64), walk writes to the command var and — if every write is
  derived via deref / subscript / field / cast from a function
  parameter (possibly through other parameter-derived locals) —
  reuse `callers_are_all_clean`. Suppress iff every caller's summary
  has `has_env03_taint_source` false. New helper
  `is_command_var_parameter_derived` + write-collection fixpoint.
- `function_summary::ENV03_TAINT_SOURCE_FUNCTIONS` and the matching
  scope-local list in `env03_c` now cover wide-character and Windows
  input equivalents: `fgetws`, `getwchar`, `getwc`, `fgetwc`,
  `wscanf`/`fwscanf`/`swscanf`/`vwscanf`/`vfwscanf`, `_getws`,
  `_getws_s`, `_wgetenv`, `_wgetenv_s`. Juliet's
  `wchar_t_console_*` / `wchar_t_file_*` variants read via `fgetws`;
  with these absent, the bad-path caller's summary was (incorrectly)
  clean and the new parameter-derived fix was over-suppressing the
  wchar_t bad-sink TPs. Mirrors the narrow-char coverage.

### Benchmark

- Juliet CWE-78 (single-rule ENV03-C measurement, prescan enabled):
  - Pre-change: 660 violations (520 TP / 140 FP, 78.8% TP rate).
  - Post-change: 680 violations (620 TP / 60 FP, **91.2% TP rate**).
  - FP −80, TP +100 — **0.8:1 FP:TP ratio** (net gain of TPs
    exceeds FPs eliminated). Both axes move in the right direction
    because the wide-char taint expansion recovers bad-path TPs that
    were previously silently suppressed by the clean-caller check.
  - Variant-level: v63/v64/v66/v67 FPs go to 0 each (80 FPs cleared);
    wchar_t bad-sink TPs (variants v01-v18, v21-v68) recover 4 each
    across ~25 variants.
  - Remaining 60 ENV03-C CWE-78 FPs: v34 (union field access, 20),
    v45 (static global pointer read, 20), v68 (extern global pointer
    read cross-file, 20). These need type-aware field analysis or
    global-write tracking, out of scope here.
- Full Juliet + real-world rerun deferred (changes reuse existing
  `FunctionSummary` fields; wide-char taint additions affect ENV33-C /
  INT31-C / STR02-C identically to ENV03-C but those are all
  conservative additions — a missing source was letting taint through).done2026-04-20T16:58:09Z2026-04-20T00:00:00Z2026-04-20T00:00:00Z
q�
a�+q�7s�-�C555INT32-C + INT10-C: gate sign-safety rules on operand signedness (unsigned types)INT32-C fires on unsigned int/u32/u16 operands (27 violations in e_bms_primcu3124_scud) — signed overflow rule should not fire on unsigned types. INT10-C fires on u16 modulo (16 violations) for the same reason: % on unsigned always yields non-negative. Same root cause: checkers do not verify operand signedness before firing. Also INT32-C fires on pointer arithmetic expressions (e.g. AFE_INT_EN+4) — need to gate on non-pointer integer types too. Fix: before firing either rule, confirm LHS operand resolves to a signed integer type.done2026-04-30T15:41:33Z2026-04-30T15:55:48Z2026-04-30T16:08:01Z� r��%555INT31-C FP reduction: conditional-branch goodG2B pattern (v08-v17, v6xb)Investigation of INT31-C remaining FPs in CWE-195 (690 FP) and CWE-194 (330 FP).

## Summary
Total INT31-C FPs: 1,248 (CWE-195: 690, CWE-194: 330, rest from other CWEs).
Callsite constant arg propagation (v0.3.115) did NOT help INT31-C — those goodG2B
cases were already handled by prior suppression (within-function VRA or taint-free).

## Top FP Variants (CWE-195 s01, local repro)
- v08: 34 FPs — staticReturnsFalse/staticReturnsTrue conditional branch
- v09: 28 FPs
- v10: 28 FPs
- v13: 24 FPs
- v11: 20 FPs, v14: 18 FPs, v17: 17 FPs, v45: 15 FPs
- v63b/v64b/v66b/v68b: 8-10 FPs each (void-ptr helper sink)

## v08 Pattern (most common)
  static void goodG2B1() {
      int data = -1;
      if (staticReturnsFalse()) { /* dead */ }
      else { data = 100-1; }   // data=99
      if (data < 100) {
          malloc(data);    // INT31-C fires here (FP)
          memset(buf, x, data-1);  // also fires
      }
  }

## Analysis
- Standalone file (no prescan): CLEAN — suppression works
- With full CWE-195 prescan (-d CWE195 dir): FPs fire on lines 161,164,187,190
- Suppression path: is_inside_upper_bound_guard() && var_is_taint_free()
  - upper_bound_guard: 'data < 100' should return true
  - var_is_taint_free: goodG2B1 has no taint source, data not from tainted call
  - Standalone: both true → suppress. With prescan: something breaks.
- SUSPECT: prescan cross-contamination. Multiple static goodG2B1 definitions
  OR-merged; if any has has_env03_taint_source=true, var_is_taint_free returns false.
  But checked: all goodG2B1 functions in CWE-195 use constant sources.
- NEXT: inspect why the prescan run breaks suppression. Add debug trace or
  check if find_enclosing_function fails (returns None → var_is_taint_free=false).
  Check lines 140-170 of connect_socket_malloc_08.c for exact context.
  Also check if 'data' missing from var_types when 'int data;' declared without init.

## Files
- src/rules/cert_c/INT/INT31-C/int31_c.rs: var_is_taint_free(), is_inside_upper_bound_guard()
- Juliet: ~/data/benchmarks/.../CWE195.../s01/*_08.cdone2026-04-30T11:20:20Z2026-04-30T11:20:35Z2026-04-30T15:55:45Z�q
�555Update task 18 investigation notes: MEM30-C item #8 fixed in v0.3.114done2026-04-28T18:59:56Z2026-04-28T19:00:02Z2026-04-28T19:00:02Z�5p
}�q55550G: ENV03-C uppercase macro constant safe strcpy sourcestrcpy/strcat second-arg check now accepts ALL_CAPS identifiers as compile-time macro constants. Eliminates 136 CWE-426 FPs (GOOD_OS_COMMAND pattern) + 84 spurious TPs. v0.3.109.done2026-04-23T17:44:45Z2026-04-23T17:44:52Z2026-04-23T17:44:52Z�do
M�555ENV03-C v68 extern global FP fixEliminate ~20 FPs in CWE-78 from Juliet v68 pattern (extern global pointer cross-file data flow). Fixed collect_static_pointer_globals to also track non-static extern-linkage pointer globals. With -d flag, goodG2BSink correctly suppressed. v0.3.108.done2026-04-23T13:56:29Z2026-04-23T13:56:40Z2026-04-23T13:56:40Z
�
�J�
���Vz�A�m555PRE10-C: recognize do-while(0) wrapper spanning multiple lines with backslash continuation1 FP in e_bms_primcu3124_scud — IO_F_mcu_pwm macro (bms.h:211) correctly wrapped in do{...}while(0) but sqc flags it as unwrapped. The do-while spans multiple lines using backslash continuation. Fix: parse multi-line macro body with backslash continuations before checking for do-while wrapper pattern.done2026-04-30T15:42:09Z2026-04-30T20:01:38Z2026-04-30T20:01:38Z�qy��K555FLP00-C: only fire on floating-point operands, not integer comparisons1 FP in e_bms_primcu3124_scud — if(da == 0xff) at comm.c:676 flagged as float equality. da is declared u8. Fix: FLP00-C should only fire when at least one operand of == is a floating-point type (float/double/long double).done2026-04-30T15:42:09Z2026-04-30T20:01:38Z2026-04-30T20:01:38Z�|x��e555MSC37-C: recognize post-loop unconditional return as valid exit path1 FP in e_bms_primcu3124_scud — cell_temp_interpolate() (comm.c:89) has unconditional return after for-loop (out-of-range case). sqc appears to miss post-loop return when loop body contains early return — may be treating post-loop code as unreachable. Fix: code after a for/while loop is reachable when loop condition is not guaranteed true on every iteration.done2026-04-30T15:41:49Z2026-04-30T20:01:38Z2026-04-30T20:01:38Z�-w��K555MEM05-C: verify actual call cycle exists before flagging recursion1 FP in e_bms_primcu3124_scud — SendDataLogging() (comm.c:225) flagged as recursive. It calls get_bms_data_log(), Cal_Crc(), SendData_IF() — none call back into SendDataLogging. Fix: confirm a call chain from the flagged function back to itself actually exists before firing MEM05-C.done2026-04-30T15:41:49Z2026-04-30T20:01:38Z2026-04-30T20:01:38Z�
v�O�5EXP33-C + ARR00-C: cross-function output-buffer fill pattern (non-const ptr + return-value guard)2 EXP33-C + 8 ARR00-C violations in e_bms_primcu3124_scud at same sites (I2C.c:398,431). ReadBuf[] passed to I2CRead() as output buffer (non-const ptr); only read inside if(ret==1) where ret is I2CRead() return value. sqc cannot track interprocedural fill. Partial fix: when array passed as non-const ptr arg and its subsequent read is guarded by the callee's return value, reduce EXP33-C confidence. Also: ARR00-C and EXP33-C fire on same sites — avoid reporting two rules on the same uninitialized-buffer pattern.pending2026-04-30T15:41:49Z�3u��I555MEM30-C: gate stack-escape check on pointer/array type of assigned global18 FPs in e_bms_primcu3124_scud — scalar integer assignments to globals (timer counters, state vars) inside HAL_ENTER_CRITICAL_SECTION blocks misidentified as stack pointer escapes. Fix: only fire MEM30-C stack-escape when the global's declared type is a pointer or array type. If global is scalar integer (u8/u16/u32/int/uint8_t etc.), do not fire. Note: currently suppressed via project config as a workaround.done2026-04-30T15:41:49Z2026-04-30T16:08:01Z2026-04-30T16:08:01Z�}t�=�?555DCL07-C + DCL31-C: follow #include chain for declarations; recognize compiler intrinsics374 duplicate violations (187 each) in e_bms_primcu3124_scud. Two sub-patterns: (A) Holtek compiler built-ins _nop()/_clrwdt() have no standard header — need configurable intrinsics list per target; (B) functions declared via extern in #included headers are still flagged because sqc does not resolve #include chains when checking for prior declarations. Also: DCL07-C and DCL31-C appear to check the same condition and fire on identical sites — consider deduplication.done2026-04-30T15:41:33Z2026-04-30T16:08:01Z2026-04-30T16:08:01Z
��
����1�M5Develop a sound evaluation methodology for concurrency rules (CON03/CON07/CON33-C)CWE-377 (CON33-C) sits at 3% TP rate and CWE-366 (CON07-C) at 8% — race conditions are structurally beyond intra-procedural static analysis. Rather than spending fp-reduction effort here, demote both to manual-review severity or disabled-by-default in the TOML. Also cleans up headline precision honestly. Note d5e6a286 already cut their FP rates from 97%/87%, but the remaining signal is still too weak to report by default.
Catapult audit update (2026-06-17, DB_UPDATE.md): New CON03-C data — sqc's CON03-C heuristic flags ALL file-scope statics in any TU containing a function named IRQ/interrupt/ISR, without checking whether the ISR can reach the flagged var. Catapult RC624 firmware: ~130 CON03-C FPs (76% of 176). No call graph for ISR reachability. CON07-C: ~52 FPs (80% of 65), same root cause (main-loop-only functions flagged because file contains an ISR). Combined ~182 Medium FPs from one root cause (no ISR reachability). Options: A demote/disable (loses 8-24% signal); B ISR call-graph reachability (preserves ~26 CON07-C + ~46 CON03-C genuine hits). Catapult's high MCU FP rate strengthens B. Note: DEV_APPROX_IRQProcess has 'IRQ' in name but is a main-loop poller — name matching alone insufficient; need vector-table / indirect-call analysis.

--- 2026-06-21 RE-CHARACTERIZED (owner) ---
SCRAPPED the original demote/disable framing. Two corrections:
  1. The `severity = "Medium"` on CON07-C/CON33-C/CON03-C is lifted
     verbatim from the CERT-C wiki risk-assessment table (e.g. CON07-C
     line 102: "CON07-CMediumProbableYesNoP8L2"). That is CERT's
     authoritative rating, NOT ours to demote. Demoting severity would
     misrepresent the standard.
  2. Do NOT disable the rules. They stay enabled at their CERT severities.

NEW GOAL (research/discovery only — do NOT implement yet):
  Figure out how to PROPERLY EVALUATE the concurrency rule runs. The 3%
  (CON33-C) / 8% (CON07-C) "TP rates" are suspect as a measure of rule
  quality: race-condition rules are structurally hard for both static
  analysis AND for ground-truthing. Before spending FP-reduction effort,
  establish whether the weak numbers reflect bad rules or an inadequate
  evaluation harness/oracle for concurrency.

  Discovery questions to answer (later):
   - Is there a concurrency-appropriate ground-truth corpus (Juliet
     CWE-366/367/377/362/364 templates? a thread-aware oracle?) vs the
     current intra-procedural scoring that may not credit valid hits.
   - The Catapult MCU finding (no ISR reachability => ~182 Medium FPs from
     one root cause) suggests the FP signal is concentrated and
     characterizable, not random noise — quantify that before judging.
   - What would a defensible precision/recall number for these rules even
     look like, and what harness produces it.

  Deliverable for this task = a written evaluation plan, not code. Once we
  have the plan, implementation (e.g. ISR call-graph reachability, the old
  "Option B") becomes its own follow-on task. Lowered to P4: park until the
  backlog thins (per task-150 standing guidance: no big infra bets now).pending2026-06-10T12:32:58Z�q��I�e5Paper: quarantine Juliet-specific tuning and hedge the 100%-precision claims (CWE-78, CWE-690)ENV03-C contains explicitly Juliet-tuned logic (goodG2BSink pattern, Juliet v34/v42/v45 handling in env03_c.rs); STR31-C hardcodes the Juliet memset(buf,'A',N) idiom. (1) Mark these in code comments as benchmark-idiom handling where not already done. (2) The 100%-precision/0-FP claims on CWE-78 (taint) and CWE-690 (inter-procedural null) are suspicious as generalization claims — hedge them in the paper, or back them with real-world evidence from the task-148 audit if it validates them.pending2026-06-10T12:32:58Z
�
��	��d��)�#	555Real-world ground-truth (TP reference) databases for measured precision/recallBuild a curated, versioned ground-truth label set per real-world codebase (libcrc, mosquitto, curl, sqlite, hostap) — the real-world analog to Juliet's OMITBAD/OMITGOOD oracle — so we can compute ACTUAL precision/recall on real code over time instead of only volume reductions and one-off sampled audits.

Motivation: the v0.4.22 sampled precision audit (data/precision_audit/) showed measured real-world precision for the noisiest rules is ~2-34% (combined ~10.5%), a gap Juliet's synthetic tests do not predict. Reference: 'Juliet is a rough approximation, not a proxy' principle now in the paper. A standing labeled corpus turns ad-hoc adjudication into a regression metric.

Scope:
1. Schema: add ground-truth tables to data/benchmarks.db keyed by (project, codebase_commit, file, line, rule_id/cwe_id) with a verdict (TP/FP/uncertain), adjudicator, reason, and date. Pin to codebase_commit (now captured per realworld_results row) so labels stay valid only for the revision they were judged against.
2. Seeding: import the 200 adjudicated findings already in data/precision_audit/adjudication_0.4.22.csv as the first labels; design so future sampled audits append rather than replace.
3. Scoring: a bench command (e.g. 'python -m bench realworld-score RUN_ID') that joins a run's realworld_violations against the ground-truth labels for the matching codebase_commit and reports measured precision (and recall over labeled TPs) per rule and overall, with a warning when a run's codebase_commit has no labels.
4. Provenance: reuse the codebase_commit capture (commit e9957b77); only score label-vs-run pairs on identical commits.
5. Stretch: confirmed-TP labels can seed a real-world regression-detection set (alerts if a known true bug stops being flagged), and uncertain/disputed labels feed a re-adjudication queue.

Relationship to other tasks: complements the sampled audit feeding tasks 140/142/143/146; over time this becomes the primary real-world quality signal alongside Juliet.done2026-06-11T12:22:56Z2026-06-11T15:32:16Z2026-06-11T17:38:16Z�1�
_�		555Trim benchmark MCP server token footprintObservation (2026-06-11): the juliet-benchmark and realworld-benchmark MCP servers contribute disproportionately to Claude's token usage — the opposite of their intent. Root cause is verbose JSON payloads returned whole into context. Worst offenders: (1) list_runs dumps ALL runs (121+) with every field — a single call is ~8-10K tokens when the caller usually wants just the latest run name; add limit/since/latest params and a compact mode. (2) get_status re-emits recent-CWE detail on every poll; over a ~15-min run that compounds. (3) compare_runs/get_cwe_detail return deep nested breakdowns even when a few scalars are wanted. Explore: default-compact responses, pagination/limit params, a 'fields' selector, and returning answer-shaped summaries instead of raw tables. Files: mcp_servers/server.py (+ realworld server).done2026-06-11T13:34:58Z2026-06-11T15:12:40Z2026-06-11T15:22:33Z�Z���{5Shared iterative AST walker for rule check() implementationshostap hostapd/config_file.c (multi-thousand-deep else-if chain) overflowed the stack in ARR00-C, MEM33-C (collect + check passes); fixed those individually in v0.4.22 (commit 1c94dc95) by converting to explicit-stack pre-order walks. ~252 rule files still share the self-recursive check pattern and are one deep input away from the same crash. Provide a shared iterative pre-order walker (e.g. in src/analyze/ or rules common) and migrate rules, or at minimum the rules enabled in rules-benchmark.toml.pending2026-06-10T20:17:54Z


�r�(�U�]	5Fix call-graph function-boundary corruption from #ifdef-spanning brace mismatch (task 267 follow-up)prescan.rs's collect_call_graph()/process_file() determine a function's
extent from tree-sitter's function_definition node span. When a function
body contains a brace whose open and close fall in different branches of the
same repeated #ifdef/#ifndef guard (e.g. sqlite prepare.c's xAuth
save/restore: opens under `#ifndef SQLITE_OMIT_AUTHORIZATION`, closes under a
second `#ifndef SQLITE_OMIT_AUTHORIZATION` a few lines later), sqc's
preprocessor-less tree-sitter parse can't reconcile it: it emits a local
ERROR node and the enclosing function_definition never closes, silently
swallowing every subsequent sibling function in the file as descendants.

Confirmed impact (see task 267 for the sqlite3Init/sqlite3InitOne repro):
- The swallowing function's callee set becomes the union of every call
  expression in ALL the functions it accidentally swallowed -- observed
  producing a false MSC04-C indirect-recursion cycle
  (sqlite3Init -> sqlite3InitOne -> sqlite3Init) in sqlite/src/prepare.c.
- Every swallowed function gets ZERO entry in the global call graph
  (collect_call_graph only matches function_definition via direct child
  iteration, never re-descends into an already-matched one), so it's
  invisible to every interprocedural rule keyed on call_graph or
  function_summary (MSC04-C, EXP34-C, MEM30/31-C, null-state, taint) for as
  long as it lives in the same file after the swallowing function -- a
  silent FN risk, not just the one FP this surfaced.

Scope (ad hoc scan: function_definition nodes containing a nested
function_definition descendant -- impossible in valid C, a reliable
tripwire): libcrc 0/16 files, sqlite 19/312, mosquitto 0/384, curl 15/696
(mostly tests/unit/*.c unity-macro harnesses -- lower real-world stakes),
hostap 18/504 (src/fst/fst_ctrl_iface.c and others). Reproducible on 3 of 5
realworld corpora; likely present in some Juliet cases too (not yet checked).

Fix direction: add the same invariant-violation guard already used for the
DCL00-C ERROR-root fallback (see mem file
dcl00-scope-mutation-and-error-root.md) -- detect when a function_definition
subtree contains a nested function_definition descendant and treat it as a
corrupted parse: either truncate the outer function's callee/summary
extraction to stop at the first nested function_definition, or register each
nested function_definition at its own top level and exclude its content from
the outer (swallowing) function's summary. Needs a regression fixture (a
prepare.c-style #ifdef-spanning-brace snippet) plus a Juliet + realworld
gate (sqlite/curl/hostap should all show zero swallow-hits after the fix;
recall must hold or improve, not regress).pending2026-07-06T17:16:30Z
�E�*��=5Evaluate whether ratatui/crossterm TUI dependency still earns its keepPrompted by noticing tools_sqc's heavy transitive dependency tree (ratatui,
crossterm, plus rfd -> ashpd/zbus for native file dialogs) while diagnosing
a full disk from accumulated build artifacts. Owner's instinct: sqc's
primary real-world usage is CI/CD and ad-hoc terminal runs (benchmark
harness, MCP servers, one-shot scans), not the --interactive TUI mode.

Current state: src/ui/mod.rs (2873 lines) implements a real ratatui
TerminalUI gated behind --interactive in main.rs, not dead code -- so this
isn't a "delete unused code" task, it's a "is this feature worth its
dependency weight" question.

Evaluate:
1. Actual usage: does anyone (owner, any documented workflow) use
   --interactive today, or has it been superseded by the benchmark
   dashboard / MCP tools / CLI output? Check git log / commit messages for
   any recent TUI-mode work as a signal of active use.
2. Dependency cost: ratatui + crossterm p�p�)�K�555Migrate tools_sqc call-graph construction to lang_parsing_substrate::calls (task 296 follow-up)Task 296 fixed the has_error()-gated corruption guard in BOTH tools_sqc's
own prescan.rs::collect_call_graph AND lang_parsing_substrate::calls (0.1.8/
0.1.9), because tools_sqc doesn't consume the substrate for call-graph
construction yet -- it still has its own hand-rolled walk. This task is
about actually finishing that consolidation ("fix it once"), not just the
duplicate bugfix.

Blocker (the real reason this isn't a same-day swap): lang_parsing_substrate
::calls has NO function-pointer alias resolution. tools_sqc's own
collect_fn_ptr_aliases/rhs_target_function_name resolves
`void (*fp)(...) = target; fp(x);` to a callee edge on `target` --
recall-relevant for cross-file Juliet v65a/b patterns (INT31-C and others).
A blind swap would silently regress that. Needs porting upstream first
(generalized across languages, or scoped to function_definition like the
error-recovery-debris guard was, if the pointer-alias pattern doesn't
generalize cleanly to closures in other languages).

Bonus found while scoping this: the substrate's is_macro_function_definition
filter (skips macro-invocation-shaped pseudo-functions matching a
parenthesized_declarator) has NO equivalent in tools_sqc's own
collect_call_graph today -- migrating would incidentally fix a latent gap,
not just consolidate code.

Plan:
1. Port fn-ptr alias resolution into lang_parsing_substrate::calls (own
   PR/version bump there, with tests).
2. Swap tools_sqc's collect_call_graph/collect_callees for
   lang_parsing_substrate::calls::call_edges + a thin adapter to the
   HashMap<String, HashSet<String>> shape callers expect (context.rs,
   MSC04-C, INT31-C, STR02-C, ENV03-C, ENV33-C).
3. Gate the cutover on Juliet (recall must hold or improve, never regress)
   + realworld FP/TP diff (sqlite/curl/hostap should be byte-identical
   except for the two known latent-gap fixes: macro-pseudo-function
   filtering and any residual fn-ptr-alias parity issues, which should be
   diffed and understood before merging, not just accepted blind).
4. Once cut over, delete the now-dead hand-rolled collect_call_graph/
   collect_callees/collect_fn_ptr_aliases/is_c_keyword from prescan.rs.

--- 2026-07-06 COMPLETE ---
Ported fn-ptr alias resolution into lang_parsing_substrate::calls (0.1.10,
commit 5435ca1, pushed+tagged+published). Migrated tools_sqc's
collect_call_graph to a thin adapter over calls::call_edges (commit
2220dc55, ~280 lines of hand-rolled walk deleted). Gate: Juliet
byte-identical (0 TP/FP delta, all 74 CWEs); realworld clean-to-small
except curl(+41)/lua(+37) MSC04-C, verified additive-only (0 removed) and
traced to a pre-existing cross-TU same-named-static merge behavior now
surfaced more completely by the substrate's more-thorough traversal --
filed separately as task 299 (not a regression). tools_sqc now pins the
real published 0.1.10 (commit bc09ebac), no local path patch.done2026-07-06T19:37:36Z2026-07-06T20:09:00Z2026-07-06T21:23:09Z
����E�*��=5Evaluate whether ratatui/crossterm TUI dependency still earns its keepPrompted by noticing tools_sqc's heavy transitive dependency tree (ratatui,
crossterm, plus rfd -> ashpd/zbus for native file dialogs) while diagnosing
a full disk from accumulated build artifacts. Owner's instinct: sqc's
primary real-world usage is CI/CD and ad-hoc terminal runs (benchmark
harness, MCP servers, one-shot scans), not the --interactive TUI mode.

Current state: src/ui/mod.rs (2873 lines) implements a real ratatui
TerminalUI gated behind --interactive in main.rs, not dead code -- so this
isn't a "delete unused code" task, it's a "is this feature worth its
dependency weight" question.

Evaluate:
1. Actual usage: does anyone (owner, any documented workflow) use
   --interactive today, or has it been superseded by the benchmark
   dashboard / MCP tools / CLI output? Check git log / commit messages for
   any recent TUI-mode work as a signal of active use.
2. Dependency cost: ratatui + crossterm pull their own tree; is rfd's
   native-file-dialog stack (ashpd/zbus, only relevant if the TUI has a
   file picker) coupled to the same feature or independently needed?
3. If low/no real usage: options are (a) delete the TUI and --interactive
   flag entirely, (b) move it behind a Cargo feature flag (off by default)
   so CI/CD and MCP-server builds skip compiling it, or (c) keep as-is if
   there's a real use case this would break.
4. Not just ratatui -- worth a broader one-time dependency audit while in
   there (cargo tree, cargo-udeps) since this is the kind of thing that
   compounds silently (contributed to a 186GB target/ dir before cargo
   clean, per this session's disk-full incident).pending2026-07-06T20:25:35Z�]�+�#�c5MSC04-C cross-TU static-name-collision noise surfaced by task 297 migrationTask 297's Juliet+realworld gate for migrating tools_sqc's collect_call_graph
onto lang_parsing_substrate::calls came back byte-identical on Juliet (0
TP/FP delta, all 74 CWEs) and clean-to-small on realworld (hostap +1,
sqlite +2, libcrc/mosquitto/raylib untouched) -- except curl (+41) and lua
(+37) MSC04-C counts, which grew more than expected.

Root cause (verified, not a regression): the call graph merges same-named
`static` functions across every scanned file into ONE entry
(call_graph.entry(caller).or_default().extend(callees) -- both the old
hand-rolled prescan.rs code and the new substrate code do this, comment
predates task 297: "multiple files can each define a static function with
the same name"). curl's docs/examples/ has several near-identical example
programs (ephiperfifo.c, evhiperfifo.c, ghiper.c, hiperfifo.c, ...) each
defining their own `static void timer_cb(...)` / `static void
check_multi_info(...)`. Because the substrate's collect_functions always
fully recurses (vs. the old code's narrower selective recursion into only
preproc_*/linkage_specification/declaration_list wrappers), it now finds
and merges more of these same-named statics, producing more spurious
cross-file MSC04-C indirect-recursion cycles.

Confirmed additive-only: 0 REMOVED violations in either project, every
ADDED entry has a real function name and a structurally coherent (if
ultimately wrong) call chain -- not parser debris. This is the SAME root
cause already tracked for STR31/EXP33's "static-global (45)" cross-function
FP bucket in task 203, not a new problem class.

Fix direction: scope call-graph merges per translation unit (keep the
merge for genuine same-named statics only when analysis actually needs
cross-file linking, e.g. via file-path-qualified keys, falling back to
bare-name merge only for non-static/externally-linked functions) rather
than merging every static by bare name globally. Low priority: this is a
precision/noise issue on an already-known FP bucket, not a correctness or
recall risk.pending2026-07-06T21:06:38Z
	�~����\���'	555Re-clear knots complexity gate after wheel-edition upgrade (v1.13.1)Switching the pre-commit knots hook from the git repo (v1.8.2) to the PyPI wheel edition (knots-pre-commit v1.13.1, commit e4319c81) changed/tightened the AIRD scoring engine and surfaced 26 new AIRD>85 violations across rule implementations, core analysis infra, and two Python scripts, beyond the 3 already fixed in this session (prescan.rs collect_assignments_recursive/collect_calls_with_locals, exp33_c.rs is_read_context). Mirrors the prior task 250 pattern (subtasks 240-249). Tackle subtasks one at a time; several touch rule logic / core analysis (null_state, init_state, value_range, const_eval) so run a Juliet (+ realworld) benchmark after those land to confirm no detection drift before considering this closed. DoD: pre-commit run knots --all-files exits 0 repo-wide; cargo test + clippy + fmt clean; benchmark shows no regression.done2026-07-05T22:06:58Z2026-07-05T23:16:07Z2026-07-05T23:16:07Z�D�
e�'555Refactor render_violations_tab below AIRD 85src/ui/mod.rs:810 — render_violations_tab, AIRD 96 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:21Z2026-07-05T22:13:24Z2026-07-05T22:21:13Z�s�
y�q555Refactor check_return_pointer_arithmetic below AIRD 85src/rules/cert_c/ARR/ARR30-C/arr30_c.rs:2188 — check_return_pointer_arithmetic, AIRD 86 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:21Z2026-07-05T22:13:21Z2026-07-05T22:13:21Z�_�
e�]555Refactor check_array_subscript below AIRD 85src/rules/cert_c/ARR/ARR30-C/arr30_c.rs:1858 — check_array_subscript, AIRD 96 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:21Z2026-07-05T22:07:46Z2026-07-05T22:13:21Z��5�S5Review MSC04-C recall improvement: sqlite3Init indirect-recursion cycle now detectedDuring task 153 batch-4 QA (v0.4.77 realworld benchmark vs v0.4.76 baseline), found +2 MSC04-C violations, both traced and confirmed as genuine recall improvements from the substrate::query migration, not regressions:

1. hostap wpa_supplicant/binder/binder_manager.h:30 -- C++ header misparsed by the C grammar; old pruning-based walk_node skipped a self-reference that the new flat traversal now finds.
2. sqlite src/prepare.c:438 -- a REAL indirect-recursion cycle (sqlite3Init -> sqlite3InitOne -> sqlite3Init) that the OLD walk_node never detected. Verified by instrumenting both pre- and post-migration binaries: old code never eve�v��5�9555Review MSC04-C recall improvement: sqlite3Init indirect-recursion cycle now detectedDuring task 153 batch-4 QA (v0.4.77 realworld benchmark vs v0.4.76 baseline), found +2 MSC04-C violations, both traced and confirmed as genuine recall improvements from the substrate::query migration, not regressions:

1. hostap wpa_supplicant/binder/binder_manager.h:30 -- C++ header misparsed by the C grammar; old pruning-based walk_node skipped a self-reference that the new flat traversal now finds.
2. sqlite src/prepare.c:438 -- a REAL indirect-recursion cycle (sqlite3Init -> sqlite3InitOne -> sqlite3Init) that the OLD walk_node never detected. Verified by instrumenting both pre- and post-migration binaries: old code never even invoked check_function on sqlite3Init at all. Root cause: old walk_node matched on node.kind()=="function_definition" and did NOT recurse into a matched nodma` was last written elsewhere)
  - Function-pointer cross-file calls (v65a/b, v67 variants — no
    call-graph edge for `funcPtr(data)`)
  - Extend the same clean-callee `rhs_is_safe` pattern to ENV33-C —
    same template as ENV03-C, likely similar 4:1 ratio (~500 FP
    candidates).
  - CWE-89 sinks: add SQL injection entry points (sqlite3_exec,
    mysql_query, PQexec) and the STR02-C or a new taint-sink rule.

Rule candidates that would benefit from the existing taint bits once
integrated: FIO30-C, STR02-C, FMT variants for format-string injection.

This task stays open as the coordinating umbrella; individual
rule-integration rounds are tracked as follow-ons to tasks 68/69/49A.


## Sub-task 113 — ENV03-C macro-value path check + CWE-426 caller-aware (DONE v0.3.113)

Replace ALL-CAPS heuristic in check_writes with macro-value absolute-path check
(is_safe_command_macro): GOOD_OS_COMMAND=/usr/bin/ls is safe, BAD_OS_COMMAND=ls is not,
and argument fragments like SAFE_CMD_ARGS=" -la" are also safe to strcat.
Add collect_string_literal_macros / is_safe_command_macro / is_relative_command_macro
to const_eval.rs; handles wide-string L"..." macros.
Add FunctionSummary.has_relative_command_write prescan bit: set when a function calls
strcpy/strcat with a macro expanding to a known relative-path command string.
callers_are_all_clean and call_is_clean now gate on both has_env03_taint_source AND
has_relative_command_write, blocking CWE-426 bad callers from passing the clean check.

Results: CWE-426 0 TP -> 132 TP / 0 FP; CWE-78 unchanged (2810 violations, 0 FPs).

Original status line: partial (v0.3.94-0.3.113 — tasks 67-69 + 49A/49B/49C/49D/113 delivered)

## Sub-task 115+116 — INT32-C/INT30-C goodG2B caller constant arg propagation (DONE v0.3.116)

Root cause: VRA initializes function parameters with full type range (e.g. [INT64_MIN, INT64_MAX])
even when ALL callers pass the same safe constant (e.g. data=2). So goodG2BSink(data=2) still
triggered data+1 may overflow because VRA could not prove the value was safe.

Fix (v0.3.115): Added callsite_param_const_int to FunctionSummary. prescan now walks each
function body to collect constant call-site arguments via collect_callsite_int_args_from_tree.
Two invalidation mechanisms: (1) pointer_expression &var in a call invalidates the variable
(fscanf pattern); (2) any non-literal assignment (data=LLONG_MAX, data=rand()) invalidates
the variable (v0.3.116 fix). aggregate_callsite_int_args stores param->const only when ALL
call sites agree. VRA then seeds [v,v] instead of full range. compute_vra_if_needed in
mod.rs runs this for same-file scans too.

v0.3.115 had TP -171 / FP -228 (+0.30pp) due to data=0LL followed by data=LLONG_MAX
leaving data=0 in map; v0.3.116 fixes by invalidating on any non-literal RHS assignment.

v0.3.116 CONFIRMED results (vs v0.3.114 baseline):
  Overall: TP +0 / FP -228 / TP rate +0.40pp — zero TP regression
  CWE-190 INT32-C: TP 1421->1421 (+0), FP 999->909 (-90)
  CWE-190 INT30-C: TP 403->403 (+0),  FP 291->261 (-30)
  CWE-191 INT32-C: TP 1151->1151 (+0), FP 810->738 (-72)
  CWE-191 INT30-C: unchanged
  CWE-369 / CWE-680: FP -24 / -12, TP +0 each (side benefit)
  228 FPs eliminated with no TP regression.

Status line update: v0.3.94-0.3.116
2026-06-10: paused pending ceiling decision (task 150). CWE-78 at 94.8% already exceeds clang-tidy; remaining residue (v42 return-tainted data=helper(data) chains, v45 global-static pointer reads, CWE-89 SQL sinks) is deliberately on hold until the post-75% strategy is decided from the task-148 real-world audit data.

--- 2026-07-03 UPDATE ---
Task 150 resolved 2026-06-18 — owner decided NOT to invest in major infra
(alias analysis/SSA-lite); proceed tackling backlog issues as they arise
instead. This task's "paused pending 150" note above is therefore stale
as of that date. Remaining scope (v42 return-tainted data=helper(data)
chains, v45 global-static pointer reads, CWE-89 SQL sinks) is unblocked
but stays P4 — pick up opportunistically, not urgent.partial2026-04-20T16:45:55Z2026-04-20T16:45:55Zke `GETENV(data)` etc. didn't poison the caller's
    summary, so helper-sink suppression over-applied.
  - ENV03-C: FP 324 → 300 (−24), TP 620 → 628 (+8). Clean win from the
    same macro-alias recognition.
  - INT31-C: FP 1452 → 1392 (−60), TP 2142 → 2122 (−20). CWE-194 TP
    rate +1.5pp, CWE-195 +0.6pp.

Real-world (curl / sqlite / mosquitto / libcrc / hostap): zero delta
v0.3.98 → v0.3.102. The fix is Juliet-specific — function-pointer
tables in real-world code don't match Juliet's helper-sink shape, and
no real-world codebase in the set macro-wraps a taint source.

Remaining CWE-78 gap (~280 FP across ENV03-C 300 + STR02-C 140): v42
return-tainted `data = helper(data)` chains and v45 global-static
pointer reads still need return-value propagation and global-write
tracking respectively. The function-pointer edge lands variant 65;
variant 67 wasn't in the measured FP contributors this round.

## Sub-task 49D — STR02-C caller-aware suppression (DONE v0.3.103)

Port the ENV33-C task 49B template to STR02-C. Previously STR02-C
tainted every parameter by default ("params are external input") and
flagged any `system()` / `popen()` whose arg resolved to a tainted
variable — so every Juliet `_goodG2BSink(char *data) { popen(data); }`
produced an FP. New gate: suppress iff (a) the arg is a function
parameter, (b) the enclosing body has no direct taint-source call,
and (c) every transitive caller's summary has both
`has_env03_taint_source` and `returns_tainted` false. BFS with
visited-set handles variants 52c/53d/54e exactly like ENV33-C.

Threading the scope required passing `func_scope: &Node` through
`check_sinks` → `check_dangerous_function_call` →
`check_command_injection_risk`; `check_single_function` seeds it
from the current `function_definition`.

Reused existing infrastructure: STR02-C now owns a
`function_summaries` + `callers` RefCell pair populated from
`ProjectContext.call_graph` in `set_project_context`. No new summary
bits needed — the `has_env03_taint_source` + `returns_tainted` pair
from v0.3.99 / v0.3.102 covers exactly the shape STR02-C wants.

Results: Juliet TP 24,542 → **24,518** (−24), FP 13,498 → **13,358**
(−140), TP rate 64.5% → **64.7%** (+0.2pp). **5.83:1 FP:TP** — best
ratio in the task 49 series so far (prior bests 4.5:1 at 49A, 4.02:1
at 49B, 4.1:1 at task 67). Zero other-CWE regressions.
  - CWE-78 TP rate 90.3% → **94.8%** (+4.5pp). STR02-C FP 140 → **0**,
    TP 560 → 536 (−24). STR02-C now contributes zero FPs to CWE-78.
  - CWE-78 TP rate (94.8%) now **exceeds clang-tidy's 91.6%** on the
    overlapping-CWE competitor benchmark — CWE-78 is no longer a
    parity gap.
  - Remaining 140 CWE-78 FPs are all on ENV03-C: v42-style
    `data = helper(data)` chains (return-tainted propagation) and v45
    global-static pointer reads. STR02-C structurally can't hit these
    because its taint tracking starts from "params = tainted" rather
    than from externally-read buffers.

Real-world: not rerun. No new `FunctionSummary` fields; STR02-C
consumes the same bits that v0.3.102 already populates.

## Sub-task 49B — ENV33-C caller-aware suppression (DONE v0.3.101)

ENV33-C FP 500 → **50** (−450), TP 1550 → 1438 (−112). **4.02:1
FP:TP** — matches the task 49 umbrella 4:1 projection. CWE-78 TP
rate 76.6% → **87.7%** (+11.1pp). Zero other-rule regressions.

Approach: mirror the ENV03-C task 68 / 49A pattern. Replace the
blanket "pointer parameter → flag" check with a caller-aware
transitive walk of the reverse call graph. Suppress iff every
reachable ancestor's summary has both `has_env03_taint_source` and
`returns_tainted` false. BFS with a visited set handles cycles and
multi-level forwarding chains (Juliet variants 52c/53d/54e have
intermediate clean pass-through sinks whose grand-caller holds the
recv/fgets).

Remaining gaps for CWE-78 (~50 ENV33-C FPs, plus ~324 ENV03-C FPs
and 140 STR02-C) and CWE-194/195 (~1224 INT31-C FPs):
  - Global/static pointer read tracking (v45-style `char *data =
    g_goodG2BData;` where `g_goodG2BDate's own children, which silently drops sibling functions whenever the parser's brace-tracking gets confused by a preceding construct (same class of bug as ARR38-C/MEM01-C's flagged pruning, but MSC04-C wasn't flagged for it during the batch-4 review since the bug wasn't caught there).

Needs manual review: (a) confirm the sqlite3Init cycle is a legitimate true positive worth surfacing generally (not just a real-world benchmark artifact), (b) spot-check whether other real-world/Juliet runs show similar previously-silent MSC04-C misses now surfaced elsewhere, (c) decide if this warrants a CHANGELOG/RESULTS note since it changes real-world FP/TP counts outside the task-153 migration's intended no-op scope.

--- 2026-07-06 REVIEW: correcting the finding ---
The sqlite3Init cycle is NOT a genuine recall improvement -- it's a NEW false
positive from a call-graph construction bug, unrelated to the walk_node
pruning class this task suspected.

Root cause (confirmed via a throwaway `CParser` dump of prepare.c's function
spans): sqlite3InitOne's body has a brace that opens under one
`#ifndef SQLITE_OMIT_AUTHORIZATION` branch and closes under a second,
identical `#ifndef SQLITE_OMIT_AUTHORIZATION` re-guard a few lines later
(prepare.c:367-378, the xAuth save/restore around sqlite3_exec). sqc has no
real preprocessor (raw tree-sitter), and tree-sitter-c can't reconcile that
brace pairing -- it emits an ERROR node at line 377 and the enclosing
`sqlite3InitOne` function_definition never closes normally. It extends from
line 199 all the way to line 1093 (EOF of the file's function region),
nesting EVERY subsequent function in the file as descendants: sqlite3Init,
sqlite3ReadSchema, schemaIsValid, sqlite3Prepare, sqlite3Prepare16, etc.

prescan.rs's collect_call_graph() walks each function_definition's full
subtree for call_expressions and assigns them all to that function's name.
Because sqlite3InitOne's subtree now contains the whole rest of the file, its
callee set becomes the union of ~70 functions' calls -- including the literal
`sqlite3Init(db, ...)` call that lives inside the (swallowed) sqlite3ReadSchema
body. That union edge is what MSC04-C's DFS walks to build the false
"sqlite3Init -> sqlite3InitOne -> sqlite3Init" cycle.

Worse: collect_call_graph only matches function_definition at each level of a
plain child iteration (recursing only into preproc_*/linkage_specification/
declaration_list) -- it never revisits nodes it already classified as
function_definition. So every function swallowed this way (sqlite3Init,
sqlite3ReadSchema, sqlite3Prepare, ...) gets ZERO entry in the global call
graph (confirmed: ctx.call_graph.get("sqlite3Init") == None), i.e. invisible
to every interprocedural rule (function_summary, null-state, taint) as long
as it lives after the swallowing function in the same file -- silent FN risk,
not just this one FP.

Scope check across the other realworld corpora (ad hoc CParser scan for
function_definition nodes containing nested function_definition descendants,
which can never happen in valid C and is a reliable tripwire for this bug):
libcrc 0/16, sqlite 19/312, mosquitto 0/384, curl 15/696 (mostly
tests/unit/*.c unity-macro harnesses), hostap 18/504 (src/fst/fst_ctrl_iface.c
and others). Not a one-off -- reproducible on 3 of 5 corpora.

Disposition:
(a) NOT a legitimate TP worth surfacing -- retract the recall-improvement
    claim for the sqlite3Init hit specifically.
(b) Yes, this class recurs elsewhere (see corpus scan above); filed as its
    own bug (see linked task) since it's a distinct, higher-severity issue
    than what this task scoped (call-graph corruption > one rule's FP).
(c) No CHANGELOG "+2 recall" note for MSC04-C from task-153's migration --
    that migration is still a real no-op for direct-recursion detection and
    the hostap binder_manager.h hit (C++ header misparsed by the C grammar)
    is separately-understood, pre-existing noise, not new. This sqlite hit
    should NOT be cited in the paper as a recall win.done2026-07-04T00:31:26Z2026-07-06T17:16:03Z2026-07-06T17:16:03Z OBJ face v_idx no-upper-bound 4603, glTF JOINTS temp overflow 6232. Confirmed-FP families: MEM30 reused-temp-across-branches (29), ARR00 points[4]/tmp[4] size-misparse + worldTransform out-param-fill, EXP34 cgltf result-guarded, FLP storm. Filed upstream-report task. CUMULATIVE (6 batches, 10/23 files=43.5%): precision 3.3% (100 TP/3048), recall 86.2% (100/116, 16 FN). NEXT: batch 7 = rshapes.c (879, FLP storm) then raudio.c(304)/rlgl.h(252) then platform backends.
BATCH 7 DONE (rshapes.c, 2026-06-23): 568 unique labels (4 TP / 564 FP) + 0 FN. Pure 2D-drawing float-geometry storm, as predicted. 4 TP all DCL00-C compute-once (float c=powf(t,2) bezier coeffs, 2106/2152/2239/2254). Adversary: 0 flips, 0 FNs (verified every array decl: point[12], point[16], spline points[50] indexed to 49; MEM05 #define-not-VLA; ARR36 float scalar swaps; INT33 float div; collision routines all caller-trusted bounded). Surfaced ARR00 initializer-misparse as THE dominant FP driver (98 here) -> filed task 234. CUMULATIVE (7 batches, 11/23 files=47.8%): precision 2.9% (104 TP/3616), recall 86.7% (104/120, 16 FN). Drawing storms done (rtextures/rshapes); rmodels was the TP jackpot (IQM). NEXT: raudio.c(304) + rlgl.h(252) = batch 8, then 8 platform backends + raylib.h = batch 9.
BATCH 8 DONE (raudio.c + rlgl.h, 2026-06-23): 466 unique labels (3 TP / 463 FP) + 1 FN. Infrastructure files; audio decode fully DELEGATED to external libs (dr_wav/dr_flac/stb_vorbis/qoa/jar_xm/jar_mod, internally validated + NULL-safe) and rlgl trusts caller indices -> NO own parser -> no IQM-style TP cluster (confirms the loader-trust-boundary thesis). 3 TP all DCL00 compute-once (rlgl 3835/3837/3838 e/r/g pixel-flip). Adversary: 0 flips (verified eye-index 4804/4814 = trusted 0/1 contract no sibling bounds-checks; MEM30:1793 jar_mod_unload-frees-internal-vs-RL_FREE-wrapper + 2625 extList-aliases-into-extensionsDup = container-vs-member, both FP; MSC37 2092/4757 every GL-backend config returns; EXP34 drwav/drflac_free reduce to free() NULL-safe). FN found: rlgl.h:1248 rlPushMatrix stack OOB write (overflow check TRACELOGs but no return -> 33rd push writes stack[32] past [32]; rlPopMatrix is guarded, asymmetric). New FN class = sqc doesn't model warning-without-return guards. False-claim DCL00 globals AUDIO:404/RLGL:1149 confirmed FP. CUMULATIVE (8 batches, 13/23 files=56.5%): precision 2.6% (107 TP/4082), recall 86.3% (107/124, 17 FN). NEXT: batch 9 (final) = 8 platform backends (rcore_desktop_sdl/win32/glfw/rgfw/drm/android/web/web_emscripten ~1265) + raylib.h (32); highly repetitive (rcore_template/rcore_memory already audited as TPs in batch 1) so calibration applies heavily.
BATCH 9 DONE + AUDIT COMPLETE (2026-06-23): 8 platform backends + raylib.h, 1181 labels (30 TP / 1151 FP) + 3 FN. TP: CON33/CON34 (strtok/strerror/readdir non-thread-safe), ENV33 system() x3 (OpenURL), DCL37 (__wrap_fopen/_XTYPEDEF_FONT reserved-id), rgfw DCL00 lookup tables. Adversary 0 flips (confirmed: DCL00 width/height all out-param-written =FP; FIO24 fd per-error-path-close not double-close; MEM31 gbm stored in global cleaned in ClosePlatform; MEM05 kernel-#define-sized not VLA; POS01 trusted /dev paths; button/key indices OS-guaranteed or guarded; API05 [static N] suggestion = FP per task194). 3 FN (OS-input-index OOB sqc missed): sdl:1717 mouse-button, drm:2273 gamepadAbsAxisRange dim-mismatch, android:1308 key-queue-no-guard. ===== FINAL (frozen oracle raylib-v1.0, run #66): 23/23 files 100% coverage, 5263 labels, 137 TP / 5126 FP / 20 FN -> precision 2.6%, recall 87.3%. ===== TP rules: DCL37 100%(22), ARR38 56%(19 IQM), INT32 37%(17 IQM), DCL00 29%(34), CON34 75%(9), DCL13(9), CON33/ENV33/MSC30/POS30 100%, FIO11/FIO14 75%, MEM05(2),INT30(2). All semantic advisories 0%. Tool-improvement tasks filed: 228(INT33-float) 229(cpp-block) 230(FLP06) 231(DCL00-reassign) 232(MEM30-freetrack) 234(ARR00-init-misparse) 235(warn-without-return FN); upstream 233(IQM). raylib is now a fully-adjudicated 6th oracle (frozen raylib-v1.0).done2026-06-23T16:36:27Z2026-06-23T16:47:02Z2026-06-23T22:59:02Z
	&i���
�%	&	&�F�
Y�7555Refactor parse_item_page below AIRD 85scripts/scrape_cert_wiki.py:197 — parse_item_page, AIRD 86 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:21Z2026-07-05T22:28:25Z2026-07-05T22:29:08Z�4�
Q�555Refactor analyze_cwe below AIRD 85bench/analyzer.py:275 — analyze_cwe, AIRD 86 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:21Z2026-07-05T22:27:10Z2026-07-05T22:28:25Z�`�
g�]555Refactor check_dereferences_cfg below AIRD 85src/rules/cert_c/EXP/EXP34-C/exp34_c.rs:144 — check_dereferences_cfg, AIRD 95 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:21Z2026-07-05T22:23:31Z2026-07-05T22:27:10Z�a�
u�Q555Refactor check_stmt_for_var_assignment below AIRD 85src/analyze/const_eval.rs:1422 — check_stmt_for_var_assignment, AIRD 87 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:21Z2026-07-05T22:21:13Z2026-07-05T22:23:31Z�9�
Y�555Refactor scan_repository below AIRD 85src/ui/mod.rs:2146 — scan_repository, AIRD 87 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:21Z2026-07-05T22:21:13Z2026-07-05T22:21:13Z��
_�U5Refactor analyze_operations below AIRD 85src/rules/cert_c/INT/INT14-C/int14_c.rs:259 — analyze_operations, AIRD 91 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.pending2026-07-05T2�I�
O�G555Refactor infer_type below AIRD 85src/rules/cert_c/INT/INT32-C/int32_c.rs:1637 — infer_type, AIRD 86 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:21Z2026-07-05T22:29:08Z2026-07-05T22:31:50Z�
k�G5Refactor process_expression_range below AIRD 85src/analyze/value_range.rs:572 — process_expression_range, AIRD 89 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark aft�W�
k�G555Refactor process_expression_range below AIRD 85src/analyze/value_range.rs:572 — process_expression_range, AIRD 89 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:21Z2026-07-05T22:31:50Z2026-07-05T22:34:06Z
;�;(P
��6��Z�
a�W555Refactor check_strcpy_safety below AIRD 85src/rules/cert_c/STR/STR31-C/str31_c.rs:639 — check_strcpy_safety, AIRD 86 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:21Z2026-07-05T22:38:20Z2026-07-05T22:44:23Z�f�
m�c555Refactor check_validation_patterns below AIRD 85src/rules/cert_c/API/API00-C/api00_c.rs:460 — check_validation_patterns, AIRD 86 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:21Z2026-07-05T22:34:06Z2026-07-05T22:36:09Z�
_�U5Refactor analyze_operations below AIRD 85src/rules/cert_c/INT/INT14-C/int14_c.rs:259 — analyze_operations, AIRD 91 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.pendi�X�
_�U555Refactor analyze_operations below AIRD 85src/rules/cert_c/INT/INT14-C/int14_c.rs:259 — analyze_operations, AIRD 91 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:21Z2026-07-05T22:36:09Z2026-07-05T22:38:20Z%
a�W5Refactor collect_validations below AIRD 85src/rules/cert_c/INT/INT31-C/int31_c.rs:791 — collect_validations, AIRD 91 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preservi�Z�
a�W555Refactor collect_validations below AIRD 85src/rules/cert_c/INT/INT31-C/int31_c.rs:791 — collect_validations, AIRD 91 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:22Z2026-07-05T22:49:33Z2026-07-05T22:51:54Z�J�
_�9555Refactor process_expression below AIRD 85src/analyze/init_state.rs:705 — process_expression, AIRD 86 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:22Z2026-07-05T22:49:33Z2026-07-05T22:49:33Z�T�
i�C555Refactor process_call_expression below AIRD 85src/analyze/init_state.rs:977 — process_call_expression, AIRD 87 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:21Z2026-07-05T22:44:23Z2026-07-05T22:49:33Z�T�
[�Q555Refactor find_buffer_size below AIRD 85src/rules/cert_c/STR/STR31-C/str31_c.rs:212 — find_buffer_size, AIRD 91 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:21Z2026-07-05T22:44:23Z2026-07-05T22:44:23Z
FT���{n^QA4$���������viYL</
�
�
�
�
�
�
�
�
�
q
d
T
G
7
*


���������M7%������pbT�e+msc04c�d+cert-c�c%+fp-reduction�b*tech-debt�a)*infrastructure�`/)task-153-followup
�_)refactor�^))infrastructure�]/(task-153-followup�\%(fp-reduction�[(parser�Z!(robustness�Y)(infrastructure9�Xu'fp-reduction,robustness,mem-family,task-153-followup
�W&refactor
�V&knots
�U%refactor
�T%knots
�S$refactor
�R$knots
�Q#refactor
�P#knots
�O"refactor
�N"knots
�M!refactor
�L!knots
�K refactor
�J knots
�Irefactor
�Hknots
�Grefactor
�Fknots
�Erefactor
�Dknots
�Crefactor
�Bknots
�Arefactor
�@knots
�?refactor
�>knots
�=refactor
�<knots
�;refactor
�:knots
�9refactor
�8knots
�7refactor
�6knots
�5refactor
�4knots
�3refactor
�2knots
�1refactor
�0knots
�/refactor
�.knots
�-refactor
�,knots
�+refactor
�*knots
�)refactor
�(knots
�'refactor
�&knots
�%
refactor
�$
knots�#ci
�"knots8�!stask-153-followup,msc04c,recall,realworld-benchmark0� c
infrastructure,robustness,task-153-followup
�
�	��x��%�M555API00-C/API02-C: preprocessor/parameter-list pruning recursion left in placeTask 153 batch 4: API00-C's check_validation_patterns only recurses into preproc_ifdef/preproc_if/preproc_else/preproc_elif/preproc_function_def children (bounded by preprocessor nesting depth, lower risk than statement-chain cases); API02-C's check_parameters_recursive deliberately skips descending into a matched parameter_list's own children to avoid double-counting nested function-pointer params, which find_descendants_of_kind can't reproduce (it always descends into matches). Lower priority than the statement-chain residual risks (task 262) but still unaddressed by task 153's mechanical migration.done2026-07-03T21:35:16Z2026-07-06T14:16:51Z2026-07-06T14:21:55Z�C��]�+555ARR38-C: collect_function_definitions_recursive / collect_pointer_offsets_in_node residual overflow riskTask 153 batch 5: both helpers prune at nested function-definition boundaries (kind-based pruning), but depth within a single function body remains unbounded, same stack-overflow risk class as the original hostap ARR00-C/MEM33-C bug. Needs bespoke explicit-stack rewrite.done2026-07-03T21:51:27Z2026-07-06T14:04:53Z2026-07-06T14:08:06Z�-��-�/555MSC37-C/PRE13-C/STR02-C: statement/path-context recursion residual overflow riskTask 153 batch 4: MSC37-C's ends_with_return/statement_returns/all_branches_return are mutually recursive over control-flow structure (if/else/switch chains, not kind-uniform); PRE13-C's check_node threads a per-path defined_macros accumulator down preproc_if branches (flat query API has no path context); STR02-C's check_functions prunes at function_definition boundaries (shallow, low risk). All three retain deep-nesting stack-overflow exposure similar to the original hostap ARR00-C/MEM33-C bug, none mechanically fixable via substrate::query. Needs bespoke explicit-stack rewrites (or a parallel-stack context param for PRE13-C's path-sensitive case).done2026-07-03T21:35:16Z2026-07-06T13:56:27Z2026-07-06T14:04:13Z�G�
�K�5Bespoke explicit-stack rewrites for ~15 stateful/branch-sensitive rule files (task 153 residue)Task 153's mechanical substrate::query migration (5 batches, commits c7bf7fc4/11d291ac/15d52d97/3ee1244d/045c39f1) closed 195 rule files but could not mechanically fix ~15 files whose recursion is genuinely stateful, branch-sensitive, or path-context-dependent (substrate::query's find_descendants has no skip/prune/state-threading mechanism). Each still carries the original hostap-style deep-nesting stack-overflow exposure. Individual follow-ups already filed: 255 (FIO22-C), 256 (CON34-C/CON40-C), 257 (INT30-C/INT32-C), 258 (INT33-C), 259 (DCL01-C), 260 (DCL30-C), 261 (MEM03-C/MEM30-C/MEM31-C), 262 (MSC37-C/PRE13-C/STR02-C), 263 (API00-C/API02-C, lower priority), 264 (ARR38-C), 265 (FLP03-C/SIG00-C). This umbrella task tracks the group for prioritization; close only once all child tasks are resolved or explicitly deferred.pending2026-07-03T22:03:34Z�8�	�5�=555FLP03-C/SIG00-C: branch-feasibility and byte-position pruning residual overflow riskTask 153 batch 5: FLP03-C's check_all_assignments/walk_scope_for_last_assignment (divisor_provably_nonzero_fp machinery) prune based on which if-branch is feasible, not node kind; SIG00-C's contains_sigaddset_before prunes based on byte-offset position relative to a target node. Both retain deep-nesting stack-overflow exposure (same class as FIO22-C/CON34-C/DCL01-C). Needs bespoke explicit-stack rewrites.done2026-07-03T21:51:27Z2026-07-06T14:08:38Z2026-07-06T14:16:11Z
���������|jUF1�������hYD5
�
�
�
�
�
�
�
o
]
Q
<
*


��������vdVJ5#������u^I2!
�
�
�
�
�
�
�
o
`
I
;
*

	�	�	�	�	�	�	�	�	�	p	b	Q	C	2	$		������vc<����cC#��sZeL;-���������sbTC5$��������{j\K=,
���������rdSE4������xgM6$�+msc04c�+cert-c�%+fp-reduction�*tech-debt�)*infrastructure�/)task-153-followup�)refactor�))infrastructure�/(task-153-followup�%(fp-reduction�(parser�!(robustness�)(infrastructure�<u'fp-reduction,robustness,mem-family,task-153-followup�&refactor�
&knots�%refactor�
%knots�$refactor�
$knots�#refactor�
#knots�"refactor�
"knots�!refactor�
!knots� refactor�
 knots�refactor�
knots�refactor�
knots�refactor�
knots�refactor�
knots�refactor�
knots�refactor�
knots�refactor�
knots�refactor�
knots�refactor�
knots�refactor�
knots�refactor�
knots�refactor�
knots�refactor�
knots�refactor�
knots�refactor�
knots�refactor�
knots�refactor�
knots�refactor�
knots�
refactor�

knots�
ci�
knots�;stask-153-followup,msc04c,recall,realworld-benchmark�3c
infrastructure,robustness,task-153-followup�;	fp-reduction,robustness�;fp-reduction,robustness�;fp-reduction,robustness�;fp-reduction,robustness�*Qfp-reduction,robustness,mem-family�;fp-reduction,robustness�&Ifp-reduction,robustness,dcl01c�&Ifp-reduction,robustness,int33c�;fp-reduction,robustness�;fp-reduction,robustness�&I�fio22c,fp-reduction,robustness�!�robustness�)�infrastructure�)�infrastructure�!�robustness�)�infrastructure�)�rule-hardening�%�fp-reduction�
�knots�
�ci��refactor�
�knots��refactor�
�knots��refactor�
�knots��refactor�
�knots��refactor�
�knots��refactor�
�knots��refactor
�knots~�refactor}
�knots|�refactor{
�knotsz�refactory
�knotsx)�rule-hardeningv�recallw�benchmarku%�fp-reductiont�upstreamr�securitys)�rule-hardeningq%�fn-reductionp)�rule-hardeningo%�fp-reductionn�upstreaml�securitym)�rule-hardeningk%�fp-reductionj)�rule-hardeningi%�fp-reductionh)�rule-hardeningg%�fp-reductionf)�rule-hardeningd%�preprocessore%�fp-reductionc)�rule-hardeningb%�fp-reductiona�realworld]%�ground-truth^�c99_
�audit`�realworldZ%�ground-truth\�c99[�benchmarkY
�paperW�wontfixX)�infrastructureV�bugU�bugT�bugS�bugR
�infraQ
�infraP�realworldO%�ground-truthN�c99M�benchmarkL)�rule-relevanceK�realworldJ)�infrastructureH�configI%�fp-reductionC�benchmarkD�benchmarkB
�benchA�benchmark@7�sqlite-audit-followup?�recall>%�fn-detection=�arr30c<7�sqlite-audit-followup;�recall:%�fn-detection9�arr30c8�prescan7)�infrastructure6�benchmark5�juliet4�benchmark37�sqlite-audit-followup2%�fp-reduction1�exp34c0%�fp-reduction,�benchmark/�arr38c-�arr30c.�benchmark+�str31c'�prescan)#�performance(�benchmark*�str31c#Zi�������������������������~ytoje`[VQLF@:4.("
����������������������ztnhb\VPJD>82,& �z
G�1555Analysis capabilities roadmapDescription:
Track fundamental analysis limitations and potential improvements.

Details:
DONE. Updated docs/architecture.rst with comprehensive inventory of all 10
analysis modules, current capabilities table (17 entries), known limitations
table (8 entries with impact descriptions), per-CWE ceiling analysis, and
updated competitor landscape from 5-tool benchmark. Previous version was
heavily outdated (referenced "No VRA", "No whole-program analysis", 48% TP
rate — all now incorrect).

Original status line: done (v0.3.87)done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z�r
%�
5Docker imageDescription:
Containerized CI/CD distribution of sqc.

Details:
Dockerfile for sqc with all dependencies. Enables drop-in CI/CD usage without
local Rust toolchain installation. Part of Tier 2 production quality definition
of done.
Note (2026-06-10): Reviewed and kept at P4. Release CI already builds an AppImage (plus deb/rpm/Windows), which covers toolchain-free CI/CD usage. Docker's only remaining value is ergonomics for container-native pipelines (GitLab 'image:', GH Actions container jobs) — would be a thin wrapper copying the release binary into a slim base image.pending2026-04-20T16:45:55Z�K
I�Q555Inter-procedural .c test casesDescription:
Multi-file C test cases for prescan/call-site propagation.

Details:
DONE. Added 13 multi-file CLI integration tests exercising 4 cross-file
prescan capabilities:

  1. Callsite null propagation (EXP34-C): NULL arg detected across files,
     no detection without -d, safe caller not flagged. (3 tests)
  2. can_return_null (EXP34-C): unchecked nullable return detected,
     checked return safe. (2 tests)
  3. frees_params (MEM31-C): cross-file free suppresses leak, no
     suppression without -d, actual leak still detected. (3 tests)
  4. header_declared_functions (DCL15-C): header-prototyped functions
     suppressed, all flagged without -d. (2 tests)

  Fixtures: tests/fixtures/cli/{crossfile_callsite_null, crossfile_frees,
  crossfile_header}. Each scenario tests with-d, without-d, and safe
  variants.

Original status line: done (v0.3.87)done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z�
9�5DCL13-C alias trackingDescription:
Reduce DCL13-C FPs (12,138 real-world) via alias/points-to analysis.

Details:
Const correctness violations where pointer params flow through struct fields.
Example: ringbuffer.c:275 ptrBuffer — pointer stored into struct field, then
memset writes through struct member. Requires alias/points-to tracking.
Possible shortcut: if a pointer param is stored into a struct field, treat it
as potentially modified.

Original status line: deferredpending2026-04-20T16:45:55Z�
;�5MEM31-C ownership modelDescription:
Reduce MEM31-C FPs (5,440 real-world) via ownership tracking.

Details:
Cross-function ownership patterns (strdup -> struct field -> custom_Delete)
require an ownership model to track which function is responsible for freeing
allocated memory. New analysis capability, high effort.

Original status lih�)g�(w�'p�x�!o�j�r�
?�@�́|ˁvʁmɁkȁiǁfƁcÁba��_��Z��X��W��V��S��Q��O��M��L��K��H��E��B��@��=��;��8��5��4��0��,��)��%��#��"�� �����������������z�s�n�j�h�e�c�a�^�[�V�Q�M�I�F�A�?�=�9�5�2�.�'� ���~}|
{zyvu
�0�
��a��z
G�1555Analysis capabilities roadmapDescription:
Track fundamental analysis limitations and potential improvements.

Details:
DONE. Updated docs/architecture.rst with comprehensive inventory of all 10
analysis modules, current capabilities table (17 entries), known limitations
table (8 entries with impact descriptions), per-CWE ceiling analysis, and
updated competitor landscape from 5-tool benchmark. Previous version was
heavily outdated (referenced "No VRA", "No whole-program analysis", 48% TP
rate — all now incorrect).

Original status line: done (v0.3.87)done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z�r
%�
5Docker imageDescription:
Containerized CI/CD distribution of sqc.

Details:
Dockerfile for sqc with all dependencies. Enables drop-in CI/CD usage without
local Rust toolchain installation. Part of Tier 2 production quality definition
of done.
Note (2026-06-10): Reviewed and kept at P4. Release CI already builds an AppImage (plus deb/rpm/Windows), which covers toolchain-free CI/CD usage. Docker's only remaining value is ergonomics for container-native pipelines (GitLab 'image:', GH Actions container jobs) — would be a thin wrapper copying the release binary into a slim base image.pending2026-04-20T16:45:55Z�K
I�Q555Inter-procedural .c test casesDescription:
Multi-file C test cases for prescan/call-site propagation.

Details:
DONE. Added 13 multi-file CLI integration tests exercising 4 cross-file
prescan capabilities:

  1. Callsite null propagation (EXP34-C): NULL arg detected across files,
     no detection without -d, safe caller not flagged. (3 tests)
  2. can_return_null (EXP34-C): unchecked nullable return detected,
     checked return safe. (2 tests)
  3. frees_params (MEM31-C): cross-file free suppresses leak, no
     suppression without -d, actual leak still detected. (3 tests)
  4. header_declared_functions (DCL15-C): header-prototyped functions
     suppressed, all flagged without -d. (2 tests)

  Fixtures: tests/fixtures/cli/{crossfile_callsite_null, crossfile_frees,
  crossfile_header}. Each scenario tests with-d, without-d, and safe
  variants.

Original status line: done (v0.3.87)done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z�
9�5DCL13-C alias trackingDescription:
Reduce DCL13-C FPs (12,138 real-world) via alias/points-to analysis.

Details:
Const correctness violations where pointer params flow through struct fields.
Example: ringbuffer.c:275 ptrBuffer — pointer stored into struct field, then
memset writes through struct member. Requires alias/points-to tracking.
Possible shortcut: if a pointer param is stored into a struct field, treat it
as potentially modified.

Original status line: deferredpending2026-04-20T16:45:55Z�
;�5MEM31-C ownership modelDescription:
Reduce MEM31-C FPs (5,440 real-world) via ownership tracking.

Details:
Cross-function ownership patterns (strdup -> struct field -> custom_Delete)
require an ownership model to track which function is responsible for freeing
allocated memory. New analysis capability, high effort.

Original status line: deferredpending2026-04-20T16:45:55Z�M
O�5MEM30-C field-level free trackingDescription:
Reduce MEM30-C FPs (15,330 real-world) via field-level free tracking.

Details:
Sequential struct/member frees and cross-function free propagation cause high
FP count. Requires field-level free tracking — a new analysis capability beyond
current architecture. Deferred until ownership model (task 9) or field-sensitive
analysis is implemented.

Original status line: deferredpending2026-04-20T16:45:55Z
FF�7
G�u5Paper — real bug case studyDescription:
Find and document a confirmed real defect in one of the 5
  open-source benchmark codebases detected by SqC but missed by cppcheck
  and clang-tidy.

Details:
Strongest paper contribution would be a confirmed bug (ideally with a CVE
or upstream fix) found by SqC.  Candidates:

  - EXP34-C on mosquitto (8,657 violations) — high volume, likely contains
    real null dereference paths.  Cross-reference with mosquitto's issue tracker.
  - ERR33-C on curl (unchecked return values) — curl has strict error handling
    conventions, violations may be real.
  - MEM30-C on any project — use-after-free is high-severity.

Process: run sqc on latest versions, export JSON, filter by high-severity
rules, manually verify top candidates, check if upstream has acknowledged
or fixed the issue.

Paper impact: new Section "Case Study" between Worked Example and Limitations.pending2026-04-20T16:45:55Z
��"D
Wn���'�_�w5MEM30-C/MEM31-C: explicit-stack rewrite for stateful save/fork/merge dataflow chains (task 261 follow-up)Split from task 261 (MEM03-C portion done, commit 08fb346a). MEM30-C's MemoryAnalyzer::analyze_node/analyze_function/analyze_function_body/analyze_if_statement chain does a save -> analyze-then-branch -> snapshot -> restore -> analyze-else-branch -> snapshot -> merge dance across ~6 mutable state fields (freed_vars, aliases, nullified_vars, realloc_updated, realloc_invalidated) plus unconditionally_diverges' then&&else combine -- unlike MEM03-C's simple clone-and-discard fork, the recursive calls sit mid-procedure, so an explicit-stack conversion needs a small state machine (condition -> then-branch -> capture -> reset -> else-branch -> capture -> merge -> resume caller), not just a push-children pattern. MEM31-C's MemoryLeakAnalyzer chain needs the same treatment (unexamined so far). Also MEM30-C's GlobalTracker::scan_function_body has an order-dependent has_recursive_call flag plus a #if 0 subtree prune -- secondary, bounded-depth concern, lower priority than the main chain. Needs thorough verification given the state-mutation-ordering risk: deep-nesting stack-overflow repro, full test suite, and targeted branch-merge sanity checks (e.g. free-in-one-branch-only, free-in-both-branches, realloc-null-branch detection) to catch subtle reordering bugs.pending2026-07-06T13:54:11Z�d�"
k�a555Refactor check_array_modification below AIRD 85src/rules/cert_c/STR/STR30-C/str30_c.rs:557 — check_array_modification, AIRD 93 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:22Z2026-07-05T23:00:46Z2026-07-05T23:06:40Z�e�&
m�a555Refactor check_scope_for_shadowing below AIRD 85src/rules/cert_c/DCL/DCL01-C/dcl01_c.rs:54 — check_scope_for_shadowing, AIRD 86 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:22Z2026-07-05T23:09:26Z2026-07-05T23:15:55Z�i�%
o�g555Refactor check_buffer_size_mismatch below AIRD 85src/rules/cert_c/ARR/ARR38-C/arr38_c.rs:1583 — check_buffer_size_mismatch, AIRD 98 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:22Z2026-07-05T23:06:40Z2026-07-05T23:09:26Z�Z�$
a�W555Refactor process_declaration below AIRD 85src/rules/cert_c/STR/STR30-C/str30_c.rs:128 — process_declaration, AIRD 93 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:22Z2026-07-05T23:06:40Z2026-07-05T23:06:40Z�Z�#
a�W555Refactor check_function_call below AIRD 85src/rules/cert_c/STR/STR30-C/str30_c.rs:475 — check_function_call, AIRD 90 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:22Z2026-07-05T23:06:40Z2026-07-05T23:06:40Z
	;
c�o�
w�k555Refactor collect_computational_handlers below AIRD 85src/rules/cert_c/SIG/SIG35-C/sig35_c.rs:82 — collect_computational_handlers, AIRD 90 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:22Z2026-07-05T22:51:54Z2026-07-05T22:54:19Z_
i�C5Refactor process_expression_null below AIRD 85src/analyze/null_state.rs:438 — process_expression_null, AIRD 88 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a J�T�!
i�C555Refactor process_expression_null below AIRD 85src/analyze/null_state.rs:438 — process_expression_null, AIRD 88 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:22Z2026-07-05T23:00:46Z2026-07-05T23:00:46Z�V� 
k�E555Refactor process_declaration_null below AIRD 85src/analyze/null_state.rs:322 — process_declaration_null, AIRD 93 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:22Z2026-07-05T23:00:46Z2026-07-05T23:00:46Z�g�
{�W555Refactor analyze_null_states_with_globals below AIRD 85src/analyze/null_state.rs:1044 — analyze_null_states_with_globals, AIRD 86 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85, wheel edition v1.13.1). Verify with: pre-commit run knots --all-files. Behavior-preserving; if it touches rule detection logic or core analysis, run a Juliet (+ realworld) benchmark after to confirm no drift.done2026-07-05T22:07:22Z2026-07-05T22:54:19Z2026-07-05T23:00:46Z
DD�-}��55Paper — taint tracking for CWE-78/CWE-89 (future work)Description:
Expand cross-function taint tracking for injection CWEs,
  referenced in paper future work section.

Details:
Partial delivery via tasks 67-69 plus v0.3.99 (49A), v0.3.101 (49B),
v0.3.102 (49C), and v0.3.103 (49D). CWE-78 62.8% → **94.8%** (+32.0pp,
now exceeds clang-tidy), CWE-194 58.4% → **69.4%** (+11.0pp), CWE-195
48.7% → 52.5% (+3.8pp).

Delivered infrastructure:
  - `FunctionSummary.has_env03_taint_source` — body text scan for ~25
    taint sources (recv, fgets, scanf, getenv, Win32 I/O, etc.)
  - `FunctionSummary.returns_tainted` + `returns_from_callees`
    (v0.3.99, task 49A) — seeded from `has_env03_taint_source` on non-
    void returns, then propagated to fixpoint via
    `propagate_return_taint` so wrapper chains
    (`char *wrap() { return readIt(); }`) inherit the bit.
  - Reverse call graph built in each consuming rule from
    `ProjectContext.call_graph`.
  - Same-named static function merging in prescan (any tainted def
    poisons the merged summary; OR-merges both taint bits).

Rule integrations so far:
  - ENV03-C: parameter path → caller summary lookup (task 68); local
    command var `data = helper(...)` → callee clean-summary check
    (task 49A).
  - ENV33-C: pointer-parameter helper-sink path → transitive caller
    summary walk (task 49B). Mirrors ENV03-C task 68, with a BFS
    over the reverse call graph for Juliet variants 52c/53d/54e.
  - INT31-C: signed→size_t inside upper-bound guards → caller / callee /
    local-assignment summary lookups (task 69); `call_rhs_has_taint_source`
    now also treats `returns_tainted` callees as tainted (task 49A).
  - STR02-C: tainted-parameter → caller summary lookup (task 49D).
    Mirrors ENV33-C's BFS pattern; gated on "scope has no direct taint
    source" so local-recv paths stay flagging.

## Sub-task 49A — Return-value taint (DONE v0.3.99)

ENV03-C FP 468 → **324** (−144), TP 652 → 620 (−32). **4.5:1 FP:TP**
— cleanest ratio since task 67. CWE-78 TP rate 74.1% → **76.6%**
(+2.5pp). CWE-426 side benefit: FP −24 (1:1). Zero other-rule
regressions. INT31-C was neutral on Juliet; the wrapper pattern
exists in real-world code but Juliet CWE-194/195 v42 templates call
taint sources directly inside `badSource`, so the new transitive
bit had no additional TPs to catch there.

## Sub-task 49C — Function-pointer call graph + macro-aliased taint (DONE v0.3.102)

Two linked prescan fixes targeting Juliet v65a/b helper-sink variants.

1. `collect_callees` resolves function-pointer aliases. The function body
   is scanned once to build a local `pointer_var → target_function` map
   from init declarators (`void (*fp)(char *) = target;`) and later
   rebinds (`fp = target;`), then callees are emitted with aliases
   rewritten. Juliet v65a `caller → sink` edges are now first-class
   instead of landing as a `funcPtr` dead-end callee.

2. `has_env03_taint_source` also matches per-file macro aliases whose
   target is in `ENV03_TAINT_SOURCE_FUNCTIONS`. Juliet macro wrappers
   (`#define GETENV getenv`, `#define FGETS fgets`, etc.) are now
   caught, so callers of v65b-style sinks get correctly classified as
   tainted. New `taint_source_aliases: &[String]` parameter on
   `compute_summaries` / `analyze_function` carries the pre-filtered
   alias list without widening the existing `MacroConstantMap` contract.

Results: Juliet TP 24,478 → **24,542** (+64), FP 13,632 → **13,498**
(−134), TP rate 64.2% → **64.5%** (+0.3pp). Zero other-rule
regressions.
  - CWE-78 TP rate 87.7% → **90.3%** (+2.6pp). ENV33-C FP 50 → **0**,
    TP 1438 → 1514 (+76) — the macro-alias fix recovered TPs previously
    missed becausl
z�cz�f
M�555MEM31-C FP reduction for CWE-401Description:
Reduce MEM31-C FPs on CWE-401 (memory leak).
 CWE-401: 77.6% vs clang-tidy 83.9% (−6.3pp, 220 FP remaining)

Details:
DONE. MEM31-C: 786 TP/763 FP → 761 TP/220 FP (-543 FP, -25 TP, 21.7:1 ratio).
CWE-401 TP rate 50.7% → 77.6% (+26.9pp). Rule FP rate 49.3% → 22.4%.

  Three fixes:
  1. Prescan callee-frees-param: integrate FunctionSummary.frees_params.
  2. Transitive free propagation: param pass-through + fixpoint in prescan.
  3. If/else branch merge: UNION of freed memory from both branches.

  Remaining 220 FPs: switch constants, pointer-to-pointer, global variables.

Original status line: done (v0.3.86)done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z�-

E�555Binary distribution packagesDescription:
Generate AppImage, Windows .exe, .deb, and .rpm packages for sqc.

Details:
Packaging targets:
  - AppImage (Linux portable): use cargo-appimage or linuxdeploy with sqc binary +
    .desktop file + icon. Single self-contained executable for any Linux distro.
  - Windows .exe: cross-compile with x86_64-pc-windows-gnu or -msvc target.
    Optionally wrap in an MSI installer via cargo-wix.
  - .deb (Debian/Ubuntu): use cargo-deb. Include sqc binary in /usr/bin/,
    man page (task 52) in /usr/share/man/man1/, config examples in
    /usr/share/doc/sqc/. Set dependencies (libc6).
  - .rpm (Fedora/RHEL): use cargo-generate-rpm. Same file layout as .deb.

CI/CD integration: GitHub Actions matrix build with release artifacts uploaded
on tag push. Use cross for cross-compilation where needed.

Artifact bundle (per knots reference in ~/data/knots/.github/workflows/build.yml):
binary + LICENSE + THIRD_PARTY_LICENSES.txt + sqc.cdx.json (from task 71).done2026-04-20T16:45:55Z2026-05-07T19:21:05Z2026-05-07T19:21:05Z�j	
W�K5Paper — finalization and submissionDescription:
Final paper revisions, formatting, and submission preparation.

Details:
Current state: paper/sqc.tex compiles to 10 pages, two-column, with 5 figures,
8 tables, and 11 references.  Uses plain article class.

Remaining items:
  - Update numbers when tasks 46-47 complete
  - Choose target venue and switch to appropriate template:
    * IEEE S&P / USENIX Security / ACM CCS (top tier, competitive)
    * NDSS / ACSAC (strong security venues)
    * IEEE SecDev / SCORED (tools-focused, better fit)
    * ICSME / ASE (software engineering, tool papers track)
  - Add Eric and Tristan's institutional affiliation if not BISSELL
  - Review by co-authors
  - Proofread and style consistency pass
2026-06-10: also gated on task 152 (hedge/validate 100% claims) and task 147 (v0.4.21 numbers).pending2026-04-20T16:45:55Z
���0
m�w555INT30-C embedded guard/bound pattern recognitionDescription:
Reduce INT30-C FPs on bounded embedded arithmetic.

Details:
DONE. Work spread across v0.3.88, v0.3.89, v0.3.92, v0.3.93.

Patterns recognized across the four commits:

  1. **Bitmask wrapping** (`(x + 1) & MASK`): v0.3.88 via
     `is_addition_masked_by_bitand`. Applies to addition only — the mask
     bounds the result regardless of any wrap.
  2. **Narrow-pre-cast addition/multiplication**: v0.3.88 + v0.3.89 via
     `both_operands_narrow_pre_cast` /`is_narrow_cast_plus_small_const` /
     `is_narrow_cast_times_small_const` using `effective_operand_type`
     that peers through explicit casts to recover `uint8_t` / `uint16_t`.
  3. **(WIDE)(a - b) guarded by `a > b + POS`**: v0.3.89 via
     `is_cast_over_guarded_narrow_sub` + `cond_gt_b_plus_positive`.
  4. **Same-array subtraction / widened comparison**: covered by
     narrow-pre-cast + guarded-subtraction combination.
  5. **Wide-unsigned struct-field `++`/`--`** (`ctx->tick++`,
     `obj.seq--`): v0.3.92 direct skip in `check_increment_decrement`.
     Monotonic counter fields wrap at 2^32/2^64 and are benign; Juliet
     CWE-190/191 only exercises local-variable `++`, so no TP loss.
  6. **Thin calloc wrapper** (`calloc(nmemb, size)` where both args are
     function parameters): v0.3.92 via
     `calloc_args_are_function_params` — delegates overflow to C11
     calloc (§7.22.3.2).
  7. **Implicit-else early-exit guard** (`if (a < b) return; /* a - b */`):
     v0.3.92 via `preceding_early_exit_guards_subtraction` + the new
     `if_always_exits` helper.

Infrastructure fixes surfaced along the way:
  * v0.3.92: `get_function_arguments` now iterates named children, so
    `args[0]` is the real first argument instead of a `(` token. This
    unmasked a latent bug where malloc/realloc multiplication overflow
    detection was silently disabled and calloc messages read
    `calloc((, nmemb)`.
  * v0.3.93: dropped the dedicated malloc/realloc allocation-overflow
    check. `check_multiplication` already covers the inner `*` (with
    full VRA + SIZE_MAX-guard awareness), so the allocation-level check
    produced nothing but duplicate diagnostics and occasional FPs on
    provably-safe good-paths. Calloc keeps its dedicated check because
    its multiplication is implicit.
  * v0.3.92: `has_function_context_check` falls back to the translation
    unit for snippet-style tests without an enclosing function.

Empirical impact on target embedded codebases (INT30-C suppressions
stripped for measurement, -I include paths unchanged):
  d_lib_common:          1 → 0 INT30-C FPs
  d_lib_serial_leds:    12 → 8 INT30-C FPs
  d_lib_airpath:         2 → 2 (unchanged; bounded-shift compound
                                addition, see Remaining below)
  d_lib_networking:      0 → 0

Real-world (v0.3.91 → v0.3.93): **−187 INT30-C violations**
  curl:      -106   mosquitto:  -44
  sqlite:     -37   libcrc:       0

Juliet v0.3.93 vs v0.3.91: zero delta across all 74 CWEs (the v0.3.92
duplicate-diagnostic regression on CWE-680 was fully reversed by the
v0.3.93 dedupe).

Remaining serial_leds FPs need narrow-operand propagation through local
assignments (brightness arithmetic via `uint32_t range = (uint32_t)a -
(uint32_t)b` then `range * time`). Airpath FPs need shift-aware
effective-type recognition for compound accumulators (`ctx->ad_sum +=
(... >> SHIFT) + 1`). Both deferred — low FP count, risk of Juliet TP
regressions on CWE-190/191.

Original status line: done (v0.3.93)done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z
		�{
u�555EXP34-C null safety through if-guards and &stack_varDescription:
Reduce EXP34-C FPs where null safety is established by
 if-guard-with-early-return or &stack_variable callers (~16 FPs).

Details:
DONE. Patterns A and B were already fixed by cumulative EXP34-C work
(v0.3.82 AST-level null guard fallback, v0.2.20 &stack_var propagation).
Verified on all four target embedded codebases (d_lib_common,
d_lib_serial_leds, d_lib_networking, d_lib_airpath_debris_sensing):
zero EXP34-C FPs remain except one `Memory_Free(NULL)` wrapper case.

v0.3.90-0.3.91 broadened the fix to related idioms surfaced by the
realworld benchmark:

  1. `PARAM == 0` / `PARAM != 0` null-check detection (plus reversed-
     operand and all-spacing variants). sqlite/libcurl consistently use
     this idiom (e.g. `if(pStmt==0) return ...`) — previously unrecognized.
  2. EXP34-C: skip deref-function arg check when callee is in the
     null-safe list. `free(NULL)` and `realloc(NULL, n)` are defined
     per C11 7.22.3.3 / 7.22.3.5 — flagging them is incorrect.
  3. Alias null-check recognition: `TYPE *alias = param;` followed by
     a null-check on `alias` logically null-checks `param`. Common in
     libcurl wrappers (curl_easy_setopt, curl_multi_cleanup).

Benchmark (v0.3.89 → v0.3.91):
  Realworld: −321 violations total. EXP34-C −242, API00-C −79.
    sqlite −285, mosquitto −30, curl −3, libcrc −3, hostap 0.
  Juliet: TP −102 (all CWE-690 free() with potentially-null arg —
    by-design suppression, not a regression). FP unchanged.

Pattern C (callback `void *` params) remains open but is lower priority
(requires trust annotations or library modeling).

Original status line: done (v0.3.91)done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z
���
}�1555API00-C validation look-ahead past variable declarationsDescription:
Reduce API00-C FPs where parameter validation exists but
 is not detected due to intervening variable declarations (~12 FPs).

Details:
Three sub-patterns triaged:

  A. **Validation past var decls** — already handled pre-v0.3.97. The
     existing `check_validation_patterns` walks the entire body (not just
     the first N statements) and `collect_else_if_chain_validations`
     traverses full if/else-if/else chains, so cases like
     `Ringbuffer_read` (if/else-if/else with NULL checks after a
     `result_e result = …;` declaration) no longer FP. Verified on
     d_lib_common with API00-C suppressions stripped — zero FPs for this
     sub-pattern.

  C. **void\* container where NULL is valid** — implemented in v0.3.97.
     New type-aware suppression: a `void *` / `const void *` parameter
     that is never dereferenced locally (`*p`, `p->x`, `p[i]`) and
     passes through only to null-accepting stdlib sinks (free, realloc,
     Memory_Free, Memory_Realloc, cfree) or callees whose summary
     validates the corresponding argument is treated as a generic-
     container slot where NULL is a valid value.

     Helpers: `is_generic_void_pointer_type` (bare `void *`, rejects
     `void **` and array decls) + `is_void_ptr_storage_safe` (walks the
     body, collects every parent-kind, returns true only if every use is
     storage-like or a verified safe call).

     Results (Juliet v0.3.96 → v0.3.97):
       - API00-C: TP 90→84 (-6), FP 116→104 (-12). **2.0:1 FP:TP**.
       - CWE-476 TP rate 58.9% → **59.6%** (+0.7pp).
       - Overall TP rate unchanged at 63.4%.
       - Zero other-rule regressions.

     Real-world d_lib_common: 1 → 0 API00-C FP (ArrayList_Append).

  B. **Embedded API contract — no NULL check by design** (3 FPs in
     airpath, ~17 FPs in serial_leds). Deferred. All remaining real-
     world API00-C FPs are public-API functions that dereference `ctx`
     without validation by hardware-contract design (e.g.
     `DebrisSensor_AdcSample`, `SerialLeds_set_*`). No clean AST-level
     signal distinguishes these from genuine FPs — continuing to rely
     on `SQC-SUPPRESS: API00-C` at the function site. Options considered
     and rejected:
       * Skip all public API with `_set_` / `_Init` / `_update` prefixes
         — too broad; masks real bugs in other projects.
       * Require explicit header prototype + Doxygen `@pre` — no
         reliable way to parse `@pre` contracts from tree-sitter.
       * Switch API00-C severity to Low for non-static functions —
         doesn't reduce FP count, only its visibility.

Original status line: done (v0.3.97) — A already covered, C implemented, B deferreddone2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z

���
q�O555DCL19-C / DCL00-C scope and const-qualify FP fixesDescription:
Fix DCL19-C flagging public API functions and DCL00-C
 flagging loop counter variables (6 FPs in serial_leds).

Details:
DONE. Both fixes landed in v0.3.88 via commit 2c78eac2.

  A. **DCL19-C on public API** — `set_project_context` receives
     `header_declared_functions` from prescan; the "should be static"
     check now skips any function whose name appears in a header
     traversed via `-I`. serial_leds `SerialLeds_set`,
     `SerialLeds_set_rgb`, `SerialLeds_set_brightness`: 3 → 0.

  B. **DCL00-C on loop counters** — `is_in_for_loop_init` walks up
     the declaration's parent chain to detect when the declaration is
     itself the init clause of a `for_statement`. serial_leds
     `uint8_t g` across three for-loops: 3 → 0.

Original status line: done (v0.3.88)done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z�\
m�O555EXP02-C extended short-circuit guard recognitionDescription:
Extend EXP02-C guard pattern recognition beyond
 NULL_CHECK && fn_call to cover all common guard idioms (4 FPs).

Details:
DONE. Landed over two rounds.

v0.3.88 (task 64 initial): extended the NULL-guard exemption to `||`
and added `has_mutation_side_effects` so `p || (p = malloc(...))`
and `i++ > 10` still flag.

v0.3.98 (task 64 remaining): generalized the guard check from
null-specific substring matching to AST-based comparison detection.
`is_guard_pattern` now recognises any `binary_expression` whose
operator is `==`, `!=`, `<`, `>`, `<=`, or `>=`, plus compound
`&&` / `||` chains whose leaves are guards (recursive),
plus truthiness (bare identifier / `!x`) and parenthesized
wrappers. Combined with the preserved mutation check, the rule now
correctly suppresses:

  file_size > 0 && buflen >= file_size && fseek(...)
  self == NULL || IntSet_Contains(self, element)
  len == capacity && !growCapacity(self)
  arr->len == arr->cap && !ArrayList_growCapacity(arr)

while still flagging:

  p || (p = malloc(...))           — assignment in RHS
  a > 0 && ++count > 10            — update in RHS

Juliet: zero delta (all 4 EXP02-C tests still pass, CWE-taxonomy
totals unchanged). Real-world: EXP02-C delta below the top-5
per-rule threshold (task 64 targets d_lib_common, outside the
real-world benchmark set).

Original status line: done (v0.3.98)done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z�{
y�555MEM05-C / ARR32-C false VLA and stack allocation fixesDescription:
Fix false VLA detection and spurious stack allocation
 warnings (3 FPs across 2 codebases).

Details:
DONE. All three embedded FPs resolved by a single root-cause fix: the
MEM05-C VLA detector was text-matching `[...]` anywhere in a
declaration, so array subscripts inside initializers were
misclassified as variable-length sizes.

  1. **ARR32-C on header-defined constant** — `is_all_constant_expression`
     recursively walks binary_expression leaves, so
     `[MAX_LEDS * BYTES_PER_LED]` now passes as a constant expression
     when both identifiers are ALL_CAPS macros.
  2. **MEM05-C on array subscript** — `find_array_declarator_size`
     looks for an actual `array_declarator` node instead of bracket
     text, and `init_declarator`'s value field is explicitly skipped
     so `uint8_t x = arr[i]` is no longer a "VLA".
  3. **MEM05-C on 1-byte stack variable** — same AST-level fix. The
     "large stack allocation" message never fires; previous FPs were
     subscripts-in-initializers misclassified as VLAs. No size
     threshold was needed.

Empirical impact (serial_leds / airpath, suppressions stripped):
  serial_leds MEM05-C: 1 → 0
  serial_leds ARR32-C: 1 → 0
  airpath     MEM05-C: 1 → 0

Original status line: done (v0.3.88)done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z
����m
�_555ENV03-C locally-safe popen/system command var suppressionDescription:
Reduce ENV03-C FPs on Juliet CWE-78 goodG2B functions where
 the command variable is provably derived from string literals only.

Details:
DONE. ENV03-C FP 1272→612 (-660), TP 912→752 (-160). **4.1:1 FP:TP**,
cleanest ratio since v0.2.23.

Approach: new `is_command_var_locally_safe()` in env03_c.rs. Fixpoint over
char-array declarations and pointer aliases, then walks every write to the
command variable. Suppress only when every write is from a string literal,
a locally-initialized buffer, or strcat/strcpy with a literal source.

Short-circuits that still flag:
  - Direct string literal (defense-in-depth preserved for existing tests).
  - Function parameter (caller-supplied, handled by task 68).
  - Any taint-source call in scope (recv, fgets, scanf, getenv, etc.).

Required allowing macro-identifier initializers on char arrays — `char
buf[N] = FULL_COMMAND;` is legal C only for macros, so any identifier in
that position is treated as a literal.

CWE-78 TP rate 62.8% → 72.3% (+9.5pp). Overall TP rate 61.7% → 62.5%
(+0.8pp). Zero other-rule regressions.

Original status line: done (v0.3.94)done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z�v
e�555Miscellaneous embedded FP fixes (small wins)Collection of lower-count FPs that don't warrant individual tasks:

  1. **INT32-C sizeof(*ctx)** — DONE (v0.3.98)
  2. **INT33-C non-zero constant macro divisor** — DONE (v0.3.115)
  3. **DCL13-C direct call flagged as function pointer** (serial_leds 2 FPs): not reproducible in current scan
  4. **ARR00-C/ARR01-C bounded array access** (serial_leds 4 FPs): value-range-dependent, deferred
  5. **INT01-C protocol field types** (common 4 FPs): not appearing in current scan
  6. **DCL30-C struct member pointer** (serial_leds 1 FP): not appearing in current scan
  7. **INT00-C explicit uint32_t casts** (serial_leds 1 FP): not appearing in current scan
  8. **MEM30-C sequential frees** — DONE (v0.3.114)
  9. **EXP33-C for-loop init** — MOOT (sqc already handles correctly; code refactored to C99 style)
  10. **ARR36-C integer comparison** (common 1 FP): suppressed in d_lib_common, deferred

## Fix notes

### #1 INT32-C sizeof (v0.3.98)
check_memory_function_overflow early-returns when size arg is sizeof_expression.
INT32-C -239 realworld; Juliet zero delta.

### #8 MEM30-C sequential frees (v0.3.114)
is_freed() union_members loop: strip_prefix + check remainder starts with -> or .
Avoids matching base var itself. Juliet: zero delta. Fixes d_lib_common arraylist.c FP.

### #9 EXP33-C for-loop init — MOOT
sqc CFG puts for-loop initializer in pre-header block before first read.
d_lib_common intset.c refactored to C99 style anyway; no FP in current scan.

### #2 INT33-C non-zero constant macro divisor (v0.3.115)
is_divisor_checked() fast-path: try_evaluate_expr() + file_macros.
Non-zero integer constant macro (BRIGHTNESS_MAX=255) suppresses violation.
Requires -d prescan for cross-file header macros. Fixes 3 FPs in d_lib_serial_leds.
Juliet CWE-369: zero delta.done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-30T00:24:48Z
t	�t���555INT31-C taint-aware suppression for signed→size_t conversionsDescription:
Reuse ENV03-C's taint-source summary bit to suppress
 INT31-C FPs on Juliet CWE-194/195 helper-function variants.

Details:
DONE. INT31-C FP 2172→1452 (-720), TP 2608→2142 (-466). 1.54:1 FP:TP.

Approach: when the converted variable is inside an `if (var < LIT)`
upper-bound guard (positive literal), suppress iff:
  * the containing function's summary has no taint source, AND
  * no `var = fn(...)` assignment targets a tainted callee, AND
  * for parameters, every caller is taint-free too.

Local-variable case additionally requires evidence of at least one
call-return assignment from a clean callee — prevents over-suppression
of v45-style `int data = global_static;` reads where the global could
have been tainted elsewhere in the project.

Substring bug trap: `decl_text.contains(var_name)` matched `dataBuffer`
when looking for `data`. Fixed by walking the declarator tree to its
leaf identifier for an exact match.

Results: CWE-194 TP rate 58.4% → **67.9%** (+9.5pp). CWE-195 TP rate
48.7% → 51.9% (+3.2pp). Overall TP rate 62.7% → **63.4%** (+0.7pp).
Zero other-rule regressions.

Remaining INT31-C FPs are in v42-style `data = helper(data)` returning
tainted values, v45-style global pointers, and v65a/b function-pointer
cross-file patterns (no call-graph edge). Function-pointer and
return-value taint would be the next wins if pursued.

Original status line: done (v0.3.96)done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z�u
w�w555ENV03-C cross-function taint for helper-sink variantsDescription:
Suppress ENV03-C FPs in Juliet CWE-78 variants 41-45 where
 the popen/system call lives in a helper function receiving data as a
 parameter.

Details:
DONE. ENV03-C FP 612→468 (-144), TP 752→652 (-100). 1.44:1 FP:TP —
diminishing returns as the remaining target shrinks.

New infrastructure:
  * `FunctionSummary.has_env03_taint_source` bit — populated via body
    text scan for recv/fgets/scanf/getenv-style calls (~25 functions).
  * ENV03-C parameter path consults reverse call graph (callee → callers)
    built from `ProjectContext.call_graph`. Suppress only when every
    caller's summary is clean.

Prescan bug fix (affects other inter-procedural rules too):
  * `collect_call_graph` used `.insert()`, so multiple files with `static
    void goodG2B()` overwrote each other and dropped caller edges.
    Changed to `.entry().or_default().extend()` for call edges, and
    OR-merge for `has_env03_taint_source`. Same-named static merging is
    conservative (any tainted def poisons the merged summary).

Results: CWE-78 TP rate 72.3% → 74.1% (+1.8pp). Overall TP rate 62.5% →
62.7% (+0.2pp). Side effect: EXP34-C -6 FP / 0 TP (prescan merging
recovered a few missed caller links).

CWE-426 (Untrusted Search Path): -24 TP / -24 FP — neutral. Remaining
~468 ENV03-C FPs are v42/v22a-style (`data = helper(data)` return-tainted
assignments) and v45-style (global-static pointers) — need return-value
taint or global-write tracking to shrink further.

Original status line: done (v0.3.95)done2026-04-20T16:45:55Z2026-04-20T16:45:55Z2026-04-20T16:45:55Z
�
4��x
_�555Third-party licensing and SBOM generationDescription:
Generate THIRD_PARTY_LICENSES.txt (cargo-about) and a
 CycloneDX SBOM (cargo-cyclonedx) on every release build, following
 the knots pattern.

Details:
Port the knots setup (~/data/knots/about.toml, ~/data/knots/about.hbs,
and the licensing/SBOM steps in ~/data/knots/.github/workflows/build.yml)
into sqc once the repo is on GitHub.

Files to add:
  - `about.toml` — cargo-about license allowlist. Start from the knots
    set: MIT, Apache-2.0 (+ LLVM-exception), BSD-2/3, ISC, Unicode-3.0,
    Unicode-DFS-2016, Zlib, 0BSD, MPL-2.0, CC0-1.0.
  - `about.hbs` — Handlebars template for THIRD_PARTY_LICENSES.txt
    (one block per license with `used_by` crate list + verbatim text).
  - `LICENSE` or `LICENSE-MIT` + `LICENSE-APACHE` — per task 70
    decision.

GitHub Actions steps (on release / tag push):
  - `cargo install cargo-about --locked`
  - `cargo about generate about.hbs -o THIRD_PARTY_LICENSES.txt`
  - `cargo install cargo-cyclonedx --locked`
  - `cargo cyclonedx --format json --spec-version 1.5`
    → produces `sqc.cdx.json`.

Artifact integration:
  - Stage `THIRD_PARTY_LICENSES.txt` and `sqc.cdx.json` alongside the
    binary in the release artifact bundle (task 53).
  - In deb/rpm/AppImage: install to
    `/usr/share/doc/sqc/{THIRD_PARTY_LICENSES.txt,sqc.cdx.json}`
    and `LICENSE` → `copyright` (deb) / `%license` (rpm).

Optional pre-commit / PR check: run `cargo about generate` in CI
without output redirection so a new dependency with a disallowed
license fails the build before merge.done2026-04-20T16:45:55Z2026-05-07T19:21:05Z2026-05-07T19:21:05Z�I
[�;555Migrate sqc from Azure DevOps to GitHubDescription:
Move the sqc repository from ADO to GitHub. Prerequisite for
 any release workflow, external contribution, or public paper artifact.

Details:
sqc is currently hosted on Azure DevOps. Moving to GitHub unblocks:
  - GitHub Actions release workflows (task 53 binary distribution,
    task 71 licensing/SBOM).
  - `sqc-analysis.yml` (already checked in) — SARIF upload to GitHub
    Code Scanning requires the repo to live on GitHub.
  - External visibility for the paper (task 51) and public bug
    reports against real-world benchmark targets (task 47).

Decisions needed before the move:
  - **Licensing.** `Cargo.toml` declares `MIT OR Apache-2.0` but no
    LICENSE file is checked in. Decide between dual-license (ship
    `LICENSE-MIT` + `LICENSE-APACHE`, Rust convention) or pick one.
    Outcome feeds task 71 artifact layout.
  - **Repo name + org** (personal vs. corporate).
  - **History sanitization.** Review for internal paths, proprietary
    codebase references, or customer-specific fixtures that should
    not become public.
  - **Issue / proposal transfer.** AGENTS/PROPOSALS and planning docs
    can move with the repo; ADO work-item history probably cannot.

Move mechanics: mirror-clone ADO repo with full history, push to the
new GitHub remote, archive the ADO project (read-only) for a transition
period, redirect any CI hooks.done2026-04-20T16:45:55Z2026-05-07T19:21:05Z2026-05-07T19:21:05Z
�Td���
+�555Release v0.2.17[Release date not recorded in CHANGELOG — inherited 2026-03-11 from next-newer dated release]

### Fixed

- EXP34-C Phase 3: MEM10-C positive guard suppression (-38 FP). API02-C
  `const wchar_t *` exclusion. API00-C caller-aware suppression via function
  summaries. Prescan local variable tracking for callsite null state resolution.
- CWE-476: TP 313 -> 320 (+7), FP 542 -> 512 (-30), rate 36.6% -> 38.5%.
- CWE-690 bonus: +36 TP, -63 FP.done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z�2
+�=555Release v0.2.16[Release date not recorded in CHANGELOG — inherited 2026-03-11 from next-newer dated release]

### Added

- EXP34-C Phase 2: call-site null propagation. Call-site flagging for
  DefinitelyNull args. Callee param seeding via `infer_arg_null_state()`.
  Multi-pass aggregation with lattice join.
- CWE-476: +19 TP, +17 FP (rate 35.9% -> 36.6%).done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z�m
+�3555Release v0.2.15[Release date not recorded in CHANGELOG — inherited 2026-03-11 from next-newer dated release]

### Added

- EXP34-C Phase 1: CFG-based null state dataflow (`src/analyze/null_state.rs`).
  Forward dataflow with NullState lattice. EXP34-C rewritten from ~1200-line
  linear walk to CFG-based analysis.

### Fixed

- MEM10-C: parameter-only null check fix (-106 FP on CWE-476).
- d_lib_common FP round 2: resolved all 17 FP patterns (~51 violations). Key
  fixes: FIO46-C source-order stream tracking, INT32-C field_expression skip,
  FLP03-C scientific notation, EXP12-C parent-check, INT01-C sizeof skip.
- Juliet: -10,678 FP (-5.4%), TP rate 44.7% -> 44.2%.done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z�)
+�+555Release v0.2.13[Release date not recorded in CHANGELOG — inherited 2026-03-11 from next-newer dated release]

### Added

- INT31-C implicit narrowing assignment detection:
  `check_assignment_conversion()` for `init_declarator` and
  `assignment_expression`. Type width comparison with FP suppressions
  (double-flag, validated vars, bounds-check, literal-fits, bitmask).

### Fixed

- DCL19-C: `STATIC` macro recognition.
- INT32-C: skip unsigned operands in binary overflow checks.
- DCL15-C: skip functions with prototypes in `.h` headers.
- INT36-C: exclude struct field access and array subscript.
- PRE31-C: skip string literal arguments from side-effect analysis.
- EXP30-C: recognize `x = f(x)` as safe.
- INT30-C: detect `if (var > 0)` guard before unsigned decrement.
- DCL07-C/31-C: skip indirect calls and preprocessor-guarded blocks.
- Juliet: 44.6% -> 44.7% TP rate, -13,961 FP (-6.6%).

### Changed

- Prescan: `linkage_specification` (`extern "C" {}`) traversal in all walkers.
  `pointer_declarator` handling for pointer-returning prototypes.
  `header_declared_functions` field in `ProjectContext`.done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z
�L]-���h 
)�+555Release v0.3.3[Release date not recorded in CHANGELOG — inherited 2026-03-11 from next-newer dated release]

### Fixed

- POS49-C: `is_local_variable()` skips stack-local struct member assignments.
- EXP12-C: `connect() != 0` in binary_expression not flagged.
- INT30-C: `is_literal_one()` strips unsigned/long suffixes.
  `is_preceded_by_increment()` checks for `var++`/`++var`/`var += 1` before
  subtraction.done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z�#
+�555Release v0.2.25[Release date not recorded in CHANGELOG — inherited 2026-03-11 from next-newer dated release]

### Fixed

- STR04-C: binary buffer skip, only flag `unsigned char` arrays with string
  literal evidence.
- INT18-C: uint64_t recognition via `type_identifier` nodes.
- EXP05-C: AST-based const detection replacing text-based check.done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z�-
+�3555Release v0.2.22[Release date not recorded in CHANGELOG — inherited 2026-03-11 from next-newer dated release]

### Fixed

- ARR02-C: skip implicit bounds check for string-literal-initialized arrays.
- POS02-C: removed `socket`/`setsockopt` from privileged operations.
- PRE31-C: strip string literal content before function-call pattern checks.
- MEM05-C: ALL_CAPS macro constant VLA detection + word-boundary recursion
  matching.
- INT32-C: `is_inside_bounds_checked_block()` extended to while/for statements.
  `extract_mutation_target()` ensures loop-bounded variable matches operation.
- INT30-C: skip subtraction when either operand is `uint64_t`.
- Const-eval: `ValueRange::shl()` clamps negative shift-amount lower bounds
  to 0.done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z�l
+�1555Release v0.2.21[Release date not recorded in CHANGELOG — inherited 2026-03-11 from next-newer dated release]

### Added

- Const-eval / value-range analysis module (`src/analyze/const_eval.rs`, ~550
  lines). `MacroConstantMap` for `#define` constant collection.
  `ValueRange { min, max }` interval arithmetic. `try_evaluate_expr()` /
  `try_evaluate_range()` for recursive AST constant folding.
  `extract_loop_var_ranges()` for loop bounds. Integrated with INT32-C and
  INT30-C.

### Fixed

- Benchmark measurement: analysis script now outputs all rules (previously top
  10 only). 16 existing runs reanalyzed. Eliminated phantom regressions from
  top-10 truncation.done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z�1
+�;555Release v0.2.20[Release date not recorded in CHANGELOG — inherited 2026-03-11 from next-newer dated release]

### Added

- `-I`/`--include-path` flag: pre-pass extracts `#include` directives, resolves
  against search paths. Transitive include resolution with cycle prevention.

### Fixed

- MSC37-C: `STATIC void` macro prefix, `has_void_specifier()` scans all
  children for `void`.
- INT36-C: `(void)` discard cast, bare `void` no longer matched as pointer
  type.
- PRE02-C: trailing comment stripping in macro values.
- ERR33-C: `(void)` cast recognized as intentional discard.
- CON03-C: skip `const`-qualified variables and synchronization primitive types.
- DCL30-C: scalar value copy through pointer no longer flagged as address
  escape.
- FIO47-C: snprintf argument count corrected (subtract 3, not 1).
- EXP37-C: init_declarator skip for K&R-style declarations.
- API00-C: skip static functions + caller-aware suppression via NotNull.
- INT01-C: eliminated double-visit dedup fix (-3 duplicate violations).
- EXP34-C: array declarations tracked as NotNull in prescan.
- Juliet: -2,720 FP, TP rate 44.1% -> 44.2%.done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z
Hk5	���H�k'
+�/555Release v0.3.18### Added

- Fast benchmark mode: `generate_rule_cwe_map.py` generates 147 per-CWE
  manifest TOMLs. `run_juliet_parallel.sh --fast` uses per-CWE manifests.
  CWE-476 validation: noise 61.8% -> 0%, TP rate 39.5% -> 46.5%.
- INT31-C: `check_call_argument_conversion()` detects signed integer variables
  passed to functions expecting `size_t`. Covers 20 standard library functions.
  Suppressions for explicit cast, sizeof, literals, bounds check, non-negative
  guard.

### Fixed

- Various false positive reduction improvements.done2026-04-20T16:58:08Z2026-03-14T00:00:00Z2026-03-14T00:00:00Z�$&
+�!555Release v0.3.17### Added

- `collect_macro_aliases()` in const_eval.rs for `#define ALIAS identifier`
  patterns. ENV33-C, ENV03-C, STR02-C resolve aliases before matching dangerous
  functions. Windows exec/spawn variants added to ENV33-C.
- ERR33-C CWE-253: validates comparison correctness for functions classified by
  `ErrorReturnKind` (NullPointer, NegativeInt, Eof, NonZero, Count). Macro
  alias resolution + wchar_t variants. CWE-253: 178 TP, 0 FP, 100% precision.done2026-04-20T16:58:08Z2026-03-12T00:00:00Z2026-03-12T00:00:00Z�4%
+�A555Release v0.3.15### Added

- CWE-aware scoring system: 5 new metrics (FLAW-line hit rate, CWE-matched TP
  rate, per-file detection rate, noise ratio, incidental TP/FP).
  `generate_rule_cwe_map.py` produces `data/rule_cwe_map.json` (117 rules to
  144 CWEs). Integrated into analysis pipeline.
- CWE-124, CWE-126, CWE-127 mappings for ARR30-C, ARR38-C, STR31-C.done2026-04-20T16:58:08Z2026-03-12T00:00:00Z2026-03-12T00:00:00Z�$
+�]555Release v0.3.14### Fixed

- Juliet regression investigation: full-suite benchmark 126,106 TP, 158,036 FP,
  44.4% TP rate. Confirmed regression is cumulative effect of individually
  correct suppressions. Discovered scoring methodology issues (off-by-one in
  FLAW-line matching, incidental noise scored as TP).done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z�#
+�555Release v0.3.13[Release date not recorded in CHANGELOG — inherited 2026-03-11 from next-newer dated release]

### Added

- EXP34-C multi-pass prescan propagation: `propagate_param_null_states()`
  resolves relay chains across function call hierarchies.

### Fixed

- EXP33-C for-loop init recognition: `has_preceding_assignment_in_block()` walks
  ancestor scopes. `for_init_assigns_var()` recognizes init clauses as
  dominating assignments. Handles `for (i = 0; ...)`, `for (int i = 0; ...)`,
  and comma expressions.
- INT30-C: `is_subtraction_guarded_by_comparison()` detects `if (a >= b) { a -
  b }` patterns. Supports `>=`, `>`, `<=`, `<` and compound `&&` conditions.
  Generalized `1U`/`1u` suffix handling.done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z�3"
)�A555Release v0.3.8[Release date not recorded in CHANGELOG — inherited 2026-03-11 from next-newer dated release]

### Added

- API00-C: 4 new validation patterns for parameter checking.

### Fixed

- STR31-C: gated string-literal suppression on `!is_function_parameter()` in
  `check_strcpy_safety` and `check_strcat_safety`. Fixed
  `check_sequential_strcat_overflow` to scan only current function's line range.
- EXP33-C: field/subscript write no longer treated as read (-576 FP, -299 TP).done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z�!
)�555Release v0.3.5[Release date not recorded in CHANGELOG — inherited 2026-03-11 from next-newer dated release]

### Added

- Struct field type resolution: prescan collects struct definitions into
  `struct_field_types` in `ProjectContext`. `infer_type()` resolves
  `field_expression` types. Integrated with INT32-C and INT30-C.done2026-04-20T16:58:08Z2026-03-11T00:00:00Z2026-03-11T00:00:00Z
U�'
�gluU�.
+�555Release v0.3.25### Added

- EXP33-C ALLOCA/alloca tracking: `alloca()` and `ALLOCA()` allocations treated
  as uninitialized memory. +52 new TPs.

### Fixed

- EXP33-C conditional init heuristic: broadened from incomplete conditionals to
  any conditional body. New `inits_share_conditional` check. +18 new TPs.
- INT31-C VRA improvement: CWE-194 TP rate 41.7% -> 56.8% (+15.1pp, -310
  FP/-31 TP).
- Juliet (68/68 CWEs): 8,420 TP / 9,371 FP, 47.3% TP rate (+0.6pp).done2026-04-20T16:58:08Z2026-03-20T00:00:00Z2026-03-20T00:00:00Z�t-
+�A555Release v0.3.24### Added

- VRA Phase 5: inter-procedural return ranges. `FunctionSummary` gains
  `return_range: Option<ValueRange>` computed during prescan. VRA transfer
  function resolves `call_expression` RHS using callee return range.
- VRA Phase 6: INT31-C migration. Full VRA integration for
  signed->unsigned, unsigned->signed, and narrowing casts. VRA-based range
  narrowing supplements syntactic `is_inside_bounds_checked_block()`.

### Changed

- Prescan reordered: macro constants collected before function summaries.
- Juliet (67/68 CWEs): 7,393 TP / 8,433 FP, 46.7% TP rate (+2.4pp vs
  v0.3.21). ~6x speedup on large non-VRA CWEs via `compute_return_ranges` flag.done2026-04-20T16:58:08Z2026-03-19T00:00:00Z2026-03-19T00:00:00Z�x,
+�I555Release v0.3.23### Added

- CFG-based forward value-range analysis (`value_range.rs`). Worklist algorithm
  with interval lattice, edge refinement for all comparison/compound operators,
  type-aware initial ranges, widening after 3 back-edge iterations. Computed
  once per file per function, shared across rules via `set_vra_results()`.

### Changed

- INT33-C: `divisor_provably_nonzero()` tries VRA first, falls back to
  syntactic analysis.
- INT34-C: `check_shift_operation()` tries VRA first for shift amount range.
- INT32-C: all 6 `expression_fits_in_signed` call sites use VRA-backed version.
- INT30-C: all 4 `expression_fits_in_unsigned` call sites use VRA-backed
  version.done2026-04-20T16:58:08Z2026-03-19T00:00:00Z2026-03-19T00:00:00Z�+
+�555Release v0.3.22### Fixed

- ARR38-C: function-scoped alias resolution prevents cross-function
  contamination. Skip heuristic checks when buffer size is verified. CWE806:
  function-scoped `find_content_size_in_function()` tracks `memset(var, char,
  N)`. -183 CWE806 FP, -69 CWE805 FP.
- ARR30-C: multi-assignment constant resolution via
  `try_resolve_variable_to_constant`. Extract only condition from AST instead
  of searching full if-body text. -67 CWE129 FP.done2026-04-20T16:58:08Z2026-03-19T00:00:00Z2026-03-19T00:00:00Z�*
+�555Release v0.3.21### Added

- CWE-121/122 buffer overflow detection: ARR30-C gains literal loop bounds,
  ALLOCA tracking, pointer alias tracking. ARR38-C gains ALLOCA detection,
  strlen/wcslen overflow, snprintf variants, pointer alias resolution,
  N*sizeof(type) parsing.
- Juliet: CWE-121 39.3% -> 39.9% TP rate, CWE-122 41.7% -> 36.6%.done2026-04-20T16:58:08Z2026-03-19T00:00:00Z2026-03-19T00:00:00Z�`)
+�555Release v0.3.20### Changed

- Benchmark infrastructure overhaul: new `bench/` package replaces shell scripts
  with Python runner + SQLite. `bench/runner.py` with `ProcessPoolExecutor`,
  `bench/analyzer.py` for TP/FP classification, `bench/db.py` with 7-table
  schema in WAL mode. MCP server updated to query SQLite first with legacy
  fallback. `scripts/backfill_juliet_results.py` imported 21 Juliet + 7
  real-world runs. Fast mode default with resume support.
- First 68-CWE fast benchmark: 8,413 TP / 10,484 FP, 44.5% TP rate.done2026-04-20T16:58:08Z2026-03-18T00:00:00Z2026-03-18T00:00:00Z�s(
+�?555Release v0.3.19### Fixed

- ENV03-C: function-scoped clearenv() checks sanitization per-function instead
  of file-level.
- STR02-C: intra-function taint tracking (recv, fgets, fgetws, scanf, getenv,
  etc.) with cast handling and propagation.
- CWE-78 precision: 42.0% -> 45.5%, FP -330, TP -78.done2026-04-20T16:58:08Z2026-03-15T00:00:00Z2026-03-15T00:00:00Z
����G2
+�g555Release v0.3.30### Fixed

- EXP34-C: replaced lattice join in `aggregate_callsite_null_states()` with
  count-based voting. One PossiblyNull callsite no longer poisons parameters
  with 50 NotNull callers. EXP34-C: 26,457 -> 5,290 (-80.0%) across 5
  real-world codebases.
- Juliet: 8,285 TP / 9,180 FP, 47.4% TP rate. CWE-690 TP rate 83.8% -> 94.3%
  (+10.5pp). Zero regressions.done2026-04-20T16:58:08Z2026-03-22T00:00:00Z2026-03-22T00:00:00Z�q1
+�;555Release v0.3.28### Added

- `--save-prescan FILE` / `--load-prescan FILE` CLI flags for
  serializing/deserializing `ProjectContext` to binary cache (bincode format).
  Cache sizes: ~3.6 MB for hostap (12K functions), ~2.4 MB for sqlite.
  Per-worker speedup: hostap 11.2s -> 0.8s (93%), sqlite prescan 866s -> 0s.
  New dependency: `bincode = "1.3"`.
- Persistent prescan cache at `data/prescan_cache/{codebase}.cache` with
  `--rebuild-prescan` flag for regeneration.

### Changed

- Parallel scanner: balanced subdirectory splitting via recursive
  `find_scan_units()`, prescan cache integration, prescan timeout increased
  600s -> 1800s, graceful `TimeoutExpired` fallback.done2026-04-20T16:58:08Z2026-03-21T00:00:00Z2026-03-21T00:00:00Z�10
+�;555Release v0.3.27### Added

- `rules-benchmark.toml` manifest with 13 style/recommendation rules disabled
  (zero Juliet CWE contribution, ~114K realworld violations): EXP19-C, DCL08-C,
  DCL06-C, EXP02-C, EXP14-C, EXP12-C, EXP10-C, DCL04-C, INT02-C, INT01-C,
  INT17-C, INT16-C, PRE31-C.
- Parallel sqc scanner (`scripts/sqc_parallel_scan.py`): splits codebases by
  subdirectory, runs multiple sqc processes via `ProcessPoolExecutor`,
  auto-detects parallelism, deduplicates merged JSON outputs.

### Fixed

- POS49-C: restricted from all shared struct field writes to only actual
  bit-field writes. `collect_bitfield_names()` identifies fields with
  `bitfield_clause`. 15,693 -> 107 violations (-99.3%).

### Changed

- All benchmark infrastructure updated to use `rules-benchmark.toml`.
- MCP realworld server uses parallel scanner with `rebuild_prescan` parameter.done2026-04-20T16:58:08Z2026-03-21T00:00:00Z2026-03-21T00:00:00Z�l/
+�1555Release v0.3.26### Fixed

- EXP33-C: conditional init early-return detection. If/else-if/else chains
  where non-initializing branches have unconditional exits no longer flag as
  uninitialized. New `if_chain_covers_init_or_exit()` analysis.
- ERR33-C (CWE-253): `== 0` for NonZero functions and Count functions no longer
  incorrectly flagged.
- FIO47-C: fixed 100% FP rate (0 TP, 119 FP -> 0 FP). Root cause:
  `count_arguments()` miscounted non-data args for `sprintf`/`sscanf`/`dprintf`.
  Relaxed format validation: `%lf` valid in C99+, removed `'` flag and
  `+/space` with `%o/%u/%x` checks.
- PRE00-C: restricted from all function-like macros to only macros with
  multi-evaluation risk or side effects.
- EXP34-C: pointer function parameters default to NotNull when no
  inter-procedural call-site data exists.
- Juliet: 8,390 TP / 9,252 FP, 47.6% TP rate (+0.3pp). FIO47-C: 119 FP -> 0.
  CWE-134 TP rate 33.4% -> 47.9% (+14.5pp).
- Real-world: -5,366 violations (-1.5%). PRE00-C -4,274, EXP34-C -1,758.
  Cumulative from v0.3.5: -48,086 (-11.9%).done2026-04-20T16:58:08Z2026-03-20T00:00:00Z2026-03-20T00:00:00Z

���
5
+�m555Release v0.3.33### Changed

- EXP33-C: complete rewrite from AST-walk to CFG-based forward dataflow
  analysis. New `init_state.rs` (~1,200 lines) with `InitState` lattice (5
  states: `Uninitialized`, `MaybeUninitialized`, `Initialized`,
  `MallocUninitialized`, `MallocInitialized`), forward worklist algorithm, and
  point queries via `get_var_info_at()`. New capabilities: branch-sensitive
  analysis, loop-aware array init, malloc content tracking, realloc wrapper
  detection, conditionally-initializing function detection, ~30 initializing
  functions with per-argument output indices, non-initializing function list,
  file-scope static variable tracking, subscript read extraction through
  `field_expression` chains.
- API00-C refinements.
- CFG `condition_range` support.
- Realworld benchmark MCP server enhancements (SQLite-first pattern,
  `get_rule_trend`, `get_project_history`).
- bench/db.py improvements.

### Removed

- Legacy shell scripts: batch_analyze_sqlite, bench_mosquitto_versions,
  compare_tools, run_juliet_multi_cwe, run_juliet_parallel, test_single_file.done2026-04-20T16:58:08Z2026-03-23T00:00:00Z2026-03-23T00:00:00Z�s4
+�?555Release v0.3.32### Fixed

- DCL07-C/DCL31-C FP reduction (-11,556 real-world violations, -7.1%). Three
  root causes addressed:
  1. Prescan deep recursion: `collect_function_names` now recurses into ALL
     child nodes (not just `preproc_*` blocks), finding functions inside ERROR
     nodes from tree-sitter misparses.
  2. Macro alias integration: DCL rules now check `macro_aliases` from prescan.
  3. External library whitelist: OpenSSL, Tcl/Tk, Apple CoreFoundation,
     mbedTLS, cJSON, zlib, GnuTLS, wolfSSL prefixes. `defined` operator
     skipped.
- DCL07-C: 10,617 -> 4,765 (-55.1%). DCL31-C: 10,543 -> 4,840 (-54.1%).
- Juliet: zero change (47.0% TP rate preserved).done2026-04-20T16:58:08Z2026-03-22T00:00:00Z2026-03-22T00:00:00Z�y3
+�K555Release v0.3.31### Fixed

- INT07-C: skip `char *` pointer/array declarations in
  `is_plain_char_declaration`. 96.5% of violations were pointer arithmetic.
  6,230 -> 207 (-96.7%).
- ERR33-C: fixed duplicate violation bug (standalone calls emitted via both
  paths). Suppressed printf/puts/putchar/fputs/fputc/putc, `fprintf(stderr,
  ...)`, `signal(SIG*, SIG_IGN/SIG_DFL)`, `time(&t)` with output parameter.
  Recognized `==0`/`!=0` as NULL checks. Added `putenv`/`strdup`/`strndup`.
  7,182 -> 1,807 (-74.8%).
- MSC41-C: removed overly broad substring keywords (`db`, `connect`). Strict
  word boundaries for `key`/`token`. Leading boundaries for
  `auth`/`login`/`pwd`/`database`. Always apply `looks_like_sensitive_data()`
  heuristic. Added `looks_like_sensitive_in_context()`. 3,954 -> 293 (-92.6%).
- ARR00-C: rewrote `is_array_identifier()` from text-search to AST-based
  `has_array_declaration()`. Guarded checks with array-only. Fixed
  `check_array_assignment` to skip compound assignments. 7,341 -> 2,637
  (-64.1%).
- EXP33-C: added `scanf`/`fscanf`/`sscanf` `&var` argument initialization.
  Added 15 for-each macro patterns. 4,554 -> 4,189 (-8.0%).
- Juliet: 8,156 TP / 9,180 FP, 47.0% TP rate. -129 TP from intentional printf
  suppression. Zero FP change.
- Real-world: 182,020 -> 161,893 (-20,127, -11.1%).done2026-04-20T16:58:08Z2026-03-22T00:00:00Z2026-03-22T00:00:00Z
�O
��"9
+�555Release v0.3.37### Fixed

- FIO30-C CWE-134 format string taint improvements. Three fixes unlock
  detection across all taint source patterns:
  - recv/recvfrom/recvmsg taint tracking: socket receive functions added to
    `process_string_manipulation_call`, handles cast expressions in buffer arg.
  - Macro alias resolution: integrated `const_eval::collect_macro_aliases` for
    `#define GETENV getenv` indirection. All function name lookups go through
    `resolve_func_name()`.
  - `get_base_variable` expression handling for `cast_expression`,
    `parenthesized_expression`, and `binary_expression`.
- Juliet (v0.3.35-v0.3.37 combined vs v0.3.34): TP 8,300 -> 8,508 (+208),
  FP 9,157 -> 9,067 (-90), TP rate 47.5% -> 48.4% (+0.9pp). Zero regressions.
- Real-world: 152,590 -> 153,568 (+978, +0.6%). ARR36-C +2,727 (strchr fires
  broadly on real-world pointer arithmetic). Excluding ARR36-C, net -1,749 FP.
- Source commits pinned in BENCHMARK_INSTALL.md for all 5 codebases.done2026-04-20T16:58:08Z2026-03-23T00:00:00Z2026-03-23T00:00:00Z�8
+�c555Release v0.3.36### Added

- ARR36-C CWE-469: strchr/wcschr cross-array subtraction detection.
  `PointerAnalyzer` tracks `strchr`, `strrchr`, `wcschr`, `wcsrchr`, `memchr`,
  `strstr`, `wcsstr`, `strpbrk`, `wcspbrk` return values as pointing into
  first argument. Array declarations treated as own base. Assignment expressions
  tracked for pointer origin resolution. 36/36 TP, 0 FP.
- STR03-C CWE-464: `(char)atoi()` null sentinel detection. Covers `strtol`,
  `strtoul`, `atol` with char cast. 38/38 TP, 0 FP.
- API07-C CWE-843: void* type confusion detection. Tracks `void*` assignments,
  detects dereference with incompatible cast where cast type is larger than
  source type. 40/40 TP, 0 FP.done2026-04-20T16:58:08Z2026-03-23T00:00:00Z2026-03-23T00:00:00Z�B7
+�]555Release v0.3.35### Added

- API07-C CWE-761: free-pointer-not-at-start detection. Tracks
  `malloc`/`calloc`/`realloc` assignments, detects `ptr++`/`ptr+=N`/`ptr--`
  modifications, flags subsequent `free(ptr)`. Handles reassignment and
  reallocation resets.

### Fixed

- EXP33-C: `extract_nested_base_ex()` recurses through nested subscript/field
  chains (`arr[0].field` -> `arr`). `MallocUninitialized` + subscript-in-chain
  -> `MallocInitialized`. `match_initializing_function()` suffix-matches wrapper
  functions (`os_memset` -> `memset`). `*zalloc()` recognized as
  zero-initializing allocator.
- ARR00-C: `find_pointer_source_array()` recursively resolves pointer
  derivation chains (depth limit 5). Eliminates FPs on `end - pos` buffer
  arithmetic.
- ERR33-C: printf-family return value checks suppressed (`fprintf`, `sprintf`,
  `snprintf`, `vprintf`, `vfprintf`, `vsprintf`, `vsnprintf`).

### Changed

- BENCHMARK_INSTALL.md: updated sqc examples from `rules-all.toml` to
  `rules-benchmark.toml`.done2026-04-20T16:58:08Z2026-03-23T00:00:00Z2026-03-23T00:00:00Z�.6
+�5555Release v0.3.34### Fixed

- EXP33-C critical bug: functions inside `#ifdef`/`#ifndef`/`#if` preprocessor
  blocks were silently skipped. The guard condition `node.kind() !=
  "translation_unit"` excluded all non-top-level parents. Removed incorrect skip
  condition.
- EXP33-C: field-write `MallocUninitialized` preservation re-applied. Field
  writes on malloc'd pointers no longer upgrade to `MallocInitialized`. Stack
  struct field writes still upgrade `Uninitialized` -> `Initialized`.
- Reverted `extract_field_base` nested subscript resolution (caused premature
  `Initialized` marking on first element write).
- Juliet (vs v0.3.32): TP 8,156 -> 8,300 (+144), FP 9,180 -> 9,157 (-23),
  TP rate 47.0% -> 47.5%. EXP33-C: 294/561 -> 431/559.
- Real-world (vs v0.3.32): 150,337 -> 152,590 (+2,253). EXP33-C +2,899
  (hostap +2,525) from `arr[0].field` limitation.done2026-04-20T16:58:08Z2026-03-23T00:00:00Z2026-03-23T00:00:00Z
���*��s=
+�?555Release v0.3.43### Added

- MSC12-C dead code / no-effect detection (CWE-561) with 4 detection patterns:
  no-effect expression statements (comparisons as statements, bitwise/shift with
  discarded result, wasted dereferences, bare identifiers), duplicate conditions
  in if/else-if chains, redundant sub-expressions in logical operators, and
  meaningless `continue` at end of loop body. Exceptions for `(void)` casts,
  function calls in conditions, and function calls in logical sub-expressions.
  12 wiki tests (5 fail + 7 pass).
- Wildcard suppression in `.sqc-suppress.toml` via `[[wildcard]]` TOML section.
  Supports `file_glob`, `rule`, `rule_glob`, `function_prefix`, and
  `justification` fields (all ANDed). Hash-matched suppressions take priority.
  Glob patterns compiled to regex at load time.done2026-04-20T16:58:08Z2026-03-25T00:00:00Z2026-03-25T00:00:00Z�5<
+�C555Release v0.3.42### Fixed

- const_eval.rs: double-nested parens now handled via loop-based stripping.
- DCL02-C: function-scope declarations checked via `init_declarator` +
  root-node traversal.
- EXP40-C: per-scope const variable tracking (was only double-pointer).
- STR34-C: `init_declarator` path + parameter tracking + per-function scoping.
- CON34-C: thread-unsafe function detection via banned function list.
- CON07-C: unprotected shared variable access via file-scope global collection.
- MSC38-C: test reclassified to SIG30-C (already detected).
- ERR01-C: errno-setting function detection for strtol/sqrt.
- MEM10-C: `sizeof(pointer)` misuse detection in alloc/memory calls.
- POS50-C: TOCTOU race detection (`stat()` then `fopen()` on same path).
- DCL17-C: K&R style function declaration + empty param list detection.
- CWE-480 (EXP16-C): AST-based function name collection + NULL recognition.
- CWE-482 (EXP16-C): dead comparison detection.
- CWE-367 (FIO01-C): `access()`/`stat()` + `open()` TOCTOU detection.

### Changed

- Benchmark analyzer: `parse_c_file_sections()` now performs call-graph analysis
  to reclassify helper functions defined outside `#ifndef OMITBAD`/`#ifndef
  OMITGOOD` guards. +52 TP, +5 FP across all runs. 18 historical runs
  retroactively corrected (969 total violations reclassified).
- Coverage gate raised from 79% to 80%. Current: 80.06%.done2026-04-20T16:58:08Z2026-03-25T00:00:00Z2026-03-25T00:00:00Z�L;
+�q555Release v0.3.39### Fixed

- ARR36-C real-world FP reduction (-82%). Per-function scoping fixes
  cross-function variable name collisions. Identifier chain resolution follows
  `variable_arrays` for known identifiers. Compound assignment (`+=`/`-=`) no
  longer overwrites array base. `os_*` wrapper recognition for `os_strchr`,
  `os_strstr`, `os_strrchr`, etc. Allocation functions get unique per-call
  bases. Address-of vs dereference distinction. File-scope + bare declaration
  tracking.
- Juliet: zero delta (8,508 TP, 9,067 FP, 48.4% TP rate).
- Real-world: 157,688 -> 153,156 (-4,532, -2.9%). ARR36-C 4,685 -> 829
  (-3,856, -82.3%).done2026-04-20T16:58:08Z2026-03-24T00:00:00Z2026-03-24T00:00:00Z�L:
+�q555Release v0.3.38### Fixed

- EXP33-C: conditional-init, cast unwrap, and array arg fixes for real-world
  FP reduction.

### Changed

- DCL31-C/DCL07-C: removed library-specific whitelists, added `-I` include
  paths for system-installed third-party headers.done2026-04-20T16:58:08Z2026-03-24T00:00:00Z2026-03-24T00:00:00Z

��I?
+�k555Release v0.3.46### Changed

- P3214-driven FP reduction: 17 rules improved across 5 rounds. Validated
  against P3214 Secondary MCU firmware (8051, Keil C51). Zero Juliet
  regressions across both v0.3.45 and v0.3.46 benchmark runs (51.1% held).
- DCL18-C: skip zero with type suffix (0U, 0u, 0L, 0UL) — not octal confusion.
- DCL08-C: skip enums with consecutive integer sequences (0,1,2 or 1,2,3).
- PRE02-C: skip do{...}while(0) macros and (type)(expr) cast-wrapped macros.
- EXP35-C: arrow operator (->) means pointer return, not temporary struct.
- INT36-C: distinguish bitwise AND (&) from address-of; skip *ptr dereference.
- EXP07-C: skip bit-position shifts (0-7) — standard bit manipulation idioms.
- DCL19-C: skip volatile variables (ISR-shared) and STATIC macro declarations.
- INT17-C: skip hex constants ≤0xFFFF — portable across all C implementations.
- EXP10-C: skip || and && operators — C guarantees left-to-right evaluation.
- PRE08-C: skip self-matches (same filename compared to itself).
- DCL30-C: only flag pointer/array locals assigned to globals, not integer copies.
- EXP02-C: treat func()->field as pure getter read, not a side effect.
- INT34-C: recognize modulo expression (% N) as shift-amount bounds check.
- API00-C: recognize any token containing "STATIC" as static-equivalent macro
  (covers LIN_STATIC_INLINE, MY_STATIC_FUNC, etc.).
- EXP14-C: only flag ~ (bitwise NOT) and << (left shift) for promotion risk;
  skip &, |, ^, >> which are safe with unsigned operands.
- DCL17-C: skip simple volatile reads/writes; only flag compound operations
  (++, --, +=, -=) where read-modify-write may be non-atomic.
- INT14-C: skip 2-char loop index variables (bi) for mixed bitwise+arithmetic.
- INT30-C: skip narrow unsigned types (uint8_t, uint16_t) — promoted to int
  (≥32-bit) before arithmetic, cannot overflow promoted type. Preserved actual
  declared type from type_map instead of returning generic "unsigned".

### Results

- Juliet: 8,383 TP / 8,020 FP, 51.1% TP rate (unchanged from v0.3.44).
  Zero delta on all 69 CWEs across both v0.3.45 and v0.3.46 runs.
- P3214 Secondary MCU: 1,372 → 476 violations (-896, -65.3%).done2026-04-20T16:58:08Z2026-03-28T00:00:00Z2026-03-28T00:00:00Z�1>
+�;555Release v0.3.44### Changed

- ENV33-C: taint-source heuristic suppression for system()/popen(). Functions
  with no tainted input sources (recv, fgets, getenv, scanf, etc.) and no
  pointer/string parameters are suppressed. String literal arguments and
  cross-function sinks with char* params remain flagged. Macro aliases
  (#define SYSTEM system) resolved via project context.
- FLP03-C: removed overbroad check_fp_conversion() that flagged all
  float/double cast expressions. Added divide-by-zero guard detection:
  fabs/fabsf/fabsl magnitude checks, != 0, > 0, < 0 conditions suppress
  guarded divisions.

### Results

- Juliet TP rate: 48.4% -> 51.1% (+2.7pp). **P0 milestone achieved.**
- Total: TP 8,508->8,383 (-125), FP 9,067->8,020 (-1,047). 8.4:1 FP:TP ratio.
- ENV33-C: -818 FP/-139 TP (5.9:1). FP rate 58%->24.6%.
- FLP03-C: -234 FP/-70 TP (3.3:1). FP rate 69%->58.2%.
- CWE-78: TP rate 45.5%->63.0% (+17.5pp).
- CWE-369: TP rate 33.6%->36.9% (+3.3pp).
- Bonus: CWE-367 +15 TP, CWE-479 +36 TP, CWE-480 +10 TP, CWE-482 +7 TP
  (from v0.3.43 MSC12-C/wildcard rules newly matched to CWEs).
- Realworld: 154,598->154,603 (+5, flat). FLP03-C -164 (-43%, clean).
  ENV33-C -1. EXP16-C +160 regression in sqlite (unrelated, needs investigation).done2026-04-20T16:58:08Z2026-03-26T00:00:00Z2026-03-26T00:00:00Z
ii�A
+�555Release v0.3.48### Fixed

- analyze: resolve_includes now runs even when --load-prescan is set. Previously
  -I include paths were silently ignored during parallel scans (sqc_parallel_scan.py),
  causing DCL31-C/DCL07-C to flag functions declared in system headers.
  Realworld impact: DCL31-C+DCL07-C 14,657 → 3,772 (-10,885, -74%).
  Overall: 154,603 → 142,185 (-12,418, -8.0%).
- MEM04-C: sizeof() expressions now recognized as always non-zero in
  is_potentially_zero(). malloc(sizeof(int)) no longer falsely flagged.
- FIO10-C: POSIX rename() with return value check accepted as compliant.
  On POSIX, rename() atomically replaces the destination, so checking the
  return value is sufficient handling (task 18).

### Added

- test infra: `// sqc-test: prescan` marker for .c test files (task 19).
  build.rs detects the marker and generates tests that build intra-file
  prescan context (function summaries + call-site null states + CFGs) before
  calling rule.check(). Enables testing inter-procedural analysis patterns
  within a single translation unit.
- prescan: added prescan_single_tree() — builds ProjectContext from a single
  parsed tree for use in integration tests.
- analyze: collect_function_cfgs() now public for test use.
- EXP34-C: 3 intra-file null deref tests moved from pass/ to fail/ using
  prescan marker (func_param, list_null, callback_null). All correctly detect
  violations via call-site null state propagation.
- FIO10-C: added pass/testcases_posix_rename.c for POSIX error-checked rename.

### Changed

- WIN30-C: NULL security attributes test reclassified as out of scope.
  CreateFileA/CreatePipe security attributes are not related to WIN30-C
  (alloc/dealloc pairing). Test comment updated.done2026-04-20T16:58:08Z2026-03-29T00:00:00Z2026-03-29T00:00:00Z�~@
+�U555Release v0.3.47### Changed

- FIO24-C: added double-close detection for fclose/close/CloseHandle/closesocket.
  Tracks closed variables per function; flags duplicate close without intervening
  reopen. Resolves CWE-675 (224 Juliet files, 93.0% TP rate).
- POS37-C: added unchecked Windows privilege API return value detection
  (ImpersonateNamedPipeClient, RpcImpersonateClient, ImpersonateLoggedOnUser,
  CoImpersonateClient, ImpersonateSelf, SetThreadToken). Resolves CWE-273
  (36 Juliet files, 100% TP rate).
- DCL30-C: skip return of pointer to static local address. When a local pointer
  is assigned from &static_var[i], returning it is safe. Eliminates CWE-562 FP.
- MSC37-C: skip phantom functions from preprocessor-broken else-if chains.
  tree-sitter misparses disconnected else-if as function definitions.
- MSC37-C: recognize else_clause nodes in all-branches-return check. if/else
  where both branches return was falsely flagged.
- INT33-C: recurse into nested blocks for zero-guard detection. Guards inside
  outer if-blocks (e.g., null-check wrapping a zero-check) now recognized.
- INT34-C: recognize (mask >> var) != 0 loop condition as shift-amount bound.
  while ((mask >> bi) != 0u) implicitly constrains bi to < bit width.
- rule_cwe_map: added MSC12-C → CWE-561 mapping.
- INT32-C: scope type_map per function definition. Two functions declaring
  same variable name with different types (float X_pred vs int32_t X_pred)
  no longer collide — each function gets its own type map.
- DCL06-C: accept float zero literals (0.0f, 1.0f, etc.) as non-magic.
  Strip float/unsigned suffixes before checking acceptable values.
- FLP02-C: skip equality comparisons against exact zero (0.0, 0.0f). Zero
  is exactly representable in IEEE 754 — divide-by-zero guards are valid.
- bench/analyzer.py: fixed CSV parser regex for version:HASH suffix that broke
  line number extraction when commit hash started with a digit.

### Results

- 3 formerly zero-detection CWEs now detecting: CWE-675 (80 TP, 93.0%),
  CWE-273 (72 TP, 100%), CWE-562 (2 TP, 66.7% → 100% after DCL30-C fix).done2026-04-20T16:58:08Z2026-03-29T00:00:00Z2026-03-29T00:00:00Z
]
��	�P]�pF
+�9555Release v0.3.56### Added

- EXP34-C: variant 63 pointer-to-pointer null propagation. When caller passes
  &data where data=NULL, prescan tracks the pointee null state through
  callsite_param_pointee_null_states in FunctionSummary. Null state analysis
  seeds "*paramName" into initial state; transfer function propagates *ptr
  dereference. +6 TP, 0 FP across all 6 data types in CWE-476 variant 63.
- EXP34-C: variant 64 void pointer cast propagation. Cast expressions
  (dataPtr = (int**)dataVoidPtr) preserve "*" state keys. Parenthesized
  dereference form (*dataPtr) unwrapped for variant 63/64. +6 TP, 0 FP.
- EXP34-C: variant 66 array element null propagation. Prescan tracks
  subscript_expression assignments (arr[idx] = expr) as "arr.idx" dotted
  keys, reusing the struct field mechanism. Transfer function handles
  subscript_expression lookups. +6 TP, 0 FP.
- 6 new EXP34-C regression tests for variants 63, 64, and 66.done2026-04-20T16:58:08Z2026-04-01T00:00:00Z2026-04-01T00:00:00Z�E
+�{555Release v0.3.52### Changed

- EXP33-C: partial init array detection. Track allocation element count from
  malloc/ALLOCA calls; compare for-loop bound vs allocation count. If loop
  bound < allocation count, content stays MallocUninitialized (partial init).
  Detects 6 partial_init array types across all 18 Juliet variants (+102 TP).
- init_state: dead-branch elimination for constant conditions. Collect
  file-scope static [const] constants; evaluate branch conditions at analysis
  time; skip impossible edges. Handles literal (if(1)), const expr (if(5==5)),
  and static const/var conditions (if(STATIC_CONST_TRUE), if(staticTrue)).
  Eliminates opaque predicate FPs in Juliet variants 02-07 (-198 FP).
- const_eval: added comparison operators (==, !=, <, >, <=, >=) to
  try_evaluate_expr(). Enables constant condition evaluation.
- prescan: collect global constants from prescanned directories. Non-static
  const/non-const globals with compile-time values stored in
  ProjectContext.global_constants. Merged with macro_constants into EXP33-C
  file_scope_constants for cross-file dead-branch elimination (variants 09-14).

### Results

- CWE-457: 422 TP/715 FP (37.1%) → 524 TP/517 FP (50.3%). +102 TP, -198 FP,
  +13.2pp TP rate. Per-file detection 68.5% → 85.1%.
- Overall: 51.6% → 51.9% (+0.3pp). +101 TP, -200 FP. Zero regressions.done2026-04-20T16:58:08Z2026-03-31T00:00:00Z2026-03-31T00:00:00Z�D
+�555Release v0.3.51### Added

- MSC07-C: unreachable code detection (BRULE-034 gap). AST-based detection of
  statements after unconditional return/break/continue/goto and noreturn calls
  (exit, abort, _Exit, longjmp, quick_exit, thrd_exit, ExitProcess, ExitThread).
  Reports only first unreachable statement per terminal. CWE-561 mapping.
  11 tests: 7 fail, 4 pass.
- MSC04-C: bounded recursion suppression. If a recursive function has a
  parameter-dependent base case (conditional return checking a parameter),
  the violation is suppressed. CWE-674: 2 TP/2 FP → 1 TP/0 FP (100% TP rate).done2026-04-20T16:58:08Z2026-03-30T00:00:00Z2026-03-30T00:00:00Z�8C
+�I555Release v0.3.50### Changed

- prescan: detect (type *)param cast pattern as dereference in function
  summaries. Enables EXP33-C variant 64 (void* → cast → deref) detection.
  CWE-457: +10 TP, +10 FP (void pointer indirection types).done2026-04-20T16:58:08Z2026-03-30T00:00:00Z2026-03-30T00:00:00Z�@B
+�Y555Release v0.3.49### Changed

- EXP33-C: cross-file inter-procedural init tracking via set_project_context().
  build_read_only_deref_fns(): dereferences_params - modifies_params.
  InitAnalysisConfig.read_only_deref_fns prevents &var from being marked
  initialized when callee only reads through the pointer.
  check_cross_file_uninit_calls: flags calls passing &uninit_var to functions
  that read the pointed-to value (variant 63 pattern).
  CWE-457: +10 TP, +10 FP (10 simple scalar/pointer types).done2026-04-20T16:58:08Z2026-03-30T00:00:00Z2026-03-30T00:00:00Z
�R��I
+�a555Release v0.3.59### Added

- MSC42-C: new rule for CWE-327 broken/weak crypto algorithm detection. Blacklist:
  CALG_DES, CALG_3DES, CALG_RC5, CALG_RC2, CALG_RC4 in CryptDeriveKey/CryptGenKey.
  Also detects weak OpenSSL ciphers (EVP_des_*, DES_*, EVP_rc4, EVP_rc2_*).
  54 TP/0 FP (100%).
- WIN05-C: new rule for CWE-272 unquoted CreateProcess path detection. Two
  sub-patterns: unquoted paths with spaces in CreateProcessA/W/AsUser (path
  interception), HKEY_LOCAL_MACHINE in registry operations (excessive privilege).
  254 TP/64 FP (79.9%).
- ARR39-C: CWE-468 incorrect pointer scaling fix. Case-insensitive pointer name
  matching, added "pointer" keyword. Detects double-scaling pattern.
  19 TP/32 FP (37.3%).
- MSC41-C: CWE-259 hard-coded password improvements. Added "logon" to sensitive
  function keywords, added #define macro detection for sensitive-named macros.
  0 TP/0 FP on Juliet (tree-sitter preprocessor limitation).

### Results

- Juliet v0.3.59: 23,678 TP / 21,117 FP — 52.9% TP rate (+0.3pp from v0.3.58).
  +327 TP, +96 FP. 74 CWEs covered (up from 70).done2026-04-20T16:58:08Z2026-04-01T00:00:00Z2026-04-01T00:00:00Z�:H
+�M555Release v0.3.58### Added

- SIG31-C + SIG34-C: CWE-364 signal handler race condition detection. Mapped
  existing rules to CWE-364. 54 TP/51 FP (51.4%).
- MSC12-C: CWE-398 poor code quality — extended with 7 new patterns: empty
  control flow bodies, empty function bodies, standalone empty blocks, empty
  switch cases, stray semicolons, arithmetic no-effect, self-assignment.
  181 TP/2 FP (98.9%).
- MSC13-C: new rule for CWE-563 unused variable detection. Detects unused
  initialized/uninitialized local variables and dead stores. Struct field write
  not counted as read. 289 TP/0 FP (100%).

### Results

- Juliet v0.3.58: 23,351 TP / 21,021 FP — 52.6% TP rate (+0.5pp from v0.3.56).
  +524 TP, +53 FP. Zero regressions on 70 existing CWEs.done2026-04-20T16:58:08Z2026-04-01T00:00:00Z2026-04-01T00:00:00Z�+G
+�/555Release v0.3.57### Fixed

- STR03-C, INT00-C, INT16-C: resolved 3 remaining implementation bugs.done2026-04-20T16:58:08Z2026-04-01T00:00:00Z2026-04-01T00:00:00Z
���M
+�y555Release v0.3.63### Added

- BRULE-065: pointer indirection depth check. Flags declarations with excessive
  pointer indirection (e.g., `int ***p`). Handles parameter declarations,
  init_declarators, and nested declarator chains. First non-CERT rule —
  established `src/rules/brules/` directory structure.
- `expected_fail/` test directory for known analysis limitations. build.rs
  generates tests with `#[ignore = "Known limitation: ..."]`. Run with
  `cargo test -- --ignored` to check for improvements.

### Fixed

- MSC13-C: compound assignment LHS (`+=`, `-=`, etc.) now recognized as a read.
  `is_read_context()` checks assignment operator type; `collect_all_assignments()`
  only collects simple `=` assignments.
- INT34-C: AST-based unsigned type detection from function parameter declarations.
  Replaced string matching with `decl_has_unsigned_var()` and correct
  `find_parameter_list()` traversal.
- Number of additional fixes (see commit history).done2026-04-20T16:58:08Z2026-04-01T00:00:00Z2026-04-01T00:00:00Z�SL
+�555Release v0.3.62### Fixed

- Resolved all 5 pre-existing test failures (CON08-C, DCL20-C, INT08-C, EXP15-C).
  Zero test failures remain.done2026-04-20T16:58:08Z2026-04-01T00:00:00Z2026-04-01T00:00:00Z�K
+�	555Release v0.3.61### Added

- Man page (`docs/sqc.1`) covering all 16 CLI options, exit codes, rules manifest
  and suppression file config, 7 usage examples, and cross-references.
  View with: `man -l docs/sqc.1`.
- Test coverage gate raised from 80% to 81% (1,350 additional lines covered).
  75+ new `.c` test files across 10 rules.done2026-04-20T16:58:08Z2026-04-01T00:00:00Z2026-04-01T00:00:00Z�rJ
+�=555Release v0.3.60### Added

- EXP39-C: CWE-188 struct memory layout assumption detection. Two new checks:
  (1) struct field pointer arithmetic — flags *(T*)(ptr + offset) where ptr was
  assigned from &struct.field, (2) union type punning — flags sub-field access
  into struct member of union after writing to a different scalar member.
  36 TP/0 FP (100%). All 36 Juliet files detected.
- FIO42-C: CWE-459 incomplete temp file cleanup. Detects mkstemp/mktemp/MKSTEMP
  /MKTEMP calls without corresponding unlink/remove/DeleteFile cleanup in the
  same function. 34 TP/0 FP (100%). 34/36 files (variant-12 mixed branches missed).
- POS55-C: new rule for CWE-666 socket operation ordering. State machine enforces
  bind() → listen() → accept() order. Flags accept before listen/bind, listen
  before bind. 162 TP/0 FP (100%). All 90 Juliet files detected.
- MEM03-C: CWE-226 sensitive data not cleared before release. Detects pointer/array
  variables with sensitive names (password, secret, credential, passphrase) not
  cleared with SecureZeroMemory/memset/explicit_bzero before function exit.
  68 TP/0 FP (100%). 68/72 files (variant-12 missed).
- MEM35-C: CWE-789 unbounded memory allocation from untrusted input.
  Intra-procedural taint analysis flags malloc/calloc/realloc in functions with
  taint sources (recv, fgets, fscanf, rand) and no upper-bound check (< constant).
  190 TP/0 FP (100%). Cross-function variants need inter-procedural taint.
- ERR07-C: CWE-114 untrusted library path / process control. Intra-procedural
  taint analysis flags LoadLibraryA/W/dlopen in functions with taint sources.
  126 TP/0 FP (100%). Cross-function variants need inter-procedural taint.

### Results

- Juliet v0.3.60: 24,408 TP / 21,117 FP — 53.6% TP rate (+0.7pp from v0.3.59).
  +730 TP, 0 FP. 31 CWEs at 100% precision (up from 25). Per-file rate 40.9%.
  Only 2 zero-detection CWEs remaining (CWE-259, CWE-328).
- Bonus: CWE-680 +80 TP/0 FP (MEM35-C taint caught integer-overflow-to-buffer-
  overflow), CWE-244 +34 TP/0 FP (MEM03-C sensitive data caught heap inspection).done2026-04-20T16:58:08Z2026-04-01T00:00:00Z2026-04-01T00:00:00Z
�$"
���IQ
+�k555Release v0.3.67### Fixed

- resolve_local_var_range returned first assignment instead of last. For
  `data = 0; data = INT_MAX; result = data + 1;`, resolved data to [0,0]
  instead of [INT_MAX,INT_MAX], causing INT32-C/INT30-C false suppression.
- Unevaluable assignments (data = rand(), fscanf(&data)) left stale range
  from prior assignment. New stmt_modifies_var() invalidates range on
  unevaluable assignment or pointer-modifying call.
- Juliet benchmark runner: -d JULIET_BASE prescanned 58K files per CWE
  (~4 min each × 74 CWEs). Changed to CWE-scoped prescan and -j 1.
  Benchmark time: hours → 7 min.

### Results

- CWE-190: 1,763→2,322 TP (+559), per-file 35.0%→43.3% (+8.3pp)
- CWE-191: 1,563→1,973 TP (+410), per-file 40.5%→47.7% (+7.2pp)
- CWE-680: 404→559 TP (+155), TP rate 48.7%→51.4% (+2.7pp)
- Overall: +1,144 TP, +1,290 FP. TP rate 53.6%→53.3% (-0.3pp).done2026-04-20T16:58:08Z2026-04-02T00:00:00Z2026-04-02T00:00:00Z�
P
+�s555Release v0.3.66### Added

- LPT file-size scheduling for parallel analysis. Graham's LPT heuristic
  (1969): files sorted by size descending, dispatched via rayon par_bridge()
  (demand-driven). Reduces worst-case runtime variance by 52-99% and improves
  CPU efficiency from 83% to 96% on skewed workloads (sqlite, curl).done2026-04-20T16:58:08Z2026-04-02T00:00:00Z2026-04-02T00:00:00Z�O
+�W555Release v0.3.65### Fixed

- Sequential mode (`-j 1`) now creates a fresh RuleRegistry per file, matching
  parallel mode behavior. Previously, rules with RefCell state (DCL31-C, DCL07-C,
  ERR01-C, ERR33-C, ENV33-C, ENV03-C, ENV02-C, API00-C, INT30-C, SIG00-C,
  SIG02-C, WIN03-C, WIN05-C, WIN30-C) accumulated data across files, causing
  false suppressions in later files. Sequential and parallel modes now produce
  identical output.done2026-04-20T16:58:08Z2026-04-02T00:00:00Z2026-04-02T00:00:00Z�YN
+�555Release v0.3.64### Added

- Built-in parallel analysis with rayon (`-j`/`--jobs` flag). Default `-j 0`
  auto-detects CPU count. Per-file parser and rule registry instances avoid
  RefCell/Send issues. Results sorted deterministically. Python parallel wrapper
  (`scripts/sqc_parallel_scan.py`) removed — no longer needed.
  Performance: curl 9m38s → 59s (9.8x), mosquitto 2m42s → 34s (4.8x).done2026-04-20T16:58:08Z2026-04-02T00:00:00Z2026-04-02T00:00:00Z
���+V
+�/555Release v0.3.78### Changed

- STR31-C: is_string_memcpy() now checks next 3 lines for manual null-termination
  (dest[...] = '\0').  If programmer explicitly null-terminates after memcpy,
  STR31-C concern is addressed; buffer overflow is a separate ARR38-C concern.

### Benchmark

- −306 FP, −220 TP (1.4:1 ratio). CWE-126 +1.2pp, CWE-121 +0.3pp.done2026-04-20T16:58:08Z2026-04-04T00:00:00Z2026-04-04T00:00:00Z�EU
+�c555Release v0.3.77### Changed

- ARR38-C: is_dangerous_size_calculation() exempts strlen(x)*sizeof(T) —
  legitimate byte count, not sizeof double-scaling.

### Benchmark

- −1012 FP, −728 TP (1.4:1 ratio). CWE-121 48.8% → 49.9%, CWE-126 +1.5pp.done2026-04-20T16:58:08Z2026-04-04T00:00:00Z2026-04-04T00:00:00Z�/T
+�7555Release v0.3.76### Changed

- STR31-C: find_buffer_size() follows `data = dataBuffer` pointer aliases
  (function-scoped, excludes pointer arithmetic).  Recognizes ALLOCA(N*sizeof(T))
  and ALLOCA(N).  Array size arithmetic (N*M, N+M, N-M) also supported.

### Benchmark

- −272 FP, −8 TP (34:1 ratio). CWE-127 55.6% → 64.4%, CWE-124 52.1% → 55.0%.done2026-04-20T16:58:08Z2026-04-04T00:00:00Z2026-04-04T00:00:00Z�RS
+�}555Release v0.3.75### Added

- bench/competitors.py: benchmark runner for Infer and Frama-C on Juliet.
  Runs competitor tools on overlapping CWE subsets, classifies TP/FP using
  Juliet ground truth (OMITBAD/OMITGOOD guards + procedure names).
  Infer: 11 CWEs (memory safety). Frama-C EVA: 6 CWEs (value analysis).
- playbooks/install-static-analyzers.yml: Ansible playbook for installing
  Infer v1.2.0 (prebuilt) and Frama-C 32.0 Germanium (via opam) on Debian 12.
- docs/benchmark-setup.rst: Infer and Frama-C installation instructions.
- docs/benchmark-running.rst: competitor benchmark usage, timing, classification.
- paper/sqc.tex: preliminary Infer/Frama-C comparison data (CWE-476 pilot).
- PLAN.md: split task 33 into 33a (Infer) and 33b (Frama-C) with run commands.done2026-04-20T16:58:08Z2026-04-03T00:00:00Z2026-04-03T00:00:00Z�dR
+�!555Release v0.3.74### Added

- is_full_range_return_function() denylist in std_functions.rs: atoi, atol,
  atoll, strtol, strtoul, strtoll, strtoull, strtoimax, strtoumax, wcstol,
  wcstoul, wcstoll, wcstoull, wcstoimax, wcstoumax, rand, random, lrand48,
  mrand48, rand_r, RAND32, ntohl, ntohs. Functions whose return values can
  span the full integer range are no longer suppressed by the opaque
  increment heuristic in INT32-C and INT30-C.
- resolve_identifier_call_name() in INT32-C/INT30-C: traces the callee
  function name through switch, case, for, while, if, compound, and preproc
  blocks. Enables the denylist check for deeply nested call assignments.
- VRA collect_local_decl_types(): records declared types for uninitialized
  local variables (e.g. `int data;`). Prevents fallback to [i64::MIN,
  i64::MAX] when the variable is later assigned from an unevaluable call.
- VRA local_types lookup in process_expression_range(): uses declared type
  as fallback when existing VRA entry has no type info.

### Fixed

- INT32-C/INT30-C: is_small_increment_of_opaque no longer blanket-suppresses
  `atoi(buf) + 1`, `rand() + 1`, and similar patterns. Known full-range
  functions bypass suppression. Local functions with wide VRA return ranges
  also bypass. strlen()+1 and other bounded-return patterns remain suppressed.
- VRA: `int data; data = atoi(buf);` now correctly uses [INT_MIN, INT_MAX]
  instead of [i64::MIN, i64::MAX] for the fallback range. Fixes incorrect
  VRA suppression of overflow checks for uninit-declared variables.

### Results

- CWE-190: 2,322→2,538 TP (+216), FP -6. TP rate 45.1%→47.4% (+2.3pp).
- CWE-191: 1,973→2,091 TP (+118), FP -6. TP rate 44.0%→45.5% (+1.5pp).
- CWE-680: 559→617 TP (+58), FP unchanged. TP rate 51.4%→53.9% (+2.5pp).
- Overall: +392 TP, -12 FP. TP rate 54.4%→54.8% (+0.4pp). Per-file 45.4%→45.7%.
- Zero CWE regressions. INT32-C: +360 TP / -12 FP (30:1 improvement ratio).done2026-04-20T16:58:08Z2026-04-03T00:00:00Z2026-04-03T00:00:00Z
f�
�R�:[
+�M555Release v0.3.83### Changed

- INT32-C/INT30-C: VRA now consulted for increment/decrement operations.
  check_increment_decrement() uses expression_fits_in_signed/unsigned_vra()
  to suppress data++ when VRA proves the operand is safely within bounds.
- const_eval: try_evaluate_range() handles update_expression nodes (++/--)
  by resolving the argument range and adding/subtracting 1.
- const_eval: try_evaluate_text() resolves sizeof(type) via resolve_sizeof_type()
  and sizeof(variable) conservatively as 1 (sizeof >= 1 on all platforms).
  Enables CHAR_ARRAY_SIZE = (3 * sizeof(data) + 2) macro resolution.
- CWE-190: 47.4% → 58.6% (+11.2pp). CWE-191: 45.5% → 53.9% (+8.4pp).
- Overall: -2,760 FP, -1,388 TP. TP rate 56.8% → 59.0% (+2.2pp).done2026-04-20T16:58:09Z2026-04-05T00:00:00Z2026-04-05T00:00:00Z�tZ
+�A555Release v0.3.82### Changed

- CFG: constant condition pruning for if(0)/if(1)/while(1)/for(;;).
  Only the feasible branch edge is emitted, eliminating infeasible-path FPs.
  Also evaluates literal comparisons (5==5, 5!=5) in conditions.
- null_state: walk switch_statement bodies for declarations and assignments.
  Previously the switch was treated as a single opaque statement in the CFG.
- EXP34-C: AST-level null guard fallback — walk ancestors for enclosing
  if(var != NULL) blocks to suppress dereferences inside null guards that
  the CFG cannot model (e.g., inside switch case bodies).
- API00-C: relay function suppression — skip validation warning when a
  pointer parameter is only passed to callees that check for null.

### Benchmark

- Overall: +3 TP, −378 FP (56.3% → 56.8%). Zero regressions.
- CWE-476: +3 TP, −70 FP (50.8% → 56.3%).
- CWE-690: −38 FP (94.6% → 100.0% TP rate).
- Spillover: CWE-195 −150 FP, CWE-369 −60 FP, CWE-680 −30 FP.
- Per-rule: INT31-C −180 FP, EXP34-C −90 FP, INT33-C −60 FP, API00-C −18 FP.done2026-04-20T16:58:08Z2026-04-05T00:00:00Z2026-04-05T00:00:00Z�lY
+�1555Release v0.3.81### Changed

- ARR38-C: extract_strlen_from_sizeof_expr() helper extracts strlen/wcslen
  argument from strlen(x)*sizeof(T) patterns.  Added to check_buffer_size_mismatch
  and check_string_size_parameter: compares source vs dest buffer sizes.
  When source > dest, flags overflow (recovers TPs lost by Fix 2 blanket exemption).

### Benchmark

- +200 TP, +48 FP (4.2:1 ratio). CWE-121 54.3% → 55.7%.done2026-04-20T16:58:08Z2026-04-05T00:00:00Z2026-04-05T00:00:00Z�+X
+�/555Release v0.3.80### Changed

- ARR38-C: is_size_within_known_buffer() helper — when check_size_exceeds_buffer
  confirms size fits, skip is_hardcoded_large_size/count heuristics.
  Applied to check_string_size_parameter, check_buffer_function,
  check_wide_string_function.

### Benchmark

- −272 FP, −48 TP (5.7:1 ratio). CWE-121 51.6% → 54.3%.done2026-04-20T16:58:08Z2026-04-05T00:00:00Z2026-04-05T00:00:00Z�W
+�555Release v0.3.79### Changed

- STR31-C: get_memset_content_length() scans enclosing function for
  memset/wmemset initialization + null-termination pattern.  Infers strlen(data)
  from fill count.  Max-across-branches for control flow variants.

### Benchmark

- −204 FP, 0 TP (pure FP elimination). CWE-121 +1.4pp, CWE-122 +1.7pp.done2026-04-20T16:58:08Z2026-04-04T00:00:00Z2026-04-04T00:00:00Z
�����`^
+�555Release v0.3.86### Changed

- MEM31-C: prescan-based callee-frees-param detection. When a callee function
  is known (via FunctionSummary.frees_params) to free a parameter, mark the
  allocation as freed at the call site instead of flagging a leak.
- FunctionSummary: param pass-through tracking. Detects when function params
  are forwarded directly to callees (AST-based). Used for transitive free
  propagation across relay function chains (A→B→C→free).
- prescan: propagate_transitive_frees() fixpoint. After all summaries are
  merged, propagates frees through pass-through chains up to 10 levels deep.
- MEM31-C: if/else branch merge fix. Use UNION of freed memory from both
  branches instead of only true branch state. Prevents FPs where free() is
  in the else clause of constant-condition if/else blocks.
- MEM31-C converted from unit struct to stateful struct with
  set_project_context() for prescan integration.

### Benchmark

- CWE-401: 50.7% → 77.6% (+26.9pp). MEM31-C: -543 FP, -25 TP (21.7:1 ratio).
- MEM31-C rule FP rate: 49.3% → 22.4%.
- Overall: 25,456 TP / 15,768 FP. TP rate 61.0% → 61.8% (+0.8pp).
  Zero regressions across all 74 CWEs.done2026-04-20T16:58:09Z2026-04-06T00:00:00Z2026-04-06T00:00:00Z�h]
+�)555Release v0.3.85### Changed

- MEM01-C: CFG-based forward reachability replaces naive "next statement is
  NULL?" check. For each free(ptr), BFS through CFG successor blocks — only
  flags when ptr is actually used or freed again on a reachable path. Suppresses
  when ptr goes out of scope or is reassigned. Declaration-as-reassignment
  handling for loop-scoped variables. Inline CFG building fallback for tests.
- CWE-415: 43.4% → 58.2% (+14.8pp). CWE-416: 43.9% → 92.9% (+49.0pp).
- MEM01-C: -654 FP, -204 TP (3.2:1 ratio). Rule TP rate 41.7% → 71.8%.
- Overall: 25,481 TP / 16,311 FP. TP rate 60.2% → 61.0% (+0.8pp).
  Zero regressions across all 74 CWEs.done2026-04-20T16:58:09Z2026-04-05T00:00:00Z2026-04-05T00:00:00Z�q\
+�;555Release v0.3.84### Changed

- INT33-C: all-assignments-nonzero check for divisor variables. If ALL
  assignments to the divisor in the containing function are non-zero constants,
  the division is safe. Loop update detection (i--, i++) prevents false
  suppression of loop variables.
- INT33-C: fabs()/fabsf()/fabsl() magnitude guard recognition. Float
  divide-by-zero guards like `if(fabs(data) > 0.000001)` now suppress.
- FLP03-C: constant-aware divisor non-zero detection. Two-strategy approach:
  all-assignments-nonzero, and feasible-branch walk using file-scope constants
  to determine last reaching assignment.
- CFG builder: resolve static const int variables as constant conditions.
  Enables dead-branch pruning for `if(STATIC_CONST_TRUE)` patterns.
- const_eval: collect file-scope `static const int` declarations as constants.
- const_eval: float literal to i64 fallback (e.g., 2.0F → 2) for VRA tracking.
- CWE-369 TP rate 37.9% → 53.9% (+16.0pp). -882 FP, -8 TP overall.
  Bonus: INT31-C -144 FP, EXP34-C -24 FP from CFG constant resolution.done2026-04-20T16:58:09Z2026-04-05T00:00:00Z2026-04-05T00:00:00Z
{{�a
+�555Release v0.3.91### Changed

- FunctionSummary: recognize alias null-checks as param null-checks.
  Pattern: `TYPE *alias = param;` followed by a null check on `alias`.
  Common in libcurl/sqlite wrappers that cast-copy the pointer param first
  (e.g. `struct Curl_easy *data = d; if(!data) ...`). Without this,
  `d` was not detected as null-checked, causing caller-side EXP34-C FPs
  on curl wrappers.

### Benchmark

- Addresses v0.3.90 curl EXP34-C regression (+45 FPs from unmasked short
  param-name substring matches revealing previously-hidden violations on
  curl wrapper patterns).done2026-04-20T16:58:09Z2026-04-17T00:00:00Z2026-04-17T00:00:00Z�`
+�c555Release v0.3.90### Changed

- FunctionSummary.checks_null_params: recognize `PARAM == 0` / `PARAM != 0`
  and reversed-operand variants as null checks. Previously only the `== NULL`
  / `!= NULL` spellings matched, so idioms like `if(pStmt==0)` (common in
  sqlite, libcurl) did not register the param as null-checked. The new
  `body_matches_null_check()` helper also handles arbitrary whitespace
  between tokens and uses word-boundary checks to avoid matching substrings.
- EXP34-C: skip deref-function arg check when callee is in the null-safe
  list (free, realloc). `free(NULL)` is defined as no-op per C11 7.22.3.3
  and `realloc(NULL, n)` per C11 7.22.3.5; flagging them as null-deref sites
  is incorrect.
- EXP34-C null-safe function list: added `realloc`.

### Task

- Task 61 (partial): EXP34-C FP reduction for null-safe wrappers and the
  `== 0` null-check idiom. The originally-listed 16 FPs in d_lib_common
  (Patterns 9 + 18) were already addressed by earlier EXP34-C work
  (v0.3.82 AST-level null guard + v0.2.20 &stack_var propagation). This
  changeset targets the remaining `Memory_Free(NULL)` wrapper FP and the
  sqlite-style `== 0` null-check idiom surfaced by the realworld benchmark.done2026-04-20T16:58:09Z2026-04-17T00:00:00Z2026-04-17T00:00:00Z�^_
+�555Release v0.3.87### Added

- 13 multi-file CLI integration tests for cross-file prescan capabilities:
  callsite null propagation (EXP34-C), can_return_null (EXP34-C),
  frees_params (MEM31-C), header_declared_functions (DCL15-C).
  Each scenario tests with-d, without-d, and safe variants.
  (Task 20)
- Test fixtures: crossfile_callsite_null/, crossfile_frees/, crossfile_header/
  with manifests for MEM31-C and DCL15-C.

### Changed

- docs/architecture.rst: comprehensive rewrite. Inventory of all 10 analysis
  modules, capabilities table expanded from 10 to 17 entries, limitations
  table updated (8 entries with impact), per-CWE ceiling analysis, updated
  competitor landscape from 5-tool benchmark. Removed outdated claims
  ("No VRA", "No whole-program analysis", 48% TP rate). (Task 37)
- README.md: benchmark table updated (48.4% → 61.8% TP rate, 16 → 32
  perfect CWEs, added per-file detection rate 42.6%).
- docs/sqc.1: man page version 0.3.61 → 0.3.87.
- docs/cli-usage.rst: prescan collection list expanded from 4 to 9 items
  (added header prototypes, call graph, call-site arg states, struct field
  types, global constants, global null states).done2026-04-20T16:58:09Z2026-04-07T00:00:00Z2026-04-07T00:00:00Z
����#c
+�555Release v0.3.93### Changed

- INT30-C: drop the dedicated `malloc()` / `realloc()` multiplication
  overflow check. The inner `*` expression is already covered by the
  generic `check_multiplication` walker (which correctly skips under
  VRA / constant-folding / SIZE_MAX-guard conditions), so the
  allocation-level check only produced duplicate diagnostics on every
  hit and occasional false positives on good-path cases where the
  inner check had proved the multiplication safe (e.g. Juliet
  `malloc(data * sizeof(int))` with `data = 20`). Calloc's dedicated
  check remains — its multiplication is implicit and not visible to
  the binary-expression walk.
- INT30-C: removed now-dead `flag_allocation_overflow` and
  `contains_multiplication` helpers.

### Benchmark

- Follow-up to v0.3.92: the v0.3.92 get_function_arguments fix
  restored the previously-broken malloc/realloc check, adding 525
  duplicate diagnostics on CWE-680 (TP +207, FP +318, TP rate
  −4.7pp). Deduplicating the check brings CWE-680 back to baseline
  while preserving the v0.3.92 embedded FP reductions and the
  calloc-wrapper / message-cleanup improvements.
- Juliet v0.3.93 vs v0.3.91 (baseline): zero delta across all 74
  CWEs — TP 25354, FP 15768, TP rate 61.7%, unchanged. The v0.3.92
  CWE-680 regression is fully reversed.
- Real-world v0.3.93 vs v0.3.91: **−187 INT30-C violations** across
  four codebases (hostap's pre-existing stack overflow unrelated).
    curl:      -106 INT30-C
    mosquitto:  -44 INT30-C
    sqlite:     -37 INT30-C, -1 FIO05-C
    libcrc:       0
  Total: -188 violations overall. Closes task 60.done2026-04-20T16:58:09Z2026-04-17T00:00:00Z2026-04-17T00:00:00Z�cb
+�555Release v0.3.92### Changed

- INT30-C: three targeted FP reductions on embedded codebases:
  1. Skip plain `++`/`--` of a wide-unsigned struct/union field
     (`ctx->tick++`, `obj.seq--`). Monotonic counter fields wrap at 2^32
     or 2^64 — practically never in real systems. Juliet CWE-190/191
     only exercises local-variable increments, so TP detection is
     preserved.
  2. Skip the calloc overflow warning when both `calloc` arguments are
     function parameters of the enclosing function (thin-wrapper
     pattern). Overflow detection is delegated to C11 calloc itself
     (§7.22.3.2).
  3. Extend subtraction guard detection to preceding
     early-exit `if` siblings. `if (a < b) return; /* ... a - b */`
     places the subtraction on an implicit else-path where `a >= b`.
- INT30-C: `get_function_arguments` now iterates named children of the
  argument list instead of all children. Previously it returned
  punctuation tokens (`(`) as the first "argument", which silently
  suppressed `malloc`/`realloc` multiplication overflow detection and
  produced malformed `calloc((, nmemb)` messages. Added missing
  `SIZE_MAX / size` guard recognition for `malloc` and `realloc`
  (calloc already had it) so the fix does not regress pass tests.
- INT30-C: `has_function_context_check` falls back to the translation
  unit when the call has no containing function, so top-level wiki-
  snippet tests continue to recognize overflow guards.

### Benchmark

- Targets task 60 follow-up: embedded FPs identified after v0.3.88
  library benchmark. On the 4 target embedded codebases (suppressions
  stripped for measurement):
    d_lib_common:          1 → 0 INT30-C FPs
    d_lib_serial_leds:    12 → 8 INT30-C FPs (−3 tick increments,
                                             −1 implicit-else guard)
    d_lib_airpath:         2 → 2 (unchanged — bounded-shift compound
                                 addition, out of scope)
  All 3319 existing tests still pass; new
  `testcases_embedded_patterns.c` pass test covers the three new
  patterns.done2026-04-20T16:58:09Z2026-04-17T00:00:00Z2026-04-17T00:00:00Z
A�A�	e
+�k555Release v0.3.98### Changed

- EXP02-C: extend guard-pattern recognition beyond null-checks. Any
  comparison (`==`, `!=`, `<`, `>`, `<=`, `>=`) on the LHS of `&&` or
  `||`, or a compound `&&`/`||` chain whose leaves are comparisons,
  is now treated as a short-circuit guard. The RHS is still required
  to be mutation-free (no `=`, `+=`, `++`, `--`) so patterns like
  `file_size > 0 && buflen >= file_size && fseek(...)` and
  `arr->len == arr->cap && !growCapacity(arr)` are no longer flagged,
  while `p || (p = malloc(...))` and `a > 0 && ++count > 10` still
  trigger. Closes task 64.
- INT32-C: skip `sizeof(...)` arguments to `memcpy` / `memmove` /
  `memset` size positions. `sizeof(*ctx)` always yields `size_t` and
  has no signed overflow risk, but the text-based `contains_arithmetic`
  helper false-matched the `*` inside the sizeof. Closes task 66 item 1.

### Benchmark

- Juliet v0.3.97 → v0.3.98: **zero delta** across all 74 CWEs —
  TP 24,622, FP 14,226, TP rate 63.4% (unchanged). The EXP02-C guard
  extension and INT32-C sizeof skip target real-world idioms (sizeof
  in memset, compound comparison chains, equality-plus-call patterns)
  that Juliet does not exercise.
- Real-world v0.3.93 → v0.3.98: **−343 violations** (spans v0.3.94-
  0.3.98 work combined). INT32-C −239 is almost entirely v0.3.98's
  sizeof fix (v0.3.94-0.3.97 did not touch INT32-C); API00-C −111
  and INT31-C −2 come from tasks 68/69/62C. Per-project INT32-C
  deltas: sqlite −169, curl −67, mosquitto −3. MSC04-C +8 minor
  regression carried over from the v0.3.94-0.3.97 range.done2026-04-20T16:58:09Z2026-04-19T00:00:00Z2026-04-19T00:00:00Z�0d
+�9555Release v0.3.97### Changed

- API00-C: suppress `void *` / `const void *` parameters that are never
  dereferenced locally and only pass through to null-accepting stdlib
  sinks (free/realloc/cfree/Memory_Free/Memory_Realloc) or callees
  whose summary validates the argument. NULL is a valid value for
  generic-container slot parameters (e.g., `ArrayList_Append(self,
  void *item)`).

### Benchmark

- Juliet v0.3.96 → v0.3.97: TP 24,628→24,622 (-6), FP 14,238→14,226
  (-12). API00-C was the only affected rule (2.0:1 FP:TP ratio).
  CWE-476 (null deref) TP rate 58.9% → 59.6% (+0.7pp). Overall TP
  rate unchanged at 63.4%. Zero other-rule regressions.
- Real-world d_lib_common: API00-C 1 → 0 FP with
  suppressions stripped.done2026-04-20T16:58:09Z2026-04-19T00:00:00Z2026-04-19T00:00:00Z
�����3h
-�=555Release v0.3.101### Changed

- ENV33-C: walk the reverse call graph transitively in
  `callers_are_all_clean`. v0.3.100 only checked direct callers, which
  lost TPs on Juliet CWE-78 variants 52c/53d/54e where intermediate
  forwarding sinks are clean pass-throughs but a grand-caller holds the
  recv/fgets. BFS-style walk with a visited set guards against cycles.

### Benchmark

- Juliet v0.3.99 → v0.3.101: TP 24,590 → 24,478 (−112), FP 14,082 →
  13,632 (**−450**), TP rate 63.6% → **64.2%** (+0.6pp). ENV33-C is
  the only affected rule: TP 1550 → 1438, FP 500 → **50** — a
  **4.02:1 FP:TP ratio**, matching the PLAN.md task 49 projection for
  CWE-78 helper-sink suppression. CWE-78 TP rate 76.6% → **87.7%**
  (+11.1pp). Zero other-CWE regressions. The remaining 50 ENV33-C FPs
  are all v65b function-pointer variants where the call graph has no
  edge for `funcPtr(data)` — future work requires function-pointer
  call-graph edges (same limitation noted in task 49A).done2026-04-20T16:58:09Z2026-04-19T00:00:00Z2026-04-19T00:00:00Z�g
-�555Release v0.3.100### Changed

- ENV33-C: replace blanket "pointer parameter → flag" suppression
  with caller-aware lookup. When the containing function has
  pointer/string parameters and no direct taint-source call in its
  body, defer to the reverse call graph: suppress only when every
  caller's prescan summary shows both `has_env03_taint_source` and
  `returns_tainted` are false. Unknown callers stay flagging.
  Mirrors the ENV03-C task 68 pattern.done2026-04-20T16:58:09Z2026-04-19T00:00:00Z2026-04-19T00:00:00Z�f
+�555Release v0.3.99### Changed

- FunctionSummary: new `returns_tainted` bit and
  `returns_from_callees` set. Seeded in prescan from
  `has_env03_taint_source` on non-void returns, then propagated to
  fixpoint via a new `propagate_return_taint` pass so wrapper chains
  (`char *wrap() { return readIt(); }`) inherit a callee's taint bit.
  Same-named static merging ORs the new bits (mirrors the existing
  `has_env03_taint_source` merge).
- ENV03-C: extend `rhs_is_safe` with a `call_expression` arm. A
  `data = helper(...)` assignment is now treated as safe when
  `helper`'s summary is known and has neither
  `has_env03_taint_source` nor `returns_tainted`. Unknown callees stay
  conservative. Suppresses Juliet CWE-78 v42-style goodG2B(Source)
  patterns while still flagging the corresponding `data =
  badSource(...)` bad paths (badSource contains `recv`).
- INT31-C: `call_rhs_has_taint_source` now recognises callees whose
  summary has `returns_tainted` set. Catches transitive wrappers
  without requiring a direct taint-source call in the immediate
  callee's body.

### Benchmark

- Juliet v0.3.98 → v0.3.99: TP 24,622→24,590 (−32), FP 14,226→14,082
  (**−144**), TP rate 63.4% → **63.6%** (+0.2pp). ENV03-C is the only
  affected rule: TP 652→620, FP 468→**324** — a **4.5:1 FP:TP
  ratio**, the cleanest ratio for ENV03-C since task 67 (v0.3.94's
  4.1:1). CWE-78 TP rate 74.1% → **76.6%** (+2.5pp). CWE-426 side
  benefit: FP 188→164 (−24, 1:1 with TP drop). Zero other-rule
  regressions. INT31-C was neutral on Juliet — the transitive-wrapper
  pattern exists in real-world code but not in the Juliet v42 CWE-194/
  195 templates, which use direct taint-source calls inside their
  `badSource` helpers.done2026-04-20T16:58:09Z2026-04-19T00:00:00Z2026-04-19T00:00:00Z
RkR�j
-�555Release v0.3.103### Changed

- STR02-C: port the ENV03-C / ENV33-C caller-aware suppression template.
  When `system()` / `popen()` is called with a function parameter that's
  only tainted by the default "params are untrusted" rule — i.e. the
  enclosing body contains no direct taint-source call — walk the reverse
  call graph and suppress iff every transitive caller's summary shows
  `has_env03_taint_source` and `returns_tainted` both false. BFS with a
  visited set, matching the ENV33-C pattern that handles Juliet's
  variant 52c/53d/54e multi-level forwarding chains. New fields
  `function_summaries` + `callers` on `Str02C` populated from
  `ProjectContext.call_graph` in `set_project_context`.

### Benchmark

- Juliet v0.3.102 → v0.3.103: TP 24,542 → 24,518 (−24), FP 13,498 →
  **13,358** (−140), TP rate 64.5% → **64.7%** (+0.2pp). Zero
  other-CWE regressions; every non-CWE-78 cell in the delta report is
  exactly zero.
  - CWE-78 TP rate 90.3% → **94.8%** (+4.5pp). STR02-C FP 140 → **0**,
    TP 560 → 536 (−24). **5.83:1 FP:TP ratio** — best ratio so far in
    the CWE-78 taint-aware series (prior bests: 4.5:1 at task 49A, 4.1:1
    at task 67). STR02-C now contributes zero FPs to CWE-78; all 140
    remaining CWE-78 FPs are on ENV03-C (v42-style return-tainted
    helpers and v45 global-static pointer reads).
  - CWE-78 TP rate (94.8%) now exceeds clang-tidy's 91.6% shared-CWE
    average — CWE-78 is no longer a competitor-parity gap.
- Real-world (curl / sqlite / mosquitto / libcrc / hostap): not rerun.
  The change reuses existing `FunctionSummary` fields (no new summary
  bits, no schema change), so real-world behaviour matches v0.3.102
  which had zero delta from v0.3.98.done2026-04-20T16:58:09Z2026-04-19T00:00:00Z2026-04-19T00:00:00Z�i
-�{555Release v0.3.102### Changed

- prescan (`collect_callees`): resolve function-pointer aliases when
  building the call graph. The function body is now walked twice — the
  first pass captures `void (*fp)(char *) = target;` init declarators
  and `fp = target;` rebinds into a local alias map, the second pass
  emits callees with aliased identifiers rewritten to the target
  function. Juliet v65a/b sinks now surface a real caller edge instead
  of a dangling `funcPtr` entry.
- prescan (`has_env03_taint_source`): also match per-file macro aliases
  whose target is in `ENV03_TAINT_SOURCE_FUNCTIONS`. Juliet's
  `#define GETENV getenv` wrappers now correctly poison the caller's
  summary, so ENV03-C / ENV33-C / INT31-C caller-aware suppression
  treats `GETENV(ENV_VARIABLE)` as a real taint source.
- `function_summary::compute_summaries` gains a `taint_source_aliases`
  parameter plumbed through `analyze_function` and
  `collect_function_summaries`. Per-file alias collection in prescan
  (and header resolution) pre-filters aliases to those resolving to a
  taint source before calling summarize.

### Benchmark

- Juliet v0.3.101 → v0.3.102: TP 24,478 → **24,542** (+64), FP 13,632
  → **13,498** (−134), TP rate 64.2% → **64.5%** (+0.3pp). Zero
  other-CWE regressions.
  - CWE-78 TP rate 87.7% → **90.3%** (+2.6pp). ENV33-C FP 50 → **0**,
    TP 1438 → 1514 (+76). ENV03-C FP 324 → 300 (−24), TP 620 → 628
    (+8). 50 FP → 0 for variant 65b, plus +76 TPs recovered in other
    helper-sink variants where the bad caller used a macro-wrapped
    taint source (GETENV, FGETS, etc.) previously missed by the text
    scan.
  - CWE-194 TP rate 67.9% → **69.4%** (+1.5pp), FP −30, TP −10.
  - CWE-195 TP rate 51.9% → **52.5%** (+0.6pp), FP −30, TP −10.
  - INT31-C: FP 1452 → 1392 (−60), TP 2142 → 2122 (−20). 3:1 ratio.
- Real-world v0.3.98 → v0.3.102 (curl, sqlite, mosquitto, libcrc,
  hostap): zero delta. Change is Juliet-specific — these codebases
  don't use Juliet's function-pointer-across-files pattern or macro
  aliases that resolve to taint sources.done2026-04-20T16:58:09Z2026-04-19T00:00:00Z2026-04-19T00:00:00Z
[��[�Rn
o�955549G: ENV03-C v34 union-field-alias FP suppressionEliminated ~20 ENV03-C v34 FPs (OMITGOOD union-alias pattern). walk_for_taint case-insensitive for UPPERCASE macro aliases (GETENV->getenv). rhs_is_safe + walk_pointer_aliases handle dot field_expression. v0.3.107.done2026-04-22T19:22:42Z2026-04-22T19:22:51Z2026-04-22T19:22:51Z�Rm
o�955549G: ENV03-C v34 union-field-alias FP suppressionEliminated ~20 ENV03-C v34 FPs (OMITGOOD union-alias pattern). walk_for_taint case-insensitive for UPPERCASE macro aliases (GETENV->getenv). rhs_is_safe + walk_pointer_aliases handle dot field_expression. v0.3.107.done2026-04-22T19:22:38Z2026-04-23T15:04:45Z2026-04-23T15:04:45Z�-l
w�g55549E: ENV03-C v45 global-static pointer write trackingLast remaining major CWE-78 FP contributor (~140 FPs). Juliet v45 pattern: static global pointer is written in function A (good path: clean data) and read in function B (goodG2BSink pattern) before SYSTEM(data). Currently FPs because char *data = g_static is seen as untrusted identifier init. Fix: prescan collects writers of file-scope static variables, ENV03-C seeds clean globals (all writers have has_env03_taint_source=false AND returns_tainted=false) into safe_sources. Symmetric to caller-aware taint check but inverted (writers instead of callers).done2026-04-20T17:24:37Z2026-04-20T17:25:17Z2026-04-20T18:17:29Z�Hk
-�g555Release v0.3.104### Changed

- ENV03-C: extend caller-aware suppression to local command variables
  derived from a function parameter. When the `system()` / `popen()`
  argument is a local like `char *data = *dataPtr` (variant 63),
  `char *data = dataArray[2]` (variant 66), `char *data =
  myStruct.structFirst` (variant 67), or a chain through a cast such as
  `char **dataPtr = (char **)dataVoidPtr; char *data = *dataPtr;`
  (variant 64), walk writes to the command var and — if every write is
  derived via deref / subscript / field / cast from a function
  parameter (possibly through other parameter-derived locals) —
  reuse `callers_are_all_clean`. Suppress iff every caller's summary
  has `has_env03_taint_source` false. New helper
  `is_command_var_parameter_derived` + write-collection fixpoint.
- `function_summary::ENV03_TAINT_SOURCE_FUNCTIONS` and the matching
  scope-local list in `env03_c` now cover wide-character and Windows
  input equivalents: `fgetws`, `getwchar`, `getwc`, `fgetwc`,
  `wscanf`/`fwscanf`/`swscanf`/`vwscanf`/`vfwscanf`, `_getws`,
  `_getws_s`, `_wgetenv`, `_wgetenv_s`. Juliet's
  `wchar_t_console_*` / `wchar_t_file_*` variants read via `fgetws`;
  with these absent, the bad-path caller's summary was (incorrectly)
  clean and the new parameter-derived fix was over-suppressing the
  wchar_t bad-sink TPs. Mirrors the narrow-char coverage.

### Benchmark

- Juliet CWE-78 (single-rule ENV03-C measurement, prescan enabled):
  - Pre-change: 660 violations (520 TP / 140 FP, 78.8% TP rate).
  - Post-change: 680 violations (620 TP / 60 FP, **91.2% TP rate**).
  - FP −80, TP +100 — **0.8:1 FP:TP ratio** (net gain of TPs
    exceeds FPs eliminated). Both axes move in the right direction
    because the wide-char taint expansion recovers bad-path TPs that
    were previously silently suppressed by the clean-caller check.
  - Variant-level: v63/v64/v66/v67 FPs go to 0 each (80 FPs cleared);
    wchar_t bad-sink TPs (variants v01-v18, v21-v68) recover 4 each
    across ~25 variants.
  - Remaining 60 ENV03-C CWE-78 FPs: v34 (union field access, 20),
    v45 (static global pointer read, 20), v68 (extern global pointer
    read cross-file, 20). These need type-aware field analysis or
    global-write tracking, out of scope here.
- Full Juliet + real-world rerun deferred (changes reuse existing
  `FunctionSummary` fields; wide-char taint additions affect ENV33-C /
  INT31-C / STR02-C identically to ENV03-C but those are all
  conservative additions — a missing source was letting taint through).done2026-04-20T16:58:09Z2026-04-20T00:00:00Z2026-04-20T00:00:00Z
q�
a�+q�7s�-�C555INT32-C + INT10-C: gate sign-safety rules on operand signedness (unsigned types)INT32-C fires on unsigned int/u32/u16 operands (27 violations in e_bms_primcu3124_scud) — signed overflow rule should not fire on unsigned types. INT10-C fires on u16 modulo (16 violations) for the same reason: % on unsigned always yields non-negative. Same root cause: checkers do not verify operand signedness before firing. Also INT32-C fires on pointer arithmetic expressions (e.g. AFE_INT_EN+4) — need to gate on non-pointer integer types too. Fix: before firing either rule, confirm LHS operand resolves to a signed integer type.done2026-04-30T15:41:33Z2026-04-30T15:55:48Z2026-04-30T16:08:01Z� r��%555INT31-C FP reduction: conditional-branch goodG2B pattern (v08-v17, v6xb)Investigation of INT31-C remaining FPs in CWE-195 (690 FP) and CWE-194 (330 FP).

## Summary
Total INT31-C FPs: 1,248 (CWE-195: 690, CWE-194: 330, rest from other CWEs).
Callsite constant arg propagation (v0.3.115) did NOT help INT31-C — those goodG2B
cases were already handled by prior suppression (within-function VRA or taint-free).

## Top FP Variants (CWE-195 s01, local repro)
- v08: 34 FPs — staticReturnsFalse/staticReturnsTrue conditional branch
- v09: 28 FPs
- v10: 28 FPs
- v13: 24 FPs
- v11: 20 FPs, v14: 18 FPs, v17: 17 FPs, v45: 15 FPs
- v63b/v64b/v66b/v68b: 8-10 FPs each (void-ptr helper sink)

## v08 Pattern (most common)
  static void goodG2B1() {
      int data = -1;
      if (staticReturnsFalse()) { /* dead */ }
      else { data = 100-1; }   // data=99
      if (data < 100) {
          malloc(data);    // INT31-C fires here (FP)
          memset(buf, x, data-1);  // also fires
      }
  }

## Analysis
- Standalone file (no prescan): CLEAN — suppression works
- With full CWE-195 prescan (-d CWE195 dir): FPs fire on lines 161,164,187,190
- Suppression path: is_inside_upper_bound_guard() && var_is_taint_free()
  - upper_bound_guard: 'data < 100' should return true
  - var_is_taint_free: goodG2B1 has no taint source, data not from tainted call
  - Standalone: both true → suppress. With prescan: something breaks.
- SUSPECT: prescan cross-contamination. Multiple static goodG2B1 definitions
  OR-merged; if any has has_env03_taint_source=true, var_is_taint_free returns false.
  But checked: all goodG2B1 functions in CWE-195 use constant sources.
- NEXT: inspect why the prescan run breaks suppression. Add debug trace or
  check if find_enclosing_function fails (returns None → var_is_taint_free=false).
  Check lines 140-170 of connect_socket_malloc_08.c for exact context.
  Also check if 'data' missing from var_types when 'int data;' declared without init.

## Files
- src/rules/cert_c/INT/INT31-C/int31_c.rs: var_is_taint_free(), is_inside_upper_bound_guard()
- Juliet: ~/data/benchmarks/.../CWE195.../s01/*_08.cdone2026-04-30T11:20:20Z2026-04-30T11:20:35Z2026-04-30T15:55:45Z�q
�555Update task 18 investigation notes: MEM30-C item #8 fixed in v0.3.114done2026-04-28T18:59:56Z2026-04-28T19:00:02Z2026-04-28T19:00:02Z�5p
}�q55550G: ENV03-C uppercase macro constant safe strcpy sourcestrcpy/strcat second-arg check now accepts ALL_CAPS identifiers as compile-time macro constants. Eliminates 136 CWE-426 FPs (GOOD_OS_COMMAND pattern) + 84 spurious TPs. v0.3.109.done2026-04-23T17:44:45Z2026-04-23T17:44:52Z2026-04-23T17:44:52Z�do
M�555ENV03-C v68 extern global FP fixEliminate ~20 FPs in CWE-78 from Juliet v68 pattern (extern global pointer cross-file data flow). Fixed collect_static_pointer_globals to also track non-static extern-linkage pointer globals. With -d flag, goodG2BSink correctly suppressed. v0.3.108.done2026-04-23T13:56:29Z2026-04-23T13:56:40Z2026-04-23T13:56:40Z
�
�J�
���Vz�A�m555PRE10-C: recognize do-while(0) wrapper spanning multiple lines with backslash continuation1 FP in e_bms_primcu3124_scud — IO_F_mcu_pwm macro (bms.h:211) correctly wrapped in do{...}while(0) but sqc flags it as unwrapped. The do-while spans multiple lines using backslash continuation. Fix: parse multi-line macro body with backslash continuations before checking for do-while wrapper pattern.done2026-04-30T15:42:09Z2026-04-30T20:01:38Z2026-04-30T20:01:38Z�qy��K555FLP00-C: only fire on floating-point operands, not integer comparisons1 FP in e_bms_primcu3124_scud — if(da == 0xff) at comm.c:676 flagged as float equality. da is declared u8. Fix: FLP00-C should only fire when at least one operand of == is a floating-point type (float/double/long double).done2026-04-30T15:42:09Z2026-04-30T20:01:38Z2026-04-30T20:01:38Z�|x��e555MSC37-C: recognize post-loop unconditional return as valid exit path1 FP in e_bms_primcu3124_scud — cell_temp_interpolate() (comm.c:89) has unconditional return after for-loop (out-of-range case). sqc appears to miss post-loop return when loop body contains early return — may be treating post-loop code as unreachable. Fix: code after a for/while loop is reachable when loop condition is not guaranteed true on every iteration.done2026-04-30T15:41:49Z2026-04-30T20:01:38Z2026-04-30T20:01:38Z�-w��K555MEM05-C: verify actual call cycle exists before flagging recursion1 FP in e_bms_primcu3124_scud — SendDataLogging() (comm.c:225) flagged as recursive. It calls get_bms_data_log(), Cal_Crc(), SendData_IF() — none call back into SendDataLogging. Fix: confirm a call chain from the flagged function back to itself actually exists before firing MEM05-C.done2026-04-30T15:41:49Z2026-04-30T20:01:38Z2026-04-30T20:01:38Z�
v�O�5EXP33-C + ARR00-C: cross-function output-buffer fill pattern (non-const ptr + return-value guard)2 EXP33-C + 8 ARR00-C violations in e_bms_primcu3124_scud at same sites (I2C.c:398,431). ReadBuf[] passed to I2CRead() as output buffer (non-const ptr); only read inside if(ret==1) where ret is I2CRead() return value. sqc cannot track interprocedural fill. Partial fix: when array passed as non-const ptr arg and its subsequent read is guarded by the callee's return value, reduce EXP33-C confidence. Also: ARR00-C and EXP33-C fire on same sites — avoid reporting two rules on the same uninitialized-buffer pattern.pending2026-04-30T15:41:49Z�3u��I555MEM30-C: gate stack-escape check on pointer/array type of assigned global18 FPs in e_bms_primcu3124_scud — scalar integer assignments to globals (timer counters, state vars) inside HAL_ENTER_CRITICAL_SECTION blocks misidentified as stack pointer escapes. Fix: only fire MEM30-C stack-escape when the global's declared type is a pointer or array type. If global is scalar integer (u8/u16/u32/int/uint8_t etc.), do not fire. Note: currently suppressed via project config as a workaround.done2026-04-30T15:41:49Z2026-04-30T16:08:01Z2026-04-30T16:08:01Z�}t�=�?555DCL07-C + DCL31-C: follow #include chain for declarations; recognize compiler intrinsics374 duplicate violations (187 each) in e_bms_primcu3124_scud. Two sub-patterns: (A) Holtek compiler built-ins _nop()/_clrwdt() have no standard header — need configurable intrinsics list per target; (B) functions declared via extern in #included headers are still flagged because sqc does not resolve #include chains when checking for prior declarations. Also: DCL07-C and DCL31-C appear to check the same condition and fire on identical sites — consider deduplication.done2026-04-30T15:41:33Z2026-04-30T16:08:01Z2026-04-30T16:08:01Z

�	�t,"�{�[�
O�k555Improve test debugging experienceGenerated test names are opaque, failure output lacks source location, debug prints get overwritten on rebuild. Need better linkage between failing test name, .c file, and CERT C wiki example. Originally P1-003 in AGENTS/PROPOSALS/BACKLOG.done2026-05-07T18:45:26Z2026-06-18T03:20:14Z2026-06-18T03:27:37Z�M�
E�Y555Add mutex poisoning recoveryMultiple lock().unwrap() calls in src/progress.rs and src/rules/cert_c/integration.rs have no poisoning recovery. A thread panic while holding a lock cascades to crash the entire run. Originally P1-002 in AGENTS/PROPOSALS/BACKLOG.done2026-05-07T18:45:24Z2026-05-07T19:31:22Z2026-05-07T19:31:22Z�>�
U�+555Add TOML validation to build processbuild.rs merges individual rule TOML files but does not validate the output. Syntax errors, schema violations, and malformed fields go undetected until runtime. Originally P1-001 in AGENTS/PROPOSALS/BACKLOG.done2026-05-07T18:45:22Z2026-06-18T02:54:07Z2026-06-18T03:06:48Z����#	555Every rule violation should report where and why it failedRules should include precise source location and human-readable explanation in their output. Originally P0-003 in AGENTS/PROPOSALS/BACKLOG.done2026-05-07T18:45:18Z2026-05-19T00:48:42Z2026-05-19T01:22:21Z��
o�#	555Optimize runtime performance on real repositoriesTool is too slow for practical use on real codebases. Needs profiling and optimization pass. Originally P0-002 in AGENTS/PROPOSALS/BACKLOG.done2026-05-07T18:45:17Z2026-05-15T13:42:31Z2026-05-18T00:26:28Z�E
�	555Eliminate compiler warnings (clean build generates noise)Clean build generates excessive warnings from stub rules, masking real issues. Root causes: unused imports in stub rules, missing allow attributes. Originally P0-001 in AGENTS/PROPOSALS/BACKLOG.done2026-05-07T18:45:15Z2026-05-07T19:24:17Z2026-05-07T19:24:17Z�u~�-�?555EXP15-C: do not fire on empty loop body when condition polls a volatile variable6 FPs in e_bms_primcu3124_scud — spin-poll busy-waits like while(_txif0==0); and while(!_hircf); flagged as likely accidental empty bodies. All are intentional hardware peripheral-ready/clock-stable polls. Also: sqc message says semicolon is 'on the same line' but it is consistently on the next line in this codebase. Fix: if loop condition operand is a volatile variable or has form while(volatile_var op constant), treat empty body as intentional and suppress EXP15-C.done2026-04-30T15:42:09Z2026-04-30T20:01:38Z2026-04-30T20:01:38Z�T}��555PRE07-C: do not flag trigraph sequences inside // or /* */ comments2 FPs in e_bms_primcu3124_scud — sys.c:319,340 have ?- sequences inside // comments where Chinese text is garbled/truncated (变量初始??? etc.). Even if it were a real trigraph (expands to ~), trigraphs in C99+ comments have no semantic effect. Fix: skip PRE07-C when the trigraph-like sequence appears inside a comment.done2026-04-30T15:42:09Z2026-04-30T20:01:38Z2026-04-30T20:01:38Z�@|��c555EXP02-C: allow hardware-flag && countdown-decrement short-circuit pattern3 FPs in e_bms_primcu3124_scud — while((_iar2 & 0x04) && (--timeout)) pattern: left operand is hardware register flag check (volatile), right is bounded countdown --timeout. Short-circuit is intentional: if hw condition clears, timeout is not decremented. Same pattern documented in d_lib_common FP-016/FP-019. Fix: extend EXP02-C exemption to cover VOLATILE_FLAG_CHECK && (--counter) pattern, not just NULL_CHECK && fn_call.done2026-04-30T15:42:09Z2026-04-30T20:01:38Z2026-04-30T20:01:38Z�w{�G�)555ARR39-C: do not flag sizeof-bounded loop when pointer type is u8*/uint8_t* (element size = 1)1 FP in e_bms_primcu3124_scud — sys.c:372: for(i=0;i<sizeof(bsm_data_log);i++) with (u8*)bsm_data_log.CELL_MAX+i. Pointer cast to u8* so +i advances exactly 1 byte. sizeof() and pointer step are in same unit. Fix: ARR39-C should not fire when pointer type is u8*/uint8_t* since element size is 1 byte and no scaling mismatch exists.done2026-04-30T15:42:09Z2026-04-30T20:01:38Z2026-04-30T20:01:38Z


�u	�M�B�
s�	555Investigate and fix STR31-C false positive patternsSTR31-C has 1,671 FPs (53.3% rate) — the single largest FP contributor. Does NOT use VRA. Uses text-pattern matching for strlen/sizeof/strncat guards. Need to: (1) run get_cwe_detail on CWE-121/CWE-122 to identify which Juliet variants are failing, (2) inspect the actual failing files to understand the pattern, (3) implement targeted fixes. VRA may not apply directly since this is about string lengths, not integer arithmetic — investigate first.done2026-05-17T15:29:05Z2026-06-09T18:26:34Z2026-06-09T21:45:57Z�5�

u�{	555Add VRA suppression to ARR30-C index bounds checkingARR30-C has 1,121 FPs (38.2% rate) and does NOT use VRA at all. VRA infrastructure is mature (value_range.rs). For static arrays like int arr[10], when VRA proves the index variable's range at the access point is within [0, array_size-1], suppress the violation. This is the most direct VRA extension possible — a clean intersection of index_range ⊂ [0, N-1]. See int32_c.rs for how to call needs_vra/set_vra_results/vra_var_ranges_at.done2026-05-17T15:29:05Z2026-05-17T15:29:16Z2026-05-17T17:33:55Z��	��E5Fix wiki parser to exclude output examples from test generationWiki scraper creates test .c files from runtime output blocks (not actual C code), producing unparseable test files. Example: MSC32-C tests/fail/wiki_posix_2.c. Parser needs to distinguish code examples from output documentation. Originally P2-WIKI-PARSER in AGENTS/PROPOSALS/BACKLOG.pending2026-05-07T18:45:40Z�e�
u�Y555Automate mod.rs rule registry generation in build.rsEvery new rule requires two manual edits to src/rules/cert_c/mod.rs (pub mod declaration + registry.register call). Should be auto-generated from directory scan in build.rs. Originally P2-AUTO-REGISTRY in AGENTS/PROPOSALS/BACKLOG.done2026-05-07T18:45:37Z2026-05-07T19:25:40Z2026-05-07T19:25:40Z�M�
�555Implement FIO30-C: Exclude user input from format stringsHigh-priority CERT C rule (P18 severity). Requires interprocedural taint analysis framework — significant architectural work, estimated 40-60 hours. Originally P1-FIO30-C in AGENTS/PROPOSALS/BACKLOG.done2026-05-07T18:45:33Z2026-05-07T19:24:17Z2026-05-07T19:24:17Z�@�
s�555Implement EXP34-C: Do not dereference null pointersHigh-priority CERT C rule (P18 severity). Requires scope-aware control-flow analysis — significant architectural work, estimated 25-60 hours. Originally P1-EXP34-C in AGENTS/PROPOSALS/BACKLOG.done2026-05-07T18:45:32Z2026-05-07T19:24:17Z2026-05-07T19:24:17Z�r�
]�555Add folder nesting to interactive clientInteractive client should support navigating rules organized by folder/category. Originally P1-004 in AGENTS/PROPOSALS/BACKLOG.done2026-05-07T18:45:29Z2026-06-18T03:33:36Z2026-06-18T03:47:36Z
I
t4I�g�
Y�y555FIO30-C FP investigation and reductionFIO30-C has 696 FPs (36.7% rate, 1,200 TP). This is a format-string taint rule. No VRA. The Juliet benign variants use non-user-controlled format strings or use literal format strings. Need to investigate which Juliet CWE-134 variants are generating FPs. May be addressable through: literal format string detection, taint flow analysis, or const_eval for format string args.done2026-05-17T15:29:05Z2026-06-18T11:17:27Z2026-06-18T12:28:51Z�<�
w�	555Disable or fix CON33-C and CON07-C (97%/87% FP rates)CON33-C has 97% FP rate (2 TP, 64 FP). CON07-C has 87% FP rate (10 TP, 64 FP). These map to CWE-377 and CWE-366 respectively. Both are near-useless in current form and undermine paper credibility. Options: (1) investigate if they can be fixed with targeted logic, (2) disable them entirely in the default TOML config. Fix or disable before paper submission. The 128 FPs from these two rules alone drop the overall FP total from 10,590 to 10,462.done2026-05-17T15:29:05Z2026-05-17T17:35:17Z2026-05-17T18:43:40Z����	555Investigate residual INT32-C/INT31-C/INT30-C FPs despite VRAINT32-C: CWE-190 1,287 FP / CWE-191 1,020 FP (v0.4.21). INT31-C: CWE-195 690 + CWE-194 330 + CWE-197 ~228 FP. INT30-C: CWE-191 306 FP. UPDATE 2026-06-09: the switch-case-guards-not-in-CFG hypothesis was CONFIRMED and fixed in v0.4.20/21 (process_opaque_region in value_range.rs + mid-block replay via get_all_var_ranges_at in INT32-C/INT30-C). Remaining FP sources to investigate: cross-function patterns (_61/_66/_67/_68 variants), compound expressions, and goodB2G guard styles not recognized by is_inside_bounds_checked_block. Use get_cwe_detail on CWE-190/191/194/195/197.
2026-06-10 strategic review: demoted from P1. Juliet INT FP work continues toward ~75%, but real-world audit (148) and bounds-API consolidation (149) take the P1 slots first.

[sqlite-audit 2026-06-14] ANALYSIS.md §1 quantifies this as the #1 FP source: INT32-C = 4420 FP / 15 TP (0.3%) = 20% of ALL FPs; INT30-C = 915 FP / 1 TP; INT31-C = 415 FP / 3 TP. Dominant misfire: 'signed overflow' on BOUNDED operands (i16 column counts asserted <=32767, SQLITE_LIMIT-bounded counters, i64 size math, power-of-two page sizes) and UNSIGNED values mislabeled as signed (e.g. u32 page arithmetic). Highest-leverage single FP fix. Bumped to P1 and gated under task 171 (FP reduction before new-codebase expansion).done2026-05-17T15:29:05Z2026-06-14T22:32:14Z2026-06-15T03:42:31Z
;�;�#�
y�Q555Improve CWE-121/CWE-122 flaw-hit rates (cppcheck goal)Goal 2 remainder: CWE-121 flaw-hit 14.5%, CWE-122 10.5% (unchanged v0.4.18→v0.4.21). CWE-190 (19.7%) and CWE-191 (20.4%) parts are DONE. Known scoring geometry: CWE-129/CWE-135/CWE-805-wchar patterns place violations 4 lines after the flaw annotation, outside the +/-1 tolerance — decision made NOT to change benchmark tolerance (paper comparability). Gains must come from detection at the actual flaw lines and FP reduction: v0.4.21 FP counts ARR38-C/CWE-121 504, ARR30-C/CWE-121 442, ARR30-C/CWE-122 409, STR31-C/CWE-121 258.
2026-06-10: implement on top of the shared bounds/buffer-size API (task 149), not as rule-local patches — CWE-121/122 flaw-hit is the same buffer-size problem STR31-C/ARR30-C each solve privately.

--- 2026-06-18 progress (v0.4.46→v0.4.47; commits 9749f1d8, 18cbff53) ---
FP-reduction half DONE. ARR30-C string-copy content-length gate built on the
shared buffer_size API (memset_content_length consolidated there; STR31-C now
delegates). vs v0.4.45: ARR30-C FP 1103→729 (-374), TP unchanged (1814), ZERO
TP loss, ZERO cross-CWE regressions. CWE-121 FP 1134→930 (TP rate 66.6→70.8%);
CWE-122 FP 547→377 (71.6→78.5%). Gate scoped to Static (stack-array) dests
after fixing a 6-TP CWE-122 regression (file-wide buffers map conflates malloc'd
pointer sizes across functions).
FLAW-HIT RATE UNCHANGED (CWE-121 14.5%, CWE-122 10.5%): FP reduction does not
move the TP-on-flaw-line numerator. Remaining levers are alias-analysis-bound
(see follow-up), depend on task 150.

--- 2026-06-18 close ---
Closing: the actionable FP-reduction deliverable shipped (ARR30-C -374 FP,
0 TP loss, 0 regressions). The flaw-hit-rate increase is recall/alias-bound
and parked in task 206, which the task-150 decision deferred (no alias/SSA
infra investment now). No remaining actionable work under 144.done2026-06-10T03:51:31Z2026-06-18T17:15:40Z2026-06-18T20:23:31Z���#�555Investigate cross-function buffer-size propagation for STR31-C FP reductionSTR31-C still has ~611 FPs after v0.4.17 fixes. Remaining FPs are all cross-function: sink functions receive 'char * data' as a parameter, and the destination buffer was allocated in the caller (ALLOCA/malloc). Without knowing the caller's buffer size, STR31-C can't prove the copy is safe.

Known remaining FP patterns (from CWE-121/122/127/124 analysis):
- __dest_char_alloca_cpy_ (variants 41+): sink sees strcpy(data, source) where data is a parameter; source is char source[100] filled via memset. Buffer 100 vs dest unknown.
- __CWE805_wchar_t_alloca_ncat_ (variants 41+): wcsncat(data, source, 100) where data is a parameter.
- __c_CWE805_wchar_t_ncat_ (CWE-122): same wcsncat parameter pattern.
- CWE-127/124 alloca_cpy (variants 41+): strcpy(dest, data) where dest is char dest[200] but data is a parameter.

Approaches to investigate:
1. Parameter-size summary: during prescan, record the buffer size passed to a function for each call site (similar to callsite_param_const_int). If ALL callers pass a buffer of size >= N, seed the parameter with N.
2. Source-content heuristic: if source content length is deterministic (via memset) and destination is a parameter, suppress when content_len < some conservative threshold.
3. n-bounded copy suppression: for wcsncat(data, source, N) where N <= source_size, the copy is count-bounded — flag only if we can prove dest is too small, suppress if dest size unknown.

Estimated FP impact if solved: ~430 FPs across CWE-121 (258 remain), CWE-122 (241 remain), CWE-127 (90), CWE-124 (90).
2026-06-10: blocked on task 149 — cross-function buffer-size propagation should land in the shared API, not in str31_c.rs.done2026-06-09T21:46:07Z2026-06-18T12:32:01Z2026-06-18T14:20:20Z
Z	`�]Z����s	555Real-world benchmark refresh + sampled precision audit at v0.4.21Real-world validation is ~80 versions stale (latest comparison: v0.3.5 in REALWORLD_RESULTS.md; latest DB run: v0.3.34 sqc-only). Two parts: (1) re-run the 5-project suite (libcrc, mosquitto, curl, sqlite, hostap) at v0.4.21 on the home machine; (2) manually adjudicate a random sample (~50 findings each from the top 3 noisiest rules, e.g. EXP34-C on mosquitto) to produce a MEASURED real-world precision number. This is the missing datum for the paper (answers the 8,657-EXP34-C-findings objection) and tells us whether the Juliet-driven FP fixes since v0.3.5 generalized. Output feeds the ceiling-decision task and task 147.done2026-06-10T12:32:35Z2026-06-10T13:26:51Z2026-06-10T20:18:10Z�j�
a�w555Refresh paper benchmark numbers to v0.4.21Paper table (tab:competitor) cites v0.4.17: CWE-190 66.8→67.8, CWE-191 63.3→65.9 (now beats Frama-C 63.1 by 2.8pp), CWE-680 60.0→63.2, CWE-121/122 unchanged. Overall-74-CWE TP rate 72.7% (was 72.6% at v0.4.17); recompute the 15-CWE-overlap overall (was 67.6). Also update prose claims about CWE-191 being the close row.
2026-06-10: now depends on task 148 — the refreshed paper numbers should include the v0.4.21 real-world results AND the sampled real-world precision figure, not just Juliet.done2026-06-10T03:51:31Z2026-06-10T22:06:12Z2026-06-11T12:19:24Z����k5Medium-tier FP cleanups: EXP33-C, FIO42-C, ARR39-C, WIN04-CGoal 3 (raise medium precision tiers). From v0.4.18 analysis: EXP33-C on CWE-123 (159 FP) and CWE-665 (212 FP); FIO42-C on CWE-773 (59 FP); ARR39-C on CWE-468 (32 FP); WIN04-C on CWE-319 (16 FP). Re-verify counts against sqc-0.4.21-62d93999 before starting; v0.4.21 also shows FIO30-C/CWE-134 696 FP (covered by task 142) and INT33-C/CWE-369 408 FP + FLP03-C/CWE-369 270 FP as additional candidates.
2026-06-10: demoted to P3. Note overlap with task 151 (CON/WIN triage) — if WIN04-C/ARR39-C signal stays weak after triage, consider demotion over FP-fixing.pending2026-06-10T03:51:31Z��
E�w555Close CWE-680 gap vs Frama-Cv0.4.21: tp_rate 63.2% vs Frama-C 82.6% (their best CWE). 494 TP / 288 FP. Rules involved: INT32-C + INT30-C on malloc(n*sizeof) overflow-to-BOF patterns. The v0.4.20 replay change traded -63 TP for -84 FP here; check whether the lost TPs are recoverable with narrower-type tracking like the char/short fixes.
2026-06-10: blocked on task 149 — CWE-680 (int overflow → buffer overflow) spans the integer and buffer layers; build on the shared bounds API.

--- 2026-06-21 RESULT (v0.4.58, commit fa49d057) ---
Reframed: CWE-680 was never a precision problem (already 100% CWE-matched precision, 0 FP). The gap vs Frama-C (82.6%) is RECALL: per-file detection was 37.2% (125/336). The note's 'char/short narrow-type' guess didn't apply -- all 336 files use 'int data; malloc(data * sizeof(int))'; variation is the SOURCE of data + Juliet flow variant.

Fix: INT32-C check_allocation_overflow skipped any size arg whose product provably fit 64-bit signed, missing the 'fixed' pattern (data = INT_MAX/2 + 2 -> 4294967300, fits 64-bit but wraps 32-bit size_t). Now skips only when fits-64 AND not a definite 32-bit size_t wrap (expression_overflows_unsigned_vra(...,32,...)). Good 'data = 20' -> 80 stays clean.

Full fast benchmark sqc-0.4.57 -> sqc-0.4.58: overall TP +10 (22615->22625), FP +0 (4607), tp_rate 83.1% flat. ZERO CWE/rule regressions. Timing -0.8%. CWE-680: INT32-C 125->135 TP, per-file 37.2%->40.2%, still 0 FP.

Residual gap (40.2% vs 82.6%) needs interprocedural integer-range propagation = infra task 150 deferred. Tracked as task 215. Closing the no-infra portion here.done2026-06-10T03:51:31Z2026-06-21T17:10:08Z2026-06-21T18:59:01Z
����S��c�E555Ceiling decision: post-75% strategy — alias analysis vs SSA-lite use-def vs pivot to real-world hardeningPaper's own Limitations section estimates a 75-80% precision ceiling without alias analysis, SSA, or symbolic execution; v0.4.17 is at 72.6% and still climbing ~1-2.5pp per stretch. Decide explicitly BEFORE burning the per-rule FP backlog on the last 2pp: (a) declare victory at ~75% and pivot to real-world hardening + paper, or (b) invest in the next infrastructure layer. If (b), pick alias analysis vs SSA-lite use-def chains based on which the real-world audit (task 148) shows is the bigger FP source. Do not start the infra investment until the audit data is in.

--- 2026-06-18 DECISION (owner) ---
Resolved: this is a non-item right now. Do NOT commit to a major infra bet
(alias analysis / SSA-lite) at this point. Proceed tackling issues as they
arise from the backlog; re-evaluate major architectural decisions once the
todo bucket thins out again.

Supporting data at decision time (v0.4.47): Juliet CWE-matched precision
83.1% (22615 TP / 4607 FP) — already ABOVE the paper's predicted 75-80%
ceiling. Real-world adjudicated precision: curl 1.0%, libcrc 3.5%, sqlite
6.3%, mosquitto 13.4%, hostap 13.8%. Top real-world FP rules: INT32-C 4502,
MEM30-C 3793 (1 TP), DCL13-C 2401, API00-C 2150, EXP34-C 2098, EXP33-C 1260,
STR34-C 1186, ARR30-C 888 (0 TP) — all macro-expansion / INT-overflow /
caller-contract driven, NOT aliasing. => alias/SSA would lift Juliet a few pp
but not move real-world precision (the number the paper must defend), so no
infra investment is warranted now. Task 206 (alias-bound Juliet FPs) stays
low-priority accordingly.done2026-06-10T12:32:58Z2026-06-18T20:23:13Z2026-06-18T20:23:13Z�T��1�{	555Shared bounds/buffer-size API in src/analyze/ (consolidation before more FP tasks)Consolidation sprint before tasks 143/144/145 so fixes compound instead of accreting into 2,000-4,600-line rule files. Scope: (1) extract the duplicated vra_var_ranges_at() (identical in int32_c.rs:35-59 and arr30_c.rs:181-203) into src/analyze/; (2) unify buffer-size analysis behind one API — ARR30-C's BufferInfo enum and STR31-C's text-pattern memset/malloc-arithmetic parsing solve the same problem with private tooling; (3) have ARR30-C consume prescan's context.macro_constants instead of re-extracting macros/typedefs per file; (4) factor the copy-pasted RefCell CFG/VRA setup boilerplate shared by all VRA-consuming rules. Tasks 143, 144, 145 should be implemented ON TOP of this API.done2026-06-10T12:32:44Z2026-06-11T12:24:17Z2026-06-11T15:10:48Z
�c��q��I�e5Paper: quarantine Juliet-specific tuning and hedge the 100%-precision claims (CWE-78, CWE-690)ENV03-C contains explicitly Juliet-tuned logic (goodG2BSink pattern, Juliet v34/v42/v45 handling in env03_c.rs); STR31-C hardcodes the Juliet memset(buf,'A',N) idiom. (1) Mark these in code comments as benchmark-idiom handling where not already done. (2) The 100%-precision/0-FP claims on CWE-78 (taint) and CWE-690 (inter-procedural null) are suspicious as generalization claims — hedge them in the paper, or back them with real-world evidence from the task-148 audit if it validates them.pending2026-06-10T12:32:58Z���1�M5Develop a sound evaluation methodology for concurrency rules (CON03/CON07/CON33-C)CWE-377 (CON33-C) sits at 3% TP rate and CWE-366 (CON07-C) at 8% — race conditions are structurally beyond intra-procedural static analysis. Rather than spending fp-reduction effort here, demote both to manual-review severity or disabled-by-default in the TOML. Also cleans up headline precision honestly. Note d5e6a286 already cut their FP rates from 97%/87%, but the remaining signal is still too weak to report by default.
Catapult audit update (2026-06-17, DB_UPDATE.md): New CON03-C data — sqc's CON03-C heuristic flags ALL file-scope statics in any TU containing a function named IRQ/interrupt/ISR, without checking whether the ISR can reach the flagged var. Catapult RC624 firmware: ~130 CON03-C FPs (76% of 176). No call graph for ISR reachability. CON07-C: ~52 FPs (80% of 65), same root cause (main-loop-only functions flagged because file contains an ISR). Combined ~182 Medium FPs from one root cause (no ISR reachability). Options: A demote/disable (loses 8-24% signal); B ISR call-graph reachability (preserves ~26 CON07-C + ~46 CON03-C genuine hits). Catapult's high MCU FP rate strengthens B. Note: DEV_APPROX_IRQProcess has 'IRQ' in name but is a main-loop poller — name matching alone insufficient; need vector-table / indirect-call analysis.

--- 2026-06-21 RE-CHARACTERIZED (owner) ---
SCRAPPED the original demote/disable framing. Two corrections:
  1. The `severity = "Medium"` on CON07-C/CON33-C/CON03-C is lifted
     verbatim from the CERT-C wiki risk-assessment table (e.g. CON07-C
     line 102: "CON07-CMediumProbableYesNoP8L2"). That is CERT's
     authoritative rating, NOT ours to demote. Demoting severity would
     misrepresent the standard.
  2. Do NOT disable the rules. They stay enabled at their CERT severities.

NEW GOAL (research/discovery only — do NOT implement yet):
  Figure out how to PROPERLY EVALUATE the concurrency rule runs. The 3%
  (CON33-C) / 8% (CON07-C) "TP rates" are suspect as a measure of rule
  quality: race-condition rules are structurally hard for both static
  analysis AND for ground-truthing. Before spending FP-reduction effort,
  establish whether the weak numbers reflect bad rules or an inadequate
  evaluation harness/oracle for concurrency.

  Discovery questions to answer (later):
   - Is there a concurrency-appropriate ground-truth corpus (Juliet
     CWE-366/367/377/362/364 templates? a thread-aware oracle?) vs the
     current intra-procedural scoring that may not credit valid hits.
   - The Catapult MCU finding (no ISR reachability => ~182 Medium FPs from
     one root cause) suggests the FP signal is concentrated and
     characterizable, not random noise — quantify that before judging.
   - What would a defensible precision/recall number for these rules even
     look like, and what harness produces it.

  Deliverable for this task = a written evaluation plan, not code. Once we
  have the plan, implementation (e.g. ISR call-graph reachability, the old
  "Option B") becomes its own follow-on task. Lowered to P4: park until the
  backlog thins (per task-150 standing guidance: no big infra bets now).pending2026-06-10T12:32:58Z
``������{555Shared iterative AST walker for rule check() implementationshostap hostapd/config_file.c (multi-thousand-deep else-if chain) overflowed the stack in ARR00-C, MEM33-C (collect + check passes); fixed those individually in v0.4.22 (commit 1c94dc95) by converting to explicit-stack pre-order walks. ~252 rule files still share the self-recursive check pattern and are one deep input away from the same crash. Provide a shared iterative pre-order walker (e.g. in src/analyze/ or rules common) and migrate rules, or at minimum the rules enabled in rules-benchmark.toml.done2026-06-10T20:17:54Z2026-07-03T14:41:19Z2026-07-03T21:56:36Z�1�
_�		555Trim benchmark MCP server token footprintObservation (2026-06-11): the juliet-benchmark and realworld-benchmark MCP servers contribute disproportionately to Claude's token usage — the opposite of their intent. Root cause is verbose JSON payloads returned whole into context. Worst offenders: (1) list_runs dumps ALL runs (121+) with every field — a single call is ~8-10K tokens when the caller usually wants just the latest run name; add limit/since/latest params and a compact mode. (2) get_status re-emits recent-CWE detail on every poll; over a ~15-min run that compounds. (3) compare_runs/get_cwe_detail return deep nested breakdowns even when a few scalars are wanted. Explore: default-compact responses, pagination/limit params, a 'fields' selector, and returning answer-shaped summaries instead of raw tables. Files: mcp_servers/server.py (+ realworld server).done2026-06-11T13:34:58Z2026-06-11T15:12:40Z2026-06-11T15:22:33Z�d��)�#	555Real-world ground-truth (TP reference) databases for measured precision/recallBuild a curated, versioned ground-truth label set per real-world codebase (libcrc, mosquitto, curl, sqlite, hostap) — the real-world analog to Juliet's OMITBAD/OMITGOOD oracle — so we can compute ACTUAL precision/recall on real code over time instead of only volume reductions and one-off sampled audits.

Motivation: the v0.4.22 sampled precision audit (data/precision_audit/) showed measured real-world precision for the noisiest rules is ~2-34% (combined ~10.5%), a gap Juliet's synthetic tests do not predict. Reference: 'Juliet is a rough approximation, not a proxy' principle now in the paper. A standing labeled corpus turns ad-hoc adjudication into a regression metric.

Scope:
1. Schema: add ground-truth tables to data/benchmarks.db keyed by (project, codebase_commit, file, line, rule_id/cwe_id) with a verdict (TP/FP/uncertain), adjudicator, reason, and date. Pin to codebase_commit (now captured per realworld_results row) so labels stay valid only for the revision they were judged against.
2. Seeding: import the 200 adjudicated findings already in data/precision_audit/adjudication_0.4.22.csv as the first labels; design so future sampled audits append rather than replace.
3. Scoring: a bench command (e.g. 'python -m bench realworld-score RUN_ID') that joins a run's realworld_violations against the ground-truth labels for the matching codebase_commit and reports measured precision (and recall over labeled TPs) per rule and overall, with a warning when a run's codebase_commit has no labels.
4. Provenance: reuse the codebase_commit capture (commit e9957b77); only score label-vs-run pairs on identical commits.
5. Stretch: confirmed-TP labels can seed a real-world regression-detection set (alerts if a known true bug stops being flagged), and uncertain/disputed labels feed a re-adjudication queue.

Relationship to other tasks: complements the sampled audit feeding tasks 140/142/143/146; over time this becomes the primary real-world quality signal alongside Juliet.done2026-06-11T12:22:56Z2026-06-11T15:32:16Z2026-06-11T17:38:16Z
�z��=��g� ��O	555File-at-a-time audited corpus: schema + scorer + versioningRestructure task-156 approach from rule-sampling to file-at-a-time exhaustive audit. (1) audited_files table = per-file done-unit. (2) FN support in ground_truth (verdict=FN, provenance, confidence cols) for recall. (3) coverage+recall scorer restricted to audited-file set + per-project coverage view. (4) oracle DB version-stamp/freeze for the paper. Codebases are fixed at pinned commit; corpus grows monotonically toward full coverage, reusable across every future sqc version.done2026-06-11T20:04:31Z2026-06-11T20:04:34Z2026-06-11T20:19:34Z�D�
a�u5Real-world ground truth: hostap full auditBuild the hostap (wpa_supplicant/hostapd) ground-truth oracle (template: libcrc/sqlite). Steps: (1) conf/realworld/hostap-rules.toml on benchmark base + categorical disables; wire manifest (entry already has -d src -d wpa_supplicant + includes). (2) Scope = src/ + wpa_supplicant/ + hostapd/ (exclude tests). (3) Sample-adjudicate top rules; hostap has EAP method tables / eloop callbacks (DCL13 FPs) and the known OSU XML length->malloc INT32 TP. (4) import-labels pinned to commit dcee60436; score.pending2026-06-11T17:58:10Z��
]�Y555Real-world ground truth: curl full auditBuild the curl ground-truth oracle (template: libcrc/sqlite). DONE 2026-06-16: adjudication + 3-agent adversarial pass complete, all 427 in-scope files (329 adjudicated + 98 zero-finding FN-read). Result: 100 TP / 11100 FP = 0.89% precision, 5 confirmed FNs. WIN_MAC (14 Win/Apple files) excluded as separate build config. Artifacts: data/precision_audit/curl/ (README, adjudication_curl.csv, fns_curl_final.csv, adversarial/). REMAINING (kept in-progress): realworld-import-labels + audit-complete per-file + audit-coverage --set-total 427 + realworld-score (DB writes — run when benchmark DB free); apply WIN_MAC exclusion to curl benchmark scoring scope (task 189 sibling).done2026-06-11T17:58:10Z2026-06-16T17:43:46Z2026-06-16T19:38:54Z�T�
g�E555Real-world ground truth: mosquitto full auditBuild the mosquitto ground-truth oracle using the libcrc/sqlite template. mosquitto is the next-smallest after libcrc -> good first full(ish) audit. Steps: (1) tailor conf/realworld/mosquitto-rules.toml on the benchmark base + categorical disables; wire manifest in CODEBASES (entry already has includes). (2) Define scope (lib/ + src/ broker; exclude deps/, test/, examples). (3) Sample-adjudicate top rules (DCL13-C, EXP34-C, MEM30-C, INT32-C) from run sqc-0.4.22-1c94dc95, reading source. (4) import-labels pinned to commit d3ee5c5c; score. Existing v0.4.22 labels: DCL13 4, EXP34 3, INT32 2, MEM30 6.done2026-06-11T17:58:10Z2026-06-15T20:45:37Z2026-06-15T20:45:37Z��
u�555Real-world ground truth: sqlite remaining incrementsContinue the incremental sqlite oracle started in increment 1 (INT32-C, 15 labels; config conf/realworld/sqlite-rules.toml; scope = shipped src/+ext/, see data/precision_audit/sqlite/README.md). Adjudicate the remaining high-volume in-scope rules via the sampling loop (realworld-unlabeled -> read source -> import-labels): MEM30-C (2384, unlabeled), API00-C (1377, unlabeled), EXP34-C + DCL13-C (extend v0.4.22 samples), INT30-C, EXP33-C, INT14-C, ARR00-C/ARR30-C. Add categorical config disables as the audit justifies them. Goal: a representative measured-precision corpus per rule, grown over time.

[2026-06-14] DONE — subsumed by the full file-at-a-time audit (task 163): 220/220 in-scope files, 24,834 findings adjudicated in ground_truth, exact per-rule measured precision for ALL high-volume rules this task targeted (MEM30 2300 FP/0.0%, API00 1366/0.1%, EXP34 1496/0.5%, INT30 915/0.1%, EXP33 672/0.0%, INT14, ARR00/ARR30, etc.). A full census, not a sample. See data/precision_audit/sqlite/ANALYSIS.md + README.md.done2026-06-11T17:36:17Z2026-06-11T18:14:48Z2026-06-14T22:25:36Z

�
z
��\�"��3555Real-world ground truth: sqlite file-at-a-time audited corpusConvert sqlite to the file-at-a-time audited-corpus model against config-correct run #40 (sqlite-rules.toml, 45582 findings). Reconcile increment 1-5 labels (INT32/MEM30/API00/EXP34/DCL13, ~259 labels made vs base-manifest run #34) against #40. Establish in-scope file universe per data/precision_audit/sqlite/README.md scope (src/ core + ext/ shipped extensions; exclude autosetup/jimsh0.c, tool/, test/, src/test*.c, ext/jni, ext/wasm, tclsqlite.c, *_tcl/*test* glue). Pin coverage denominator. Sweep files: pull-all-findings-per-file, label TP/FP, read for FNs, audit-complete. Long campaign.done2026-06-11T23:33:02Z2026-06-11T23:35:53Z2026-06-12T00:08:03Z��!��555Real-world ground truth: libcrc file-at-a-time audited corpusConvert libcrc to the file-at-a-time audited-corpus model (task 160 infra). Step 0 (config) settled: conf/realworld/libcrc-rules.toml, 23 out-of-scope rules disabled (Windows-on-POSIX, chroot, TOCTOU, binary-data, advisory). Produce a config-correct sqc 0.4.24 run, reconcile the existing 372 labels (13 TP/359 FP) against it per file, read each file for FNs, mark files audited, pin in-scope file total, score + freeze. Replaces stale run #34 (v0.4.22, predates the disables -> 44 out-of-scope findings).done2026-06-11T20:39:48Z2026-06-11T20:39:58Z2026-06-11T22:14:07Z� low conf) RECORDED as FN. Guard len>=nSuper admits len=nSuper-1 then writes 2-byte terminator zSuper[len]/zSuper[len+1]; zSuper[len+1] hits index nSuper. Reachable as 1-5 byte OOB heap write ONLY with custom VFS mxPathname==2^k-1 AND pageSize==that power-of-two via crafted hot-journal; default VFS safe (power-of-two pageSize slack). Re-check live-at-HEAD status at disclosure time.
BATCH 10 DONE (2026-06-14, MEDIUM-effort core/glue filler): expr.c/wherecode.c/window.c/analyze.c/vdbemem.c/insert.c via core framework, 14 reviewers, integrity gate. 1513 findings -> 120 TP / 1393 FP, 0 semantic TP, 0 recorded FN. All 120 TP decl/macro/recursion (MSC04-heavy expr.c recursion thicket + DCL13/DCL03/PRE). Coverage 112 -> 118/220 (53.6%). FNs still 14, real bugs still 13. One benign FN noted-not-recorded: window.c:401 cume_dist float div-by-zero (IEEE-defined, not CERT-class, nTotal>=1 guaranteed). Bifurcation now across 15 large core files, 0 production semantic TP. CSVs+README+memory updated. NEXT medium filler: trigger.c 181, alter.c 180, sqliteInt.h 177, pragma.c 166, prepare.c 159, whereexpr.c 150, os_kv.c 140, fkey.c 124, vtab.c 117, update.c 111, treeview.c 98, mem2.c 98, ...
BATCH 11 DONE (2026-06-14, MEDIUM-effort core/glue): trigger/alter/sqliteInt.h/pragma/prepare/whereexpr/os_kv/fkey/vtab/update, 17 reviewers. 1505 findings -> 141 TP / 1364 FP, 0 semantic TP, 1 FN. All 141 TP decl/macro/recursion (sqliteInt.h 94 PRE/DCL macro-hygiene + MSC04). Coverage 118 -> 128/220 (58.2%). FNs 15, confirmed real bugs now 14.

** SIGNIFICANT FN (priority disclosure candidate): os_kv.c:469 ARR30-C heap OOB WRITE in shipped kvvfs (WASM/browser KV VFS). kvvfsDecode hex-pair branch writes aOut[j]/aOut[j++] with NO j<nOut check (only zero-run branch checks j+n>nOut); via kvvfsDecodeJournal:510 aOut=pFile->aJrnl malloc'd to base-26 header length n from the SAME untrusted kv text -> crafted journal (small header n + longer hex payload) = attacker-controlled heap overflow. Found via TWO-REVIEWER DISAGREEMENT resolved by source-read (integrity gate caught it; chunk1 wrongly said bounds-checked). Unlike amatch (demo code), kvvfs is SHIPPED production. sqc missed it. Re-check live-at-HEAD at disclosure. NEXT: ext/expert/sqlite3expert.c 228 (untrusted-SQL advisor, higher-effort candidate), then resolve.c/treeview.c/mem2.c/dbstat.c/vacuum.c core filler.
BATCH 12 DONE (2026-06-14, HIGHER-effort untrusted-SQL advisor): ext/expert/sqlite3expert.c, 3 reviewers, untrusted-input framework. 228 findings -> 2 TP / 226 FP, 0 FN. Coverage 128 -> 129/220 (58.6%). Confirmed real bugs 14 -> 15.

** sqc-CAUGHT REAL BUG #15 (integrity-gate recovered FP->TP): sqlite3expert.c idxNewConstraint @297 allocs sizeof(IdxConstraint)*nColl+1 (* should be +); zColl=&pNew[1] @offset 40, memcpy nColl+1 @305 -> for nColl<=1 buffer undersized (nColl=1: alloc 41 < 42 = 1-byte heap OOB write; nColl=0 ~40B). nColl=STRLEN(collation name) reachable via column COLLATE x (1-char) thru sqlite3_vtab_collation/aCol.zColl. sqc flagged ARR38-C @305 (memcpy invalid size calc) = CORRECT catch; chunk0 reviewer wrongly FP'd it with false inequality '41>=42', integrity gate overrode FP->TP. Co-located INT30/INT32 @302 stay FP (mischaracterize as arith-wrap, not the failure mode). First sqc-caught semantic TP since decoder batches b3-b6; PRIORITY disclosure (sqlite3expert has public C API). DCL38 @1561 struct-hack = 2nd (style) TP. NEXT core/glue filler: resolve.c 93, treeview.c 98, mem2.c 98, dbstat.c 97, vacuum.c, ...
BATCH 13 DONE (2026-06-14, MEDIUM-effort core+ext/misc filler, 18 files, 1 reviewer/file): treeview/mem2/dbstat/resolve/pcache/pcache1/memdb/os/bitvec/mem5 + vfslog/sha1/unionvtab/vtablog/vfstrace/vfsstat/tmstmpvfs/closure. 1542 findings -> 59 TP / 1483 FP. Coverage 129 -> 147/220 (66.8%, two-thirds). FNs 15 -> 17, confirmed real bugs 15 -> 16.

** sqc-CAUGHT real bug #16: closure.c:568 MEM30 use-after-free (idx 34/35). closureConnect: on sqlite3_declare_vtab failure, closureFree(pNew)@566 then falls through to *ppVtab=&pNew->base@568 (dangling). Benign (caller ignores *ppVtab on error per vtab contract) but genuine MEM30; sqc flagged correctly.
** FN dbstat.c:449 ARR30 (low conf): statDecodePage cell-ptr read aData[nHdr+i*2] for i<nCell; nCell(hdr byte3,<=65535) unbounded vs pgsz+256 buffer before loop -> corrupt-DB heap overread via SELECT*FROM dbstat. sqc emitted only INT32(FP) at 449. dbsqlfuzz-hardened so low conf, needs ASAN/HEAD confirm.
** FN vfstrace.c:897 EXP34 (low conf): pNew=sqlite3_malloc then memset no null-check = OOM null write; sqc fired EXP33(wrong rule) at line. debug VFS shim, OOM-only.
Noted-not-recorded: vtablog.c:96 trim off-by-one (in-bounds), unionvtab.c:758 isidchar c<'Z' typo (logic). sha1/memdb/unionvtab decode paths verified clean. NEXT: ~73 remaining smaller core/glue+ext/misc files.

BATCH 14 DONE (2026-06-14, 22 files, decoders + hardened-core/glue, 1 reviewer/file + integrity gate): intck/base64/totype/dbdump/fts5_varint/fts3_unicode/fts3_unicode2/fts5_unicode2/fts5_buffer/fts5_aux/checkfreelist/fts3view/percentile/randomjson + vdbeblob/delete/mem3/attach/malloc/carray/backup/random. 1338 findings -> 65 TP / 1273 FP, 3 FNs. Coverage 147 -> 169/220 (76.8%, three-quarters). FNs 17 -> 20, confirmed real bugs 16 -> 17.

** sqc-CAUGHT real bug #17: checkfreelist.c:277 EXP34 OOB read in sqlite_readint32(blob,offset). readint_function: signed int iOff (2nd SQL arg), guard nBlob>=(iOff+4) trivially true for negative offset (8>=-96) -> get4byte(&zBlob[-100]) reads before buffer; iOff+4 also int-overflows for iOff near INT_MAX. SQL-reachable once ext/repair/checkfreelist loaded. sqc flagged EXP34 @277 correctly. Loadable repair ext (not core) but genuine SQL-reachable read primitive.
** sqc-caught memory-safety TP fts3view.c:579 (standalone tool): decodeSegment memcpy(zTerm+iPrefix,aData+i,(size_t)nTerm) -- untrusted int64 varint nTerm, guard bypassable by overflow, src len unchecked vs nData. sqc fired INT31@579 + INT32@579/580. Dev tool, lower severity.
Integrity gate overrode 5 reviewer verdicts: checkfreelist idx9/10 TP->FP (sqc mislabeled u32 underflow as signed; unreachable b/c sqlite_dbpage always full page>=512); fts3view 157/158 TP->FP (ARR39 double-scaling wrong, offset/size are CLI args not data); fts5_buffer idx49 TP->FP ((t&0x80) short-circuits unsafe index).
FNs recorded (low conf): intck.c:322 intckGetToken quoted-string branch terminates only on matching quote NOT NUL -> unbounded OOB read on unterminated quoted identifier in corrupt sqlite_schema.sql; fts3view.c:568 getVarint past nData; percentile.c:291 32-bit doubling wrap (~16GB unreachable).
Hardened core (backup/malloc/mem3/attach/vdbeblob/delete/random) = ONLY decl/macro/recursion TPs, ZERO semantic. Bifurcation holds 14 batches. NEXT ~51 files: large core engines (vdbe/btree/where/select/expr/build/os_unix/os_win/json) + heavy ext decoders (fts5_index 991, sqlite3session 716, fts3 631, sqlite3rbu 524, rtree 450, spellfix 406, qrf 366, geopoly 272) warrant HIGH-effort framework.
DISCLOSURE BACKLOG ADD (b14): checkfreelist.c:277 sqlite_readint32 negative-offset OOB read (SQL-reachable, loadable repair ext) -- priority disclosure candidate; re-check live-at-HEAD.

BATCH 15 DONE (2026-06-14) -- CAMPAIGN COMPLETE 220/220 (100%). 46 files (all remaining), 1484 findings -> 134 TP / 1350 FP, 3 FNs. NEW confirmed real bug #18: prefixes.c:295 prefix_length() NULL deref (SQL-reachable loadable ext; sqc CAUGHT EXP34). FNs (low): scrub.c:442 varint OOB past page buffer, nextchar.c:184 OOB read, fts3_term.c:232 doclist varint OOB. No reviewer overrides needed. 5-file gap to 220 = platform headers (hash.h/msvc.h/os_setup.h/os_win.h/vxworks.h, 0 sqc findings, recorded 0-finding audited). CAMPAIGN TOTALS: 220/220 files, 24834 findings -> 1496 TP / 22154 FP / 23 FN / 48 uncertain, precision ~6.3%. TP by class DCL 769 + PRE 359 + MSC 214 = ~90% decl/macro/recursion; semantic minority mostly benign. 18 confirmed real bugs, all in untrusted-input/decode/corrupt-DB/tool paths, none in hardened core. Bifurcation proven across full shipped corpus.done2026-06-12T00:10:41Z2026-06-12T21:39:04Z2026-06-14T20:24:44Z
HH�(�#���M555sqlite file-at-a-time: batches 2+ (191/220 files remaining)Continue sqlite file-at-a-time audited corpus vs config-correct run #40, denominator 220. Coverage 107/220 (48.6%) as of 2026-06-12. Done thru batch8: vdbeaux/select; b3 (8 decoders); b4 (json/geopoly/recover/fts5_hash/normalize); b5 (rbu/spellfix/qrf/fts3 tokenizers); b6 (rtree/date/amatch/checkindex/fuzzer/utf); b7 (changesetfuzz/fileio/series+build.c/os_unix.c); b8 (MEDIUM-effort core filler: os_win.c/main.c/util.c/vdbeapi.c, 1657 findings -> 31 TP/1626 FP, 0 semantic TP, 0 FN). 13 confirmed real bugs (ALL untrusted-input parsers), 13 FNs, still NO production hardened-core semantic TP (4 core files build/os_unix/os_win/main = 2828 findings, 0). EFFORT POLICY (user 2026-06-12): MEDIUM effort for pure hardened-core/glue filler, but KEEP HIGH effort + rigorous FN-hunt for the remaining genuine-untrusted-input files even though they're core: pager.c 429, wal.c 414, func.c 312, printf.c 249, vdbesort.c 223. Integrity gate (source-verify every semantic TP / FN candidate) is non-negotiable at any effort. Remaining in-scope ~113 files, mostly core/glue filler: expr.c 453, wherecode.c 226, window.c 216, analyze.c 211, vdbemem.c 193, insert.c 182, alter.c 178, sqliteInt.h 177, pragma.c 164, trigger.c 161, prepare.c 146, whereexpr.c 146, os_kv.c 138, fkey.c 123, vtab.c 110, utf.c done, ... Next: a HIGH-effort batch of pager/wal/func/printf/vdbesort, then resume medium-effort filler. Framework: /tmp/core_framework.md (core), /tmp/batch_framework.md (decoders). DISCLOSURE BACKLOG below.


DISCLOSURE BACKLOG (defer sqlite-team reports until FULL audit complete — user 2026-06-12): re-scan ground_truth verdict='FN' for live-at-HEAD items at report time. Only live-at-HEAD confirmed bug = amatch.c:1160 heap-overflow WRITE, but amatch is sqlite-labeled 'unused demonstration code'. changesetfuzz.c:506 INT32 overflow is tool-scope (standalone CLI). util.c:1328 GetUInt32 2^32 off-by-one noted-not-recorded (benign). All other confirmed bugs already fixed upstream or read/leak FNs in demo/repair/tool extensions.
BATCH 9 DONE (2026-06-14, HIGH-effort genuine-untrusted-input core): pager.c/wal.c/func.c/printf.c/vdbesort.c via untrusted-input framework + 17 reviewers + integrity gate. 1752 findings -> 79 TP / 1673 FP, 0 semantic TP, 1 FN. All 79 TP decl/macro/recursion (DCL13/MSC04/PRE/DCL03). Coverage 107 -> 112/220 (50.9%). FNs 13 -> 14. CSVs: data/precision_audit/sqlite/adjudication_sqlite_{pager,wal,func,printf,vdbesort}.csv; README batch-9 entry appended. Bifurcation now confirmed across the 5 genuine-untrusted-input core files too: 0 production semantic TP. NEXT: resume MEDIUM-effort core/glue filler (expr.c 453, wherecode.c 226, window.c 216, analyze.c 211, vdbemem.c 193, insert.c 182, alter.c 178, pragma.c 164, trigger.c 161, prepare.c 146, whereexpr.c 146, os_kv.c 138, fkey.c 123, vtab.c 110, ...).

DISCLOSURE BACKLOG ADD (batch9): pager.c:1335 readSuperJournal off-by-one (ARR30-C,�
�
d��p�%�I�555SECURITY (candidate): sqlite changeset invert/concat OOB-read via sessionChangesetBufferRecordAudit of ext/session/sqlite3session.c @ b1a73ba34d found a candidate out-of-bounds read. sessionChangesetBufferRecord (raw-record fast path for sqlite3changeset_invert/_concat/changegroup) reads field lengths via the UNSAFE sessionVarintGet (no buffer bound) and accumulates 'nByte += n' (lines 3691/3692/3695) with no nByte<0/overflow/bounds check -- unlike the validated sessionReadRecord path (which uses sessionVarintGetSafe + 'nByte>nData-iNext -> CORRUPT'). For non-streaming input sessionInputBuffer is a no-op (no bound). Callers use the unbounded nByte without validating vs input size: invert does sessionAppendBlob(&sOut,&aData[iNext],nByte) at ~4187, iterator does iNext+=nByte at ~3848. A crafted changeset with an inflated field-length varint -> signed overflow + OOB read of the application's changeset buffer. 4 INT32-C TP + 14 INT31-C uncertain (merge/rebase sessionSerialLen->memcpy consumers), 2 subagents corroborated. ACTIONS: (1) confirm still present on current sqlite trunk; (2) build a crafted-changeset PoC repro under ASAN; (3) if confirmed, RESPONSIBLE DISCLOSURE to sqlite (not a public PR) -- this is widely deployed. Disclose AI-assisted discovery per attribution norms. Relates to task 164.done2026-06-12T12:16:27Z2026-06-12T12:37:09Z2026-06-12T12:37:09Z��$�1�K5Upstream contribution: report/PR genuine findings back to benchmarked OSS projectsTrunk-validated. SQLITE (sqlite-main 124f449319): 3 genuine bugs ALREADY FIXED upstream (session OOB-read 535b1f2875+4da2ddf50e; sqlar heap-overflow 34e139d3a3; compress null-derefs 1c0a370472) -> no action, validation wins. 2 STILL PRESENT, low-severity contribution candidates: fts5 fts5SegmentSize 1+pgnoLast-pgnoFirst overflow (~1485/1551, contained); pcache.h broken include guard (~16, harmless-in-amalgamation). LIBCRC (lammertb/libcrc): upstream HEAD == our audited pin 7719e21, UNMAINTAINED since 2021-04-21 -> all 13 TP + 1 FN still present but project abandoned (weak PR targets; CON03 race is a known documented libcrc limitation). NET actionable upstream contributions = the 2 still-present sqlite hardening items only, low priority, with AI-attribution disclosure. Do after full suite per user.
mosquitto PR drafts ready (2026-06-15): data/precision_audit/mosquitto/upstream_prs/ — 00-INDEX.md + 11 per-defect reports (root cause vs mainline d3dd4463, valgrind/ASan or fault-injection repro, fix diff). Net 9 file-a-PR defects + 1 defensive guard; #05 tls_opts_set withdrawn (not a bug). PR order: 01 handle_auth MQTT5 leak, 02 srv_mosq ares leak, 11 persist_write double-fclose (all normal/valgrind-reproducible) first. User installing gh to post. Prior-art checked vs eclipse-mosquitto issues.pending2026-06-12T02:10:48Z
�
�����W�)��	555API00-C internal-contract FP suppression (1366 FP / 1 TP in sqlite audit)ANALYSIS.md §1: API00-C = 1366 FP / 1 TP (0.1%), #4 FP source. Misfire: flags params that an internal contract guarantees non-null (mutex held / caller invariant / asserted) — not a trust boundary. Fix: API00 should fire only at actual external trust boundaries (public API entry, untrusted input), not internal callees.done2026-06-14T22:19:35Z2026-06-15T15:04:54Z2026-06-15T16:04:55Z�;�(��e	555EXP34-C guarded-null FP suppression (1496 FP / 7 TP in sqlite audit)ANALYSIS.md §1: EXP34-C = 1496 FP / 7 TP (0.5%), #3 FP source. Misfire: null-deref already dominated by an assert / rc==SQLITE_OK / explicit if(p) guard, or OOM paths that set rc before deref. Fix: suppress when a guard (assert/rc-check/if) on the pointer dominates the deref. NOTE the flip side is FN task (EXP34 OOM null-deref AFTER malloc) — keep the guard-aware suppression from also masking the unguarded-malloc pattern.done2026-06-14T22:19:35Z2026-06-15T12:45:53Z2026-06-15T13:55:37Z�;�'��[	555MEM30-C freed-context-arg FP suppression (2300 FP / 0 TP in sqlite audit)ANALYSIS.md (commit fd942348) §1: MEM30-C = 2300 FP / 1 TP across the 24,834-finding sqlite corpus (0.0% precision), the #2 FP source. Dominant misfire: sqc reads the CONTEXT arg of sqlite3DbFree(db,x) / sqlite3*Delete(db,x) / robust_close(pFile) as the freed object — the live handle is never freed (the real freed arg is read first). Also %z mprintf-accumulator frees misread as double-free. Fix: when a free-like call has a (handle,target) signature, treat only the target operand as freed. Related mechanism task: 1 (field-level free tracking).done2026-06-14T22:19:35Z2026-06-15T11:51:10Z2026-06-15T12:36:59Z�V�&
{�5Explore: optional local AI-assisted review model in sqcExploration spawned by the file-at-a-time real-world audit (task 163). The audit empirically shows sqc's SEMANTIC rules (MEM30/INT30-32/ARR/EXP33-34/API00) are ~0% precise on hardened production C — the FP mass is exactly the class a Claude-subagent adjudication pass reliably filters (and which also surfaced a real FN, the matchinfo OOB write). Investigate baking an OPTIONAL, opt-in local/on-device AI-assisted review stage into sqc itself: (1) a post-analysis triage that scores/suppresses likely-FP semantic findings before they reach the user (could lift real-world precision from single digits toward usable); (2) optionally an FN-assist that reads high-risk untrusted-input decode routines. Design considerations: must be OPTIONAL and local (privacy / no code leaves the host — BISSELL Data Protection principle); model packaging/size; latency budget; determinism/reproducibility for benchmarks; how to present AI-adjudicated verdicts (confidence + rationale) without overclaiming (Data Quality principle, human-review). Tie-in: the audited-corpus oracle (data/benchmarks.db ground_truth) is the natural eval set to measure whether an AI-review stage improves precision without tanking recall. Decide build-vs-skip after more of the real-world suite is audited.pending2026-06-12T14:54:42Z
�jz��t�,�G�#555FN-detection 2a: taint-aware 'untrusted length -> unguarded buffer access' (+ re-point ARR30)ANALYSIS.md §2a: the biggest recall gap. 13 of 23 sqlite FNs are unbounded varint/decode-loop reads where a length/count/pointer from sqlite3_column_*/blob/file/page bytes drives a read/write with no bound check before access (os_kv.c:469 [disclosed], fts3_snippet.c:890 high-conf OOB write, spellfix.c:2597, sqlite3rbu.c:2654, fts5_storage.c:1405, fts3_term.c:232, fts3view.c:568, checkindex.c:389, sqlite3intck.c:322, scrub.c:442, nextchar.c:184, zipfile.c:714, dbstat.c:449, pager.c:1335). THE ARR30 PARADOX: ARR30-C = 628 FP / 0 TP yet these FNs are ARR30-class -> the rule fires on bounded indices it misreads and misses the real unbounded reads. Re-point ARR30 at: taint a length from untrusted source, require a 'p<end'/'idx<n' guard dominating the indexing read; treat getVarint and while(*p++!=term) loops as unbounded absent such a guard. Rare change that lifts recall AND precision together.
Catapult audit update (2026-06-17, DB_UPDATE.md): Catapult RC624 firmware produced ~109 ARR30-C FPs from two sub-patterns reinforcing the ARR30-C re-point. Sub-pattern A (~108): enum-constant indices on arrays sized exactly to the enum range (e.g. WIFI_Net_FunArray indexed by WIFI_NET_IDLE/CONF, array sized to WIFI_NET_END); sqc cannot prove cross-TU enum-to-array-size alignment. Goes away entirely with the taint-aware unbounded-read trigger (main thrust of task 172). Sub-pattern B (1-2): sqc miscounts AdcChannelTable in dev_adc.c as 5 elements vs actual 11 — likely only one conditional-compilation branch's initializer counted; secondary array-size inference bug — if old trigger kept for transition, size-counting should aggregate across if/else branches. Both resolved by task 172's new trigger; no separate task needed. Sub-pattern B also addressed by the if-0 preprocessor task (196) if it extends to conditional compilation in array initializers.done2026-06-14T22:20:35Z2026-06-19T11:56:45Z2026-06-19T13:43:54Z�l�+
{�c	555GATE: sqlite FP reduction before new-codebase expansionGATE MET + CLOSED (2026-06-16). Precision lift confirmed (sqlite 6.3%->8.6%, recall flat, run #44/45). Hold-for-180 condition satisfied: macro-opacity (the dominant codebase-independent FP class) hardened via the macro_semantics registry — mosquitto A/B -429 FP, 0 net-new, Juliet recall identical (docs/design/macro-expansion.md §8b). USER DECISION (2026-06-16): unblock new-codebase audits now; let curl/hostap surface what actually recurs to drive 181/175 with real data rather than pre-emptive hardening. Remaining sqlite FP classes (181 free-state, 175 EXP34-contract) proceed in parallel, not as gate blockers.done2026-06-14T22:19:35Z2026-06-16T13:03:15Z2026-06-16T15:37:04Z��*�7�q	555Disposition the 37 zero-TP rules from sqlite audit (suppress / gate / raise-evidence)REVERTED 2026-06-16: the config-disable approach was wrong. conf/realworld/*.toml only drops categorically-INAPPLICABLE rules (Windows on POSIX, advisory style the project rejects); per-finding FP is recorded in the ground_truth oracle so the benchmark MEASURES precision improvement rather than hiding it. None of the 19 group-A rules is platform/domain-inapplicable (EXP33=uninitialized memory applies to all C; WIN04 sees in-scope src/os_win.c), so none belongs in a config disable set. libcrc third exhaustive oracle proved it: EXP33 zero-TP on sqlite+mosquitto but 1 real TP / 9 FP on libcrc (macro-opacity noise). Group-A noise must be fixed by RULE HARDENING + FN reduction, routed through existing tasks: EXP33/EXP34 macro opacity=180 (+118/146), MEM30/MEM12 free-state=181, EXP34 contract=175, FN taint untrusted-length=172, group-B raise-evidence (EXP20 !strcmp gate / INT33 bridge.c:930)=182/183. This is now an umbrella/tracking item. See data/precision_audit/mosquitto/adversarial_verification.md.done2026-06-14T22:19:35Z2026-06-16T12:37:13Z2026-06-16T12:48:58Z
:!|a:�#�0�	�	5GATE: eclipse-mosquitto#3666 (SRV c-ares cleanup) review/mergeFirst upstream mosquitto PR filed 2026-06-15: https://github.com/eclipse-mosquitto/mosquitto/pull/3666 (combined SRV reply-free + channel-destroy). ECA pass, open, mergeable vs master. Fork szarta/mosquitto, branch fix/srv-ares-resource-cleanup. Mark DONE when it gets a maintainer response/merges; that unblocks filing the remaining mosquitto PRs (calibrate to Roger Light's review style first). See data/precision_audit/mosquitto/upstream_prs/.pending2026-06-16T12:32:15Z��/��555EXP34-C rc==SQLITE_OK / caller-contract FP suppression (~665 sqlite FP)Follow-up to task 168 (which removed sizeof/assert-context FPs, -160). The two largest remaining EXP34-C FP buckets in the sqlite audit need interprocedural/correlation analysis: (1) rc==SQLITE_OK success-path correlation (~327 FP): pointer assigned only on the success path, deref dominated by if/while(rc==SQLITE_OK && ...); requires tracking the rc<->pointer correlation. (2) caller-contract/precondition (~338 FP): param pointer dereferenced in a static helper, non-null guaranteed by the caller; requires interprocedural precondition propagation. CRITICAL: any suppression here must NOT mask the unguarded-malloc null-deref FN pattern (verified still firing as of 0.4.32). Validate Juliet CWE-476 recall stays flat (TP 376/FP 231 baseline).

--- 2026-06-18 bucket 1 DONE (v0.4.48-0.4.50; commits 04d8f23d, 488b6c16, 152c0df7) ---
rc==SQLITE_OK out-parameter success-correlation guard, applied in BOTH is_unsafe_at
and the interprocedural check_callsite_null_args path (the dominant project-mode FP
source, which bypasses is_unsafe_at — that's why the first cut only moved sqlite -35).
Restricted the success constant to SQLITE_OK only (dropped ambiguous ==0/!x, which
inverts polarity for pointer returns and had suppressed a real TP, expert.c:91).
RESULT (realworld, cold): sqlite EXP34-C 1875 -> 1670 (-205); curl/hostap/mosquitto
net 0 (==0 suppressions intentionally reverted for correctness). Aggregate recall
1946 -> 1947 (expert.c:91 TP restored); all 7 adjudicated sqlite EXP34 TPs flag.
Juliet CWE-476 recall provably unchanged: SQLITE_OK does not appear anywhere in the
Juliet corpus, so the guard cannot fire there. EXP34 tests pass (64); FN preserved.
Bucket 2 (interprocedural caller-contract, ~338 FP) is tracked in task 207. Possible
follow-up: typed (int-only) ==0/!x success guard to recover the curl/hostap ~25 FP
safely. Closing 175 on the bucket-1 deliverable (bucket 2 = 207 per owner direction).done2026-06-15T13:57:22Z2026-06-18T20:32:55Z2026-06-19T00:33:45Z�!�.��w5FN-detection 2c: integer truncation before allocation (INT31 pattern)ANALYSIS.md §2c: detect narrowing of a 64-bit/attacker-controlled value to a narrower type on the path into an allocation size. FNs: amatch.c:1160 (nBuf=(char)(nWord+100) signed-char truncation before realloc), sqlar.c:94 (i64 sz from sqlar blob -> sqlite3_malloc(int) truncation, then uncompress overflows).pending2026-06-14T22:20:35Z�[�-��k5FN-detection 2b: OOM null-deref after sqlite3_malloc* (EXP34 pattern)ANALYSIS.md §2b: flag 'p = sqlite3_malloc*(...)' followed by a write/deref of p with no intervening if(p==0)/p!=0 check. FNs: compress.c:63, compress.c:102, vfstrace.c:897. sqc currently mis-fires EXP33 (uninit) at some of these instead of EXP34. Coordinate with the EXP34 guarded-null FP-suppression task so suppression does not also mask the unguarded-malloc case.pending2026-06-14T22:20:35Z
x
��	"x�&�4�?�555Shared root-cause FP: external function-like macro opacity (utlist/uthash) -> EXP33/EXP34PHASE 1 COMPLETE + VALIDATED (0.4.35, commit a6275b1b). Shared positional registry src/analyze/macro_semantics.rs (iterator table + HASH_FIND*/HASH_REPLACE* prefix family). Consumers: init_state (EXP33 init), EXP33 read-check skip, EXP34 iterator-body non-null. SAME-VERSION A/B on mosquitto (0.4.33 baseline vs 0.4.35, pinned commit d3ee5c5c, identical harness cmd): TOTAL 12534->12105 (-429); EXP33 488->176 (-312); EXP34 503->386 (-117); ZERO net-new findings. Juliet recall IDENTICAL (CWE-457 TP506/FP31; CWE-476 TP370/FP175) -> recall-safe. sqlite ~unchanged (no utlist/uthash). Full lib suite green; pass fixtures for DL_FOREACH/HASH_ITER/HASH_FIND/HASH_FIND_BYHASHVALUE. Family-prefix fix closed the one gap the A/B surfaced (HASH_FIND_BYHASHVALUE @ subs.c:520).done2026-06-16T12:35:56Z2026-06-16T13:49:40Z2026-06-16T15:30:18Z�K�3�%�=5File mosquitto Phase-2 OOM-robustness PRs (03/04/06/07/08/10) + defensive 09After Phase-1 lands. Drafts in data/precision_audit/mosquitto/upstream_prs/: 03 http_client leak, 04 options TLS-setter strdup leaks, 06 net_mosq verify_hostname SSL+socket leak, 07 net.c socks realloc fd leak, 08 handle_connect BIO_new NULL deref, 10 websockets lws_create_context leak. Most are injection-only (OOM) -> provide fault-injection harness + expected output. 09 (websockets size_t underflow) is defensive-only/not-attacker-reachable -> low-priority hardening. 05 tls_opts_set WITHDRAWN (not a bug). One atomic PR per fix, phased. Branches not yet built (only Phase-1 + SRV built so far).pending2026-06-16T12:32:34Z�(�2
i�55File mosquitto PR: persist_write double-fcloseBranch fix/persist-write-double-fclose (off origin/master, signed barrendo@gmail.com). PR body: data/precision_audit/mosquitto/upstream_prs/pr_bodies/pr-11-persist-double-fclose.md. Error-path double fclose; repro via harness/fwrite_fail_dotnew.c (LD_PRELOAD fails fwrite to .new temp). Push+gh pr create as for #3666; AI-disclosure footer.pending2026-06-16T12:32:34Z�_�1
q�5File mosquitto PR: handle_auth MQTT5 property leakBranch fix/handle-auth-property-leak (off origin/master, signed barrendo@gmail.com). PR body: data/precision_audit/mosquitto/upstream_prs/pr_bodies/pr-01-handle_auth.md. Normal-path leak (auth_method/auth_data freed after callback). Push: git push -u fork <branch>; gh pr create --repo eclipse-mosquitto/mosquitto --base master --head szarta:<branch> --title 'Fix memory leak of MQTT v5 auth properties in handle__auth' --body-file <pr-01>. Add AI-disclosure footer like #3666. Capture valgrind in real env if feasible.pending2026-06-16T12:32:34Z
EE�7�5��q555Shared root-cause FP: free-state precision (free->reassign / conditional / struct-field / loop conflation) -> MEM30/MEM12CROSS-VALIDATION FINDING (mosquitto+sqlite, see memory mosquitto-cross-validation.md): the dominant shared MEM30/MEM12/MEM31 FP mass comes from imprecise free-state tracking, NOT the (handle,target) free-arg pattern already fixed (task 167). Mosquitto-confirmed patterns (~96% FP across MEM30 657/MEM31 131/MEM12 118): (1) free-then-reassign: mosquitto_FREE(x); x=alloc(); if(!x){} -> sqc flags the reassignment/check as UAF (missing the reassign); (2) conditional free treated as unconditional: if(c){FREE(p);} then later p->m flagged UAF; (3) struct-field-free cascade: FREE(s->a) makes sqc flag all s->* (incl other fields) as UAF; (4) loop-iteration conflation: FREE(item) inside DL_FOREACH_SAFE frees a DIFFERENT node each iter, sqc conflates as same object -> double-free/UAF FP. Relates to deferred capability tasks 1 (MEM30 field-level free) and 2 (MEM31 ownership) but these are the concrete recall-safe precision fixes. Moves BOTH oracles. Validate on Juliet (preserve CWE-415/416/401 recall) + mosquitto + sqlite.
PATTERN 3 SHIPPED (2026-06-17, v0.4.39 commit 10a5ee48): struct-field-free cascade fixed in MEM30-C by gating union member-aliasing on genuinely union-typed bases (typedef-union names per TU + union-typed locals/params per fn); struct/struct-pointer bases no longer poison siblings/base. GATES PASSED: Juliet every completed CWE Δ0 (CWE-415 TP342/FP246, CWE-416 TP156/FP12, 401/590/762 all Δ0 — fix inert on Juliet by design); curl+mosquitto MEM30 oracle FP 732->412 (-44%), recall 0/3->0/3 (no regression). REMAINING (still open under this task): (1) free-then-reassign, (2) conditional-free-as-unconditional, (4) loop-iteration conflation.
PATTERN 1 GATE (v0.4.40 5a9d90be): NOT inert on Juliet (commit msg claim was wrong). Cast-unwrap of RHS alloc also fixes the pervasive Juliet idiom 'data=NULL; data=(cast)malloc(); free; free' — 0.4.39 left data flagged nullified (cast-malloc unrecognized), SUPPRESSING the genuine double-free. So pattern-1 fix IMPROVES recall: Juliet CWE-415 TP+126/FP+96, CWE-416 TP+78/FP+12 (net +204 TP / +108 FP; new-flag precision 65%, ABOVE MEM30 baseline => raises precision). curl+mosquitto MEM30 oracle FP 412->372 (-40), recall 0/3->0/3. Net win on all axes (real-world FP down, recall up). Remaining patterns: (2) conditional-free, (4) loop-iter.
PATTERN 2 SHIPPED + GATED (2026-06-17, v0.4.41 commit d3ce8d09). Branch-merge now treats goto/break/continue as terminators (not just return); also fixed latent bug where a trailing comment node defeated the compound-statement terminator check (skip comment nodes). unconditionally_returns -> unconditionally_diverges. GATES PASSED: Juliet TP 22165/FP 5602 IDENTICAL 0.4.40->0.4.41 on every CWE (inert on Juliet, zero recall risk); MEM30 oracle FP 372->313 (-59, -16%), recall 0/3->0/3. Kills curl ldap.c/fopen.c + mosquitto ctrl_shell_* free-then-goto/break clusters. PATTERN 4 (loop conflation): determined to be a NON-ISSUE — zero oracle footprint (the 'in loop' detector fires 0 times on curl+mosquitto; sqc single-pass can't conflate iterations). The clusters filed under pattern 4 were all pattern 2. TASK COMPLETE: patterns 1 (v0.4.40), 2 (v0.4.41), 3 (v0.4.39) shipped; pattern 4 N/A. Follow-ups spun out: task 197 (block-level text-scan robustness) + new task (realloc-on-field cluster).done2026-06-16T12:35:56Z2026-06-17T14:10:15Z2026-06-17T23:24:47Z
�00�x�D�6�M�=555Group-B raise-evidence: gate EXP20-C !strcmp idiom + confirm INT33-C bridge.c:930 div-by-zero TPFollow-up from task 170 (group B = keep-but-strengthen). EXP20-C: ~half of its 8 mosquitto credits were the !strcmp/!strncmp idiom (http_serv.c:176/177/198, topic_tok.c:103, websockets.c:554) — real-world precision weaker than raw audit; add an evidence gate so the idiom doesn't count, do NOT disable (8 real TPs). INT33-C: adversarial pass flipped src/bridge.c:930 FP->TP (medium conf) — (high-low) used as divisor with no high>low guard; re-read, confirm TP, add guarded-divisor check. Other group-B rules (CON03,MEM31,INT00,MEM12,ENV01,EXP37) confirmed catching real bugs, left enabled as-is. See data/precision_audit/mosquitto/adversarial_verification.md.done2026-06-16T12:42:51Z2026-07-04T00:43:59Z2026-07-04T01:25:13Z�?�8�m�555Macro-expansion Phase 0: tree-sitter parse feasibility spike (MACRO(args){block}, preproc_function_def recovery)Per docs/design/macro-expansion.md §6. Confirm how tree-sitter parses function-like macro invocations with a trailing block (call_expression+sibling compound vs ERROR node — note existing ERROR handling at init_state.rs:946), and how reliably preproc_function_def bodies/args are recoverable for utlist/uthash as vendored in real projects (sqlite/mosquitto). Decide splice representation for Phase 2 (re-parsed sub-tree vs synthetic dataflow events). Also answer §9 open Q: are utlist/uthash scanned-as-headers (Phase 2 can expand directly) or only transitively included (registry needed)? Output: go/no-go note appended to the design doc.done2026-06-16T13:25:06Z2026-06-16T13:37:14Z2026-06-16T13:41:16Z��7�_�)5Re-scope task 170 follow-through: group-A noise is fixed by RULE HARDENING, not config-disable (reverted)The task-170 config-disable approach was reverted: conf/realworld/*.toml only drops categorically-INAPPLICABLE rules; per-finding FP is recorded in ground_truth oracle so the benchmark measures precision improvement, not hides it. None of the 19 group-A rules (EXP33,API02,EXP43,STR34,MSC37,FIO47,ARR01,DCL31,PRE32,STR30,FLP03,ARR36,FLP34,ARR39,FIO42,FIO50,EXP07,WIN04,EXP30) is platform/domain-inapplicable, so none belongs in a config disable set. libcrc proved it: EXP33 zero-TP on sqlite+mosquitto but 1 real TP / 9 FP on libcrc (macro-opacity noise). Route the noise reduction through existing hardening tasks: EXP33/EXP34 macro opacity=180 (+118/146), MEM30/MEM12 free-state=181, EXP34 contract=175, FN taint=172, group-B raise-evidence (EXP20/INT33)=182. This task is the umbrella/tracking item; close once those land or fold it into them. See data/precision_audit/mosquitto/adversarial_verification.md.pending2026-06-16T12:55:45Z#�M�=5Group-B raise-evidence: gate EXP20-C !strcmp idiom + confirm INT33-C bridge.c:930 div-by-zero TPFollow-up from task 170 (group B = keep-but-strengthen). EXP20-C: ~half of its 8 mosquitto credits were the !strcmp/!strncmp idiom (http_serv.c:176/177/198, topic_tok.c:103, websockets.c:554) — real-world precision weaker than raw audit; add an evidence gate so the idiom doesn't count, do NOT disable (8 real TPs). INT33-C: adversarial pass flipped src/bridge.c:930 FP->TP (medium conf) — (high-low) used as divisor with no high>low guard; re-read, confirm TP, add guarded-divisor check. Other group-B rules (CON03,MEM31,INT00,MEM12,ENV01,EXP37) confirmed catching real bugs, left enabled as-is. See data/precision_audit/mosquitto/adversarial_verification.md.pending2026-06-16T12:42:51Zwin, DCL31 has 0 curl TPs); Juliet TP 21961->21961 (delta 0), FP 5494->5494 (delta 0) vs 0.4.34 baseline = no recall regression. 50 curl DCL31 FP remain (macros not collected even textually / non-curlx names) - optional follow-up. 2c-i COMPLETE.
PHASE 2c-ii IN FLIGHT (commit cc4b2240, v0.4.37): EXP33-C macro output-arg recognition. Root: CF_DATA_SAVE(save,cf,data) body assigns (save)= ; sqc saw save as uninit read at call site + downstream. Fix: macro_expand::macro_output_param_indices(table,name) expands w/ sentinels, reports params that are whole-object assignment targets (excludes p->f=/p[i]=/*p=/+=/==). Wired into InitAnalysisConfig.macro_output_params (transfer marks output args Initialized) + EXP33 read-checker skip (is_function_macro_output_arg) + per-file precompute for invoked macros only. Removed macro_expand allow(dead_code) (expander now consumed). Verified curl cf-h2-proxy.c save 9->0 (-d lib). +6 unit tests, cli_integration macro_out_param fixture, lib green 3366. GATES RUNNING: juliet sqc-0.4.37-cc4b2240 + realworld sqc-curl-0.4.37-cc4b2240 (reused prescan). ON RESUME: get_status; realworld-score curl for EXP33 FP delta; juliet compare 0.4.36->0.4.37 recall gate; then run mosquitto. NEXT: 2c-iii Curl_safefree->MEM30 (task 181).
2c-ii GATES PASSED (juliet sqc-0.4.37-cc4b2240; realworld curl rid48 + mosquitto rid49). Juliet recall: TP 21961->21961 (d0), FP 5494->5494 (d0) vs 0.4.36 = NO regression (Juliet has no function_macros table so macro_output_params empty = path inert). curl oracle EXP33-C FP 398->360 (-38 labeled, -58 raw), zero TP loss (EXP33 has 0 curl TPs). mosquitto oracle EXP33-C FP 60->57 (-3, disjoint root-cause macro, confirms engine not curl-overfit), zero TP loss. EXP34-C/ARR00-C unchanged in both (they don't use init_state; would need separate wiring = optional 2c-ii-b). NB: mosquitto auto-ingest skipped (shared version_dir already ingested by curl); manually ingested as rid49. 2c-ii COMPLETE.
PHASE 2c-iii IN FLIGHT (commit 714fd11c, v0.4.38): MEM30-C safe-free macro recognition. Root: Curl_safefree(p)=do{curlx_free(p);(p)=NULL;}while(0); MEM30 treats it as free (name contains FREE) but can't see the =NULL, so p stays dangling -> UAF/double-free FP on later access + 2nd safe-free. Fix: macro_expand::macro_nulls_param_indices(table,name) (sentinel-expand, detect whole-object =NULL/0 assignment; shares find_assignment_targets w/ 2c-ii). MEM30 now stateful (set_project_context like MEM31), precomputes safe-free macros invoked per file (guarded by non-empty table=0 cost on Juliet), clears arg freed-state after process_free_call (clear_freed_for_nulled_args, mirrors explicit p=NULL). Recall-safe: 2nd safe-free=free(NULL), read=null-deref(EXP34); plain double free(p) still flags (verified). VERIFIED curl url.c MEM30 287->161 (-44%). +5 unit tests, cli_integration safe_free_macro fixture, lib green 3371. GATES RUNNING: juliet sqc-0.4.38-714fd11c + realworld curl; mosquitto to follow (mosquitto_FREE is same idiom). ON RESUME: realworld-score curl MEM30 FP delta; juliet compare 0.4.37->0.4.38 recall gate (MEM30=CWE-416, real recall stakes).
2c-iii GATES PASSED (juliet sqc-0.4.38-714fd11c; curl rid50, mosquitto rid51). Juliet recall: TP 21961->21961 (d0), FP 5494->5494 (d0) vs 0.4.37 = NO regression incl CWE-416/UAF (Juliet has no macro table = path inert). curl oracle MEM30-C FP 1437->901 (-536, -37%), zero TP loss (MEM30 100% FP in curl). mosquitto oracle MEM30-C FP 662->134 (-528, -80%!) via mosquitto_FREE (same free+null idiom = engine generalizes, not curl-overfit), zero TP loss; MEM31/MEM12 TPs intact in both. Combined ~-1064 MEM30 oracle FP across 2 codebases = biggest 2c win. RESIDUAL (curl MEM30 901 FP remain): struct-member->base free-conflation (e.g. curlx_free(data->state.range) poisons data->state) = task 181, NOT macro-blindfold. 2c-iii COMPLETE. Phase 2c DONE (2c-i DCL31, 2c-ii EXP33, 2c-iii MEM30). NEXT: task 181 (free-state precision, clears the MEM30 901 residual) and/or Phase 3 (task 186, migrate ~51 rule files).done2026-06-16T13:25:06Z2026-06-16T16:01:20Z2026-06-17T13:53:48Z
����d�;�3�a5Macro-expansion Phase 4 (optional, opt-in): compile_commands.json preprocessed modePer docs/design/macro-expansion.md §5(C)/§6. Opt-in flag to run a real preprocessor (cpp/clang -E) using compile_commands.json for full system-header expansion correctness, with #line source-location back-mapping. NEVER the default — breaks the no-build-system usability model. Only for users who already have a compile DB. High effort/risk; lowest priority.pending2026-06-16T13:25:06Z�M�:�?�]555Macro-expansion Phase 3: migrate ARR30 onto shared function_macros (re-scoped post-audit)Per docs/design/macro-expansion.md §10 (Phase-3 stock-take, 2026-06-17). The doc's '51 files' is a pre-Phase-1 count; Phases 1/2c already consolidated the heavy hitters. Full per-file audit (§10 disposition table) shows the ONLY rule still duplicating the shared expansion engine is ARR30-C: a local extract_function_macros + dead-code FunctionMacro struct reimplementing context.function_macros. MIGRATE ARR30 to consume context.function_macros (like MEM30/EXP33). Shared macro_expand::FunctionMacro = {params, body} only (no name/line) -> ARR30's 'defined at line N' suggestion must drop/recover the line. check_macro_invocation is LIVE (~60 curl manual-review flags) so gate the flag delta AND Juliet recall (CWE-121/122/787). KEEP: PRE rules, def-side hygiene/naming (MSC38/41, API03/10, DCL37/15/19, EXP44), incidental preproc_ traversal, is_likely_macro_constant heuristics. const_eval-consumer DRY (11 files) split to task 199.done2026-06-16T13:25:06Z2026-06-17T23:41:23Z2026-06-18T01:19:46Z�d�9��3555Macro-expansion Phase 2: in-tree function-like macro expansion enginePhase 2 = in-tree function-like macro expansion engine (docs/design/macro-expansion.md §5B/§6). Incremental:
2a (DONE, 23c2430a): src/analyze/macro_expand.rs — collect_function_macros + textual expand_invocation. 10 unit tests.
2b (DONE): wired collection into prescan pre-pass — ProjectContext.function_macros, cached cross-file, sqc output byte-identical (no consumer yet).
2c (TODO, TARGETS NOW CHOSEN from curl+mosquitto audits — see data/precision_audit/curl/STOCKTAKE.md): wire expander into dataflow consumers. FP-ranked target set:
  TIER 1 (pure opacity, expansion fixes outright, ~600 curl FP): (a) curlx_free/calloc/realloc/strdup/memdup wrappers -> clears 337 DCL31-C outright; (b) CF_DATA_SAVE + dynbuf/uthash(HASH_FIND/HASH_ITER)/utlist(DL_FOREACH_SAFE)/MY_SETOPT do-while -> clears ~280 EXP33/34/ARR00 'uninitialized'.
  TIER 2 (expansion exposes free+null, then task 181 finishes): Curl_safefree (frees AND nulls) -> ~1114 MEM30/31/12 macro-adjacent FP; expansion removes the blindfold, free-state precision (181) does the rest.
  Cross-validated in mosquitto: mosquitto_FREE<->Curl_safefree, DL_FOREACH_SAFE/utlist, HASH_FIND/uthash, SAFE_FREE/SAFE_PRINT. Check hostap (159) before locking.
  Recall-gate Juliet + measure FP delta on curl+mosquitto oracles (both ingested, scorable via audit-score run 46/45). Remove macro_expand allow(dead_code) when consumed.
PHASE 2c-i DONE (commit 37ee3a5e, v0.4.36): curl DCL31 337-FP root cause was macro COLLECTION failure (curlx_* in curl_setup.h, has_error region misparses #define as ERROR+call_expression). Fix: collect_function_macros_textual (secondary error-correcting #define scanner) + DCL31 consumes function_macros. curl uint-spbset.c DCL31 2->0; lib green 3360. GATES RUNNING: juliet sqc-0.4.36-37ee3a5e + realworld sqc-curl/mosquitto-0.4.36-37ee3a5e (rebuild_prescan). ON RESUME: get_status; audit-score curl+mosquitto for FP delta; juliet compare_runs recall gate. NEXT: 2c-ii EXP33/34/ARR00 init-macros (wire expand_invocation into init-state); 2c-iii Curl_safefree->MEM30 (task 181). See memory macro-expansion-phase2c.
2c-i GATES PASSED (run 47 / juliet sqc-0.4.36-37ee3a5e): curl oracle DCL31 FP 337->50 (-85%, pure �
%t%�K�=�	�555Confirm sqlite realworld benchmark scope matches audited filescurl established that the benchmark scoring scope should match the audited oracle file set (WIN_MAC excluded for curl). Verify the sqlite benchmark run's scored/scoped files match exactly the in-scope files that were audited in data/precision_audit/sqlite/ (core src/ + shipped ext/, excluding autosetup/jimsh0.c, tool/, test/, src/test*.c, ext/jni, ext/wasm). Ensure realworld-score and the dashboard denominators align with the adjudicated corpus.done2026-06-16T17:51:33Z2026-06-16T20:12:57Z2026-06-16T20:13:11Z��<
}�a5Add Windows open-source C tools as real-world benchmarkscurl audit excluded 14 WIN_MAC files (vtls/schannel*, vtls/apple*, system_win32*, curlx/{winapi,version_win32,multibyte}) as out-of-scope for the Linux oracle. These represent a distinct Windows build configuration, not dead code. Need a few good Windows-targeted open-source C codebases (and/or a curl windows-rules config that scopes the schannel/win32 backends) to benchmark WIN*-category rules properly. Bring in windows audit configs at a later date.
CANDIDATE (2026-06-17, user): ReactOS — recommended as a good codebase for idiomatic Windows C. Use to benchmark WIN*-category rules against genuine Windows-targeted code (Win32 API idioms). Permissively licensed (GPL — check license compatibility for inclusion vs. external clone-only use).
LICENSE CLARIFICATION (2026-06-17, user): GPL is NOT a concern — benchmark codebases are cloned externally (not shipped/vendored with tools_sqc), so ReactOS's GPL does not propagate. Proceed as a normal external clone like the other benchmark projects.
SCOPE CAVEAT (2026-06-17, user): ReactOS is very large — a full file-at-a-time FN audit (like curl/sqlite/mosquitto oracles) may be infeasible. Likely viable as a TP/FP exercise only (measure precision on WIN* rules), NOT a complete ground-truth oracle with recall/FN coverage. Consider scoping to a subset of modules if FN audit is desired.
SIZING (2026-06-17, pygount code lines): ReactOS ~/toolchain/reactos = ~5.35M C-family SLOC (C 4,908,659 / 13,897 files + C++ 443,620 / 2,018 files), i.e. ~6.2x the ENTIRE current 5-project suite (~862K). Confirms FN audit is infeasible -> TP/FP precision run, or scope to a few WIN*-relevant modules. Even one full sqc scan is a heavy run vs anything in the current suite. (SLOC ref for current suite: libcrc ~0.75K, mosquitto ~67K, curl ~158K, sqlite ~239K, hostap ~397K C-family.)pending2026-06-16T17:51:33Z
�xy��k�@
c�w555sqlite scope verification result (task 189)Confirmed sqlite scope at commit b1a73ba34d matches audited corpus exactly. (1) audit_corpus_meta.total_inscope_files=220 == audited_files=220 (100pct coverage). (2) 220 audited files == git-tracked in-scope universe on disk (src/ core + shipped ext/) after documented exclusions (test/ tool/ autosetup/jimsh0.c src/test*.c tclsqlite *test* glue ext/jni ext/wasm) -- zero set diff via comm. (3) Of 347 files sqc flagged in run 45, 215 in-scope ALL within the 220 audited (zero gap); other 132 all out-of-scope test/tool/binding/generated glue. score_audited_corpus restricts findings+labels to audited set, so denominators align.done2026-06-16T20:13:12Z2026-06-16T20:13:12Z2026-06-16T20:13:12Z�s�?�	�_555Add a C99-compliant codebase to the real-world benchmark suiteAll 5 current real-world codebases (libcrc, sqlite, mosquitto, curl, hostap) are conservative C89/C90-style — they avoid C99 conformant array parameters and other modern-C99 idioms. This leaves rules that CHECK C99 conformance with no positive-validation target: their TPs can never be confirmed, only their FPs on non-adopting code measured.

Concrete driver (task 190): API05-C 'use conformant array parameters' fired 1062x on curl, ~all FP — but with NO codebase that actually uses 'void f(size_t n, char buf[n])' syntax, we can't validate that the rule correctly CREDITS conformant usage / correctly flags genuine non-conformance. Same gap likely affects other C99-targeting che���>�3�!5Fix API05-C: unsound trigger (any size_t -> flag any pointer); then advisory triagecurl audit: API05-C = 1062 findings, ~all FP. Root cause is a RULE DEFECT, not just non-adoption (verified by reading src/rules/cert_c/API/API05-C/api05_c.rs + curl signatures):

THE BUG: check fires on any char/void/int-ish pointer param whenever the signature has ANY size_t param ANYWHERE (api05_c.rs:195 has_size_t_param && is_plain_pointer_param). It never associates the size_t with the flagged pointer. So:
 - FALSE: async_ares_rr_done(void *user_data, ..., size_t timeouts, ...) flags void *user_data (opaque callback ctx, unrelated to timeouts). Also hits NUL-terminated const char* strings and char** out-params.
 - The 3 'size variable declared after the array' findings: uint64_t H[SHA512_256_HASH_SIZE_WORDS] — a #define macro constant mistaken for a later-declared PARAMETER (macro-opacity).
 - COINCIDENTALLY-CORRECT: chunk_append(const uint8_t *buf, size_t len), Curl_alpn2alpnid(name,len) — real C99 candidates, but the rule got them right only because buf is the sole counted pointer.

WHY IT MATTERS: the rule would also misfire on a C99-COMPLIANT codebase (flags void*/strings/**-out-params in any fn that has a size_t). conformant char p[n] params ARE correctly skipped, but mixed signatures still false-fire. So fix the rule, don't just disable.

FIX: (1) only fire when an integer param can be tied to the flagged pointer as element count (pointer indexed / memcpy/memset by that size in body); (2) exclude void*, NUL-terminated const char*, pointer-to-pointer; (3) declared-after check must resolve #define/enum constants (not treat a macro constant as a later param). THEN (4) decide advisory-only/disabled-by-default in conf/realworld base for the residual correct-but-unadopted findings. Recall-gate Juliet (API05 test cases) + re-measure curl/mosquitto oracle precision.pending2026-06-16T19:40:54Zcks.

TASK: pick a permissively-licensed C codebase that genuinely adopts C99 idioms (conformant/VLA array params, designated initializers, compound literals, _Bool/stdbool, mixed declarations, restrict). Candidates to evaluate: a numerics/DSP or embedded lib that uses VLA params; modern crypto (e.g. monocypher), a modern parser, or a C99-style utility lib. Verify it actually contains conformant-array-parameter signatures (grep for 'type name[var]' param forms) before adopting. Then:
 1. clone pinned to a commit under ~/toolchain/<name>; add ~/data-enterprise/<name>-main for trunk cross-ref.
 2. add to PROJECTS in mcp_servers/realworld_server.py (sqc/cppcheck/clang-tidy include+source dirs) + conf/realworld/<name>-rules.toml.
 3. run + ingest a baseline; build the ground-truth oracle (file-at-a-time audited corpus, adversarial pass) like curl/mosquitto.
Goal: a codebase where API05-C and other C99-conformance rules have real TPs to validate against, complementing the C89-style majority. Relates to 190 (API05-C correctness fix).
NOTE (2026-06-16): split into two tracks after Melon/cgltf discussion. Melon evaluation (explicit --c99 mode; possible dual C99+macro oracle) = separate candidate task. Synthetic-conformance-corpus option for API05-C's '[static N]' (which no real codebase uses) = separate exploration task. This task (191) stays scoped to a REAL idiomatic-C99 codebase for the broader conformance rules (designated inits/compound literals/FAM/restrict/_Bool). cgltf evaluated + rejected for this goal (too conservative on structural C99).
CANDIDATE (2026-06-17, user): Lua 5.2 — recommended as a good codebase for idiomatic C99. Permissively licensed (MIT). Evaluate for C99-conformance rule validation (designated inits / compound literals / _Bool / mixed declarations / restrict); verify conformant-array-parameter signatures present before adopting.
VERSION/SHA (2026-06-17, user OK'd targeting 5.5): adopt ~/toolchain/lua = Lua 5.5 (NOT 5.2; user not version-locked as long as we pin the SHA). Pinned commit 40b76de2d77e66b70a9d4bf989c3f5340919973f (git describe v5.5.0-34-g40b76de2, dated 2026-06-03). SLOC (pygount, code lines): ~19,128 C across 66 files — tiny, ~2% of the current 5-project suite (~862K C-family), so a full file-at-a-time FN oracle like curl/sqlite is feasible and fast. ACTION: verify it actually exercises C99-conformance idioms before committing to it as the C99 target.

--- 2026-06-21 PROGRESS: Lua wired into the suite (sqc v0.4.59) ---
Lua 5.5 @ 40b76de2 added to the realworld suite as a GENERAL-PURPOSE oracle
(small ~19K SLOC, MIT, new VM/interpreter domain). Verification BEFORE adopting
showed Lua is portability-C99, NOT structural-C99 (0 designated inits / compound
literals / _Bool / restrict / FAM / conformant-array params) — so it does NOT
close this task's headline C99-conformance-validation goal. That goal is spun
off to task 217 (hunt for a genuinely idiomatic structural-C99 codebase).

Wiring delivered:
  - sqc gained a generic `--exclude <glob>` flag (repeatable, path-suffix globs
    via the shared glob_to_regex). Filters scanned files while leaving prescan/
    cross-file context intact. (src/main.rs, src/analyze/mod.rs; glob_to_regex
    made pub(crate) in suppression.rs.)
  - mcp_servers/realworld_server.py: CODEBASES['lua'] for all 3 tools; scope =
    shipping lib + lua.c, EXCLUDING the checked-in amalgamation onelua.c (would
    double-count under cppcheck/clang-tidy preprocessing), the ltests.c test/
    debug harness, and testes/ C fixtures. sqc uses --exclude; cppcheck uses -i;
    clang-tidy builder gained an optional `exclude` find-prune list.
  - conf/realworld/lua-rules.toml (same 14-rule advisory baseline as sqlite).
  - sqc scans 33 shipping .c (raw count 8631 violations pre-oracle).

REMAINING for this task: (a) clone ~/data-enterprise/lua-main for trunk
cross-ref; (b) run + ingest a baseline across all 3 tools; (c) build the
file-at-a-time ground-truth oracle (data/precision_audit/lua/) like curl/sqlite.done2026-06-16T19:54:42Z2026-06-21T20:03:41Z2026-06-22T21:13:56Z
-	�-�9�B�#�5Explore C99 ruleset validation options (incl. synthetic conformance corpus)Broader-than-191 exploration of how to give the C99-conformance ruleset a POSITIVE-validation target (raised 2026-06-16). Key insight from the Melon/cgltf discussion: API05-C's exact trigger — 'T arr[static N]' parameter syntax — is vanishingly rare in ANY real-world project, so no realworld oracle (Melon included) will validate it positively. Decouple it from the realworld-codebase search (191) so that effort doesn't stall on API05-C. OPTIONS to explore: (1) a SYNTHETIC C99-conformance fixture corpus (hand-written .c exercising [static N] params, designated inits, compound literals, FAM, restrict, _Bool, VLA params, mixed decls) used as a positive-validation suite — cheap, deterministic, fully controllable ground truth; (2) a real idiomatic-C99 codebase for the broader conformance rules (overlaps 191 — designated inits/compound literals/FAM/restrict ARE common in modern C); (3) mine existing CERT C / SEI example code for conformant snippets. Goal: every C99-conformance rule has at least one confirmable TP. Relates to 190 (API05-C correctness fix) and 191 (realworld C99 oracle).
EMPIRICAL CONFIRMATION (2026-06-23, task 217): grep over 11 local repos + raylib + monocypher found ZERO genuine '[static N]' conformant-array-param uses — the only match anywhere was a documentation comment in newlib (gd_toolchain) cdefs.h. So API05-C has no real-world oracle; its positive-validation MUST come from the synthetic corpus (option 1). The broader conformance idioms (compound literals/designated-init/FAM/restrict, option 2) DO have a real-world target: raylib @962bbfc (see task 217).pending2026-06-17T03:42:18Z��A
�)555Evaluate Melon (Water-Melon/Melon) as benchmark candidateCandidate real-world oracle (raised 2026-06-16). Melon is a C framework (data structures, regex, JSON, lang VM) with an explicit --c99 build mode (-std=c99 -DMLN_C99 -D_POSIX_C_SOURCE=200112L), so it is deliberately C99-conformant — unlike the current 5 oracles (all C89/C90; curl is strict C89). Possible DUAL value: (a) C99-conformance rule validation (task 191) IF it uses structural C99 idioms densely; (b) 3rd MACRO oracle to cross-validate the macro-expansion engine before Phase 3 migration (task 186), since it is macro-heavy and disjoint from curl/mosquitto. EVALUATE BEFORE COMMITTING: grep Melon src for density of designated initializers, compound literals, flexible array members, restrict, _Bool, and especially conformant array params 'T name[static N]' / 'T name[n]' (the API05-C trigger — likely absent even here). Also gauge full-audit cost (it is large vs single-file libcrc). Alternative considered: jkuhlmann/cgltf — REJECTED for C99-rule hardening (conservative; no designated inits/compound literals/FAM/restrict/_Bool/VLA), but noted as a strong PARSER-RECALL oracle for a different goal (untrusted glTF/GLB+JSON decode). Relates to 191.

--- 2026-06-21 CLOSED (owner) ---
Not pursuing Melon. Using Lua as the C99-compliant real-world benchmark
candidate instead (clean portable C89/C99, no platform/threading deps).
Supersedes this evaluation. See task 191 (add a C99 codebase to the suite).done2026-06-17T03:42:18Z2026-06-21T20:02:46Z2026-06-21T20:02:46Z
|�|�k�E��5Block-level text-scan robustness: rule heuristics match raw get_node_text spans (comment/string/identifier-substring sensitive)AUDIT (2026-06-17, surfaced during task 181 pattern 2). 165 call sites across 22 rule files do substring matching (.contains/.find/.starts_with/.matches) on get_node_text() of BLOCK-level nodes (compound_statement, loop, if, function body), bound to vars like body_text/loop_text/if_text/then_text/else_text/func_text. get_node_text returns the RAW source span INCLUDING comments and string literals, so these heuristics are: (a) comment-sensitive — e.g. MEM30 unconditionally_diverges was defeated by a trailing /* comment */ after goto (fixed in pattern 2 by excluding comment nodes); MSC40 func_text.contains('inline') trips on /* inline */; (b) string-literal-sensitive — MEM30 body_text.contains('size != 0'), body_text.contains('realloc('); (c) identifier-substring-sensitive — 'inline' matches 'spinline', func_name as substring matches longer names. Heavy users (oracle-relevant in *): STR31-C(24)*, INT30-C(17), MEM30-C(16)*, ARR32-C(13), SIG02-C(12), API00-C(12), EXP20-C(11)*, ERR33-C(9), FLP34-C(6), FIO50-C(6), ARR30-C(6)*, FIO34-C(5), ARR00-C(5), FLP36-C(4), ERR32-C(4), STR02-C(3), SIG34-C(3), MSC40-C(3), EXP33-C(3)*, WIN03-C(1), MEM11-C(1), INT32-C(1). Full inventory saved at /tmp/blocktext_inventory.txt at audit time (regenerate: grep -rnE '(body_text|loop_text|if_text|then_text|else_text|func_text|...)\.(contains|find|starts_with|ends_with|matches)\(' src/rules/). FIX direction: replace block-text substring scans with AST-node traversal (find the actual call_expression/identifier/keyword nodes), OR a shared helper node_text_sans_comments() as a cheap interim for pure comment-sensitivity. Each rule needs its own Juliet recall + oracle FP gate — do NOT batch-rewrite blind. Overlaps/feeds task 153 (shared iterative AST walker). Recall-safety: these are mostly used to GATE detection, so a stale substring can cause both FP (spurious match in comment) and FN (heuristic fooled). Prioritize oracle-relevant rules first (STR31, MEM30, EXP20, ARR30, EXP33).pending2026-06-17T22:04:55Z��D
i�;555Exclude `#if 0` dead-code blocks from analysissqc flagged dev_stu.c:505 (MEM30-C) for code inside a `#if 0 … #endif` block that is never compiled. Scanning dead preprocessor branches produces unfixable noise and inflates counts, masking real issues.

Fix scope: preprocessor/prescan stage — detect and mark `#if 0` regions; skip them in all rule checkers.

Evidence: FP-002 in Catapult RC624 V1.5.8 firmware review (1 hit, but cross-cutting correctness concern for any codebase that uses `#if 0` to comment out code). Source: Catapult FP code review (DB_UPDATE.md, 2026-06-17).done2026-06-17T13:56:19Z2026-06-19T01:29:58Z2026-06-19T02:07:25Z�}�C��/5Macro-expansion 2c-ii-b: EXP34-C/ARR00-C macro output-arg recognitionOptional remainder of task 185 Tier-1(b) (split out 2026-06-17 when 185 closed). 2c-ii wired the macro-expansion engine's output-arg map (macro_output_param_indices) into EXP33-C (init_state) — clearing CF_DATA_SAVE-style 'used uninitialized' FP. EXP34-C (null-state) and ARR00-C (array-init) have the SAME macro-output-arg class (a macro that writes its arg via the body) but use their OWN analyses (null_state / ARR00 array checker), so they were untouched. TASK: thread the same per-file macro_output_params map into EXP34-C's null-state transfer + ARR00-C's array-init checker (mirror EXP33-C's is_function_macro_output_arg skip + transfer marking). STOCKTAKE estimated the combined EXP33/34/ARR00 init-macro class at ~280 curl FP; 2c-ii cleared only the EXP33 slice (curl -38, mosquitto -3), so a real EXP34/ARR00 remainder exists. Recall-gate Juliet (EXP34=CWE-476 null-deref, ARR00 array — real recall stakes) + measure curl/mosquitto oracle FP delta. Engine already built (task 185); this is pure consumer wiring. Relates to 185.pending2026-06-17T13:53:48Z
�����8�H�G�+555scrape_cert_wiki.py: emit TOML literal strings for description/title to avoid invalid escapesFollow-up to task 130 (build-time manifest validation). build.rs now rejects malformed rule TOMLs; the 8 latent bad files it found (DCL06/16-C, FIO32-C, INT35-C, POS30-C, PRE07/30-C, STR06-C) were all scraped-wiki prose with unescaped backslashes (\x10, \.\, \U, \u, \0) / embedded quotes in description/title, fixed by switching to TOML literal strings (''' / '). scripts/scrape_cert_wiki.py is the source of truth; if re-run it would reintroduce the bug. Harden the writer to emit literal strings (''' for multiline description, ' for title) — or escape — so regeneration stays valid TOML. Distinct from task 137 (test-gen output-example exclusion).done2026-06-18T03:07:00Z2026-06-18T03:08:38Z2026-06-18T03:15:20Z�B�G�M�5const_eval macro-merge DRY: fold repeated collect-per-file + merge-context idiom into one helperPhase-3 follow-up (docs/design/macro-expansion.md §10, const_eval-consumer row). 11 rules (INT30/32/33/34, FIO30, FLP03, STR02, ERR33, ENV03/33, DCL07, ARR30) each open-code 'collect_macro_constants/aliases per file, then merge cross-file context.macro_constants/aliases with per-file winning'. NOT opaque-macro debt (already on shared const_eval) - pure consistency/DRY. Mechanical, low-risk, modest payoff. Fold into a const_eval helper (e.g. merged_constants(root, source, ctx)). Gate Juliet recall + real-world FP delta. Do only after task 186 (ARR30) gate is clean.pending2026-06-17T23:44:15Z�X�F�I�i555MEM30-C realloc-on-field self-assign FP: cfg->topics = realloc(cfg->topics, …) stays flaggedFP found during task 181 (v0.4.40/0.4.41). For a realloc self-assign on a FIELD path — p->f = realloc(p->f, n); if(!p->f){...} p->f[i]=… — sqc still flags 'accessing freed pointer/array' on the field. Plain-variable form (p = realloc(p,n); if(!p)) is clean; the field form is not. Three compounding root causes traced: (1) process_assignment clears realloc_invalidated for the field after the realloc branch, but analyze_function_body then RECURSES into the RHS realloc(...) call -> process_call_expression 'realloc' arm calls track_realloc_old_pointer again, RE-INSERTING the field into realloc_invalidated (undoes the clear). (2) detect_realloc_condition_branch only matches identifier conditions (if(p)/if(!p)/if(p!=NULL)); a field-path null-check if(!cfg->topics) is a field_expression -> returns None -> the realloc-failed-branch invalidation-clear never runs. (3) realloc_updated is keyed by left_var = base ('cfg'), not the full path ('cfg->topics'), so even the existing if-condition clear (which checks realloc_updated.contains(var)) can't match the full-path null-check var. FIX direction: track realloc_updated/realloc_source under the FULL PATH (and base); extend detect_realloc_condition_branch to handle field_expression conditions; and/or guard the RHS-recursion re-invalidation so a just-cleared self-assigned field isn't re-added. Recall-safe: must keep flagging a genuine post-realloc use of the OLD pointer when it was NOT reassigned to the result. SITES (mosquitto oracle): client_shared.c:550,554,1119,1123,1188,…  Reproducer saved logic in /tmp/loopdir/realloc_field.c & realloc_noloop.c at investigation time. Validate: Juliet CWE-415/416 recall + curl/mosquitto MEM30 oracle FP.done2026-06-17T23:25:03Z2026-06-19T02:07:36Z2026-06-19T02:24:33Z
M
�M�l�K��#5STR31-C cross-function FP follow-ups: function-pointer (44), static-global (45), control-flow (21/22), CWE-127 source-sideAfter task 143 (v0.4.44), CWE-121/122/124/127 STR31-C precision is 70.7% (FP 611->476, TP 1150 unchanged). The cross-function buffer-size propagation handles direct + forwarded parameter destinations (variants 41, 51-54). Remaining FP classes need separate handling:
- _44 function-pointer sinks: the sink is invoked via a funcptr (funcPtr=sink; funcPtr(data)), so the call is not name-resolvable in callsite_buf_args. Needs funcptr-assignment resolution.
- _45 static-global passing: the destination is a local assigned from a static global (data = g_global), not a function parameter, so callsite_param_buffer_size doesn't apply. Needs a global buffer-size summary (mirror of the param summary, keyed on global name + writer functions).
- _21/_22 control-flow: buffer chosen via if(staticTrue/goodB2G) branching; needs dead-branch-aware buffer selection in the caller's local buffer-size collection.
- CWE-127 source-side: the *parameter* is the strcpy SOURCE (strcpy(localdest, param)); suppression flips to caller_source_buffer <= dest_buffer. Mirror of the current dest-side analysis in check_strcpy_safety/check_strcat_safety.
All build on analyze/buffer_size + the prescan callsite_param_buffer_size infra from task 143.pending2026-06-18T13:55:07Z�C�J�_�+	555Surface benchmark timing as a tracked metric (compare_runs + run-level duration + prescan/analysis split)LOCUS: bench/db.py (logic layer), NOT the MCP server. Timing is fully captured in the DB (runs.started_at/finished_at written by bench/runner.py:253/334; cwe_scans.duration_s written per-scan). The gap is that db.py never surfaces it:
- get_run_summary (bench/db.py ~558) copies started_at/finished_at into the summary but computes no wall-clock duration and does not aggregate SUM(cwe_scans.duration_s).
- compare_runs (bench/db.py:680) builds the delta dict (tp/fp/total/rate) and never references timing, though both summaries already hold the timestamps.
mcp_servers/server.py:compare_runs (~1562) and bench/__main__.py are thin formatters over db.compare_runs — fixing db.py surfaces timing in BOTH the MCP tool and the CLI for free.
Proposed: (a) get_run_summary returns wall_s (finished-started) and analysis_s (SUM cwe_scans.duration_s); the gap approximates prescan/overhead; (b) compare_runs adds a timing block with base/target/delta; (c) update MCP + CLI formatters to print it. Per-CWE timing already comparable via cwe_scans.duration_s (used to measure task 143's ~+4.5% on CWE-124/127). Optional: split prescan_s vs scan_s in runner.py for a true depth-vs-time axis.

PRIORITY/RATIONALE (promoted to P1 2026-06-18): performance is a first-class result for the paper, not just an ops concern — reviewers will expect sqc's scan-time characteristics (and the depth-vs-time tradeoff of FP-reduction work) reported alongside precision/recall. This gap resurfaces every FP-reduction task (e.g. 143 added prescan cost only visible via a manual per-CWE query), so making timing a tracked, comparable metric pays off repeatedly and feeds the paper's evaluation section.done2026-06-18T13:55:07Z2026-06-18T14:22:54Z2026-06-18T15:24:18Z�x�I��#5FIO30-C: cross-TU + function-pointer format-string FPs (remaining 210)After task 142 (v0.4.43), CWE-134 precision is 88.7% with 210 FPs remaining, all from variants the per-file rule cannot resolve: cross-file b/c/d/e sink files (22b/51b/52c/53d/54e/65b, 30 each = 180) where the tainted-vs-literal caller lives in a sibling translation unit, and the function-pointer variant (44, 30) where the sink is invoked via a funcptr so the call is not name-resolvable. Each remaining variant carries a matching TP, so they are precision-neutral but block further FP reduction. Fixing requires cross-TU taint (whole-program/prescan call-graph across files) or function-pointer assignment resolution (funcPtr = sink; funcPtr(arg)).pending2026-06-18T12:28:51Z

<
<�@�L�[�q5Optimize multi-hop buffer-size propagation: re-parse only forwarder files (cut task-143 cold-scan cost)Task 143's propagate_param_buffer_sizes re-parses ALL source files per pass to push buffer sizes through forwarding chains. The task-202 timing metric shows this costs ~+558s (+6.2%) on the cold full Juliet benchmark (0.4.43->0.4.45), dominated by the LARGE dirs that legitimately fire the gate: CWE-78 +160s (Δfp=0 — zero benefit!), CWE-121 +161s, CWE-134 +58s. The tightened gate (0.4.45) only recovered buffer-FREE dirs (CWE-190 -30s, CWE-191 -10s); it can't help dirs that genuinely have buffer forwarding but yield no STR31 suppression.

Root cause: each propagation pass re-parses every file (thousands) though only files containing a FORWARDER function (param_passthroughs non-empty) can contribute. Fix: during the initial per-file prescan, record the set of files that contain at least one forwarder of a (potentially) bounded buffer; in propagate_param_buffer_sizes, re-parse ONLY that set each pass. For CWE-78/121 most files are leaf testcases with no forwarding, so the re-parse set should shrink dramatically.

Cost is cache-amortized (ProjectContext bincode cache) for repeat scans, so this only bites cold scans / per-version benchmarks — but those matter for the paper's perf numbers (see task 202). Validate: analysis_s returns toward the 0.4.43 baseline with STR31-C FP unchanged at the suite total (4981).pending2026-06-18T15:24:18Z
���z�M
}�{555Fix realworld benchmark timing instrumentation for paperrealworld_results.duration_s is a run-level total duplicated across every project row (not per-project): e.g. 0.4.22 wrote 2423s to all 5 projects, 0.4.41 wrote 4131s to both. Also loc unpopulated in 145/195 rows, and cppcheck/clang-tidy have 0 timed rows. Blocks a realworld runtime-over-versions graph AND a tool-vs-tool throughput (LOC/s) comparison for the paper. Fix: (1) record per-project sqc duration, (2) populate loc, (3) time cppcheck + clang-tidy. Juliet timing is already paper-grade (scripts/benchmark_timing_figure.py + paper/fig_timing.tex).

--- 2026-06-18 add: record cache warm/cold per run ---
Realworld runs must note whether they ran cache-warm (reused prescan cache) or
cache-cold (rebuild_prescan=true). Owner wants this tracked from now on; it
explains misleading deltas (a cache-warm run after a rule change can under-report
improvement; cold runs are the source of truth). Cold-cache full suite is ~1hr.
Design: thread the rebuild_prescan flag from run_all/_build_sqc_cmd into the
per-run sidecar, have _auto_ingest_to_sqlite/ingest_realworld_run append
'cache:cold' or 'cache:warm' to realworld_runs.notes (or a dedicated column).
Implement off-run (MCP server doesn't hot-reload; coordinate a server restart).
Also relevant to the prescan-cache monthly-refresh cadence.

--- 2026-06-18 CORRECTION ---
Caching is currently UNWIRED for realworld: _build_sqc_cmd passes no prescan flag,
so every run is cold/fresh; the rebuild_prescan param is a dead no-op (swallowed by
**_kwargs); data/prescan_cache/*.cache (May 15) are vestigial. sqc DOES have
--save-prescan/--load-prescan. So warm/cold tracking is only meaningful AFTER the
runner is wired to those flags. Sub-scope: (a) decide whether to wire prescan
caching for realworld at all (cold is ~9-20min/codebase, maybe acceptable), (b) if
yes, thread --save/--load-prescan + a real rebuild flag, THEN (c) record cache:warm|cold.
If no, remove the dead rebuild_prescan param to avoid the misleading API.
2026-06-20 DONE (sqc timing + loc/c_files): Root cause of duplicated run-level total: get_status set end_time=now (poll time), so a single late poll reaping all parallel codebase runs stamped them with the same wall-clock-until-observed value (run 59: all 5 = 31061s = 8.6h). Fix: end_time now derives from result/log file mtime (_completion_time helper) = process actual last write, independent of poll timing. Applied to all 4 get_status completion branches (the 2 log-only branches previously set no end_time). loc/c_files: new _count_c_source (over curated cppcheck source_dirs => same LOC denominator across tools) + _extract_run_metrics, threaded through _auto_ingest_to_sqlite -> ingest_realworld_run(metrics=). Was hardcoded 0,0. Backfilled 18 surviving /tmp result dirs (run_ids 42-59): durations now realistic & stable (curl ~100s, hostap ~435s, sqlite ~220s, mosquitto ~25s, libcrc ~0.6s); LOC/s ~900-1900. benchmarks.db gitignored (local-only). MCP server doesn't hot-reload — effect after server restart. REMAINING: (3) cppcheck/clang-tidy never ingested => 0 timed rows => task 212. Cache warm/cold => tasks 208/209.
2026-06-20 VERIFIED LIVE (post MCP restart): fresh run 60 sqc-libcrc-0.4.55-bf7ffbd6 ingested duration_s=0.4s (accurate mtime-based, not poll-display 4s), loc=1034, c_files=9. Going-forward path confirmed.done2026-06-18T15:43:55Z2026-06-20T15:30:22Z2026-06-20T23:24:46Z
�V��j�O�-�)555EXP34-C bucket 2: caller-contract / precondition FP suppression (~338 sqlite FP)Second EXP34-C FP bucket from task 175 (bucket 1 = rc==SQLITE_OK out-param correlation, done separately). Pattern: a parameter pointer is dereferenced in a static helper, non-null guaranteed by the caller / API contract (e.g. fts3_tokenizer.c:316 'objPtr param non-NULL by API contract'; fts5_main.c 'handles NULL'). Requires interprocedural precondition propagation: suppress a param-pointer deref only when ALL callers pass a provably non-null argument (or the function is a documented API entry whose contract guarantees it). CRITICAL: must NOT mask the unguarded-malloc null-deref FN (verified firing as of 0.4.32) and must not blanket-trust all params. Higher regression risk than bucket 1 — assess after bucket-1 sqlite result is in. Validate Juliet CWE-476 recall stays flat.
DONE v0.4.56 (commit 31d632b8): shipped PRECONDITION-ASSERT subset. KEY FINDING: ~338-FP estimate was from a STALE oracle (1496 FPs at old sqc); current 0.4.55 already only 314 total/191 in-scope sqlite EXP34-C FPs. is_guarded_by_precondition_assert in exp34_c.rs: suppress deref when a dominating assert() establishes non-null (explicit assert(p)/assert(p!=0) OR implicit unconditional deref inside assert e.g. assert(p->flags&X)), gated on no ||/ternary + no reassignment between assert and deref. Self-contained in is_unsafe_at; does NOT touch shared callsite aggregation. RESULTS: scoped sqlite in-scope FP 191->185 (-6), TP unchanged; benchmark sqlite 1666->1656 (-10); curl/hostap/mosquitto/libcrc EXP34 IDENTICAL (zero regression); Juliet CWE-476 IDENTICAL (TP370/FP175/67.9%, recall flat). Tests: pass/testcases_precondition_assert.c + fail/testcases_reassign_after_assert.c. Remaining caller-contract (no assert, needs interprocedural) -> task 214.done2026-06-18T20:57:13Z2026-06-20T23:27:44Z2026-06-21T02:13:13Z�&�N�E�S5Alias-bound CWE-121/122 FP buckets: ARR38-C CWE805 cross-fn dest + ARR30-C CWE-129 subscriptResidual from task 144 after the ARR30-C string-copy FP win (v0.4.47). Both buckets are 100% good-section FPs that require interprocedural/alias analysis, NOT rule-local heuristics:
- ARR38-C/CWE-121 504 FP (CWE805 memcpy/memmove/ncat/snprintf): the sink line is IDENTICAL in bad and good; only the pointed-to buffer differs (data=dataBadBuffer[50] vs dataGoodBuffer[100]), set in the caller and passed cross-function. A content-length/size heuristic here would re-introduce the kind of unsound TP loss fixed in 18cbff53.
- ARR30-C/CWE-121 248 subscript FP (CWE-129): array index via aliased pointers (data=7 written through *dataPtr1, read via *dataPtr2). Needs alias/VRA.
Do these on top of task 150's alias-analysis decision (SSA-lite use-def vs alias). Keep the Static-dest discipline from 18cbff53.pending2026-06-18T19:31:16Z
����+�Q�+�-555Plumb prescan caching into benchmark runners (make rebuild_prescan real) + testToday the rebuild_prescan param on realworld run_all/run_analysis is a dead no-op (swallowed by _build_sqc_cmd(**_kwargs)) and neither the realworld runner (mcp_servers/realworld_server.py:_build_sqc_cmd) nor the Juliet runner (bench/runner.py:124) passes sqc's --save-prescan/--load-prescan. So every run is cold (fresh in-memory prescan); data/prescan_cache/*.cache is vestigial.

Scope: (1) wire the runners to sqc --save-prescan <FILE> (cold/first run) and --load-prescan <FILE> (warm/reuse) keyed per codebase/CWE; (2) make rebuild_prescan actually force a regenerate (save) vs reuse (load); (3) invalidate/regene on binary-or-manifest change (e.g. cache key includes sqc commit + manifest hash) to avoid silent staleness; (4) add a test: a warm run reusing a cache produces identical violations to a cold run on the same binary, and rebuild_prescan=true regenerates. Decide first whether the speedup is worth it (cold is ~9-20min/codebase realworld; Juliet per-CWE is already fast) — if not worth wiring, instead REMOVE the dead rebuild_prescan param and document that runs are always cold. Unblocks warm/cold recording (tasks 205 realworld, 208 Juliet).

--- 2026-07-06 RESOLVED ---
Measured: sqlite realworld scan cold(--save-prescan) 2m57s vs warm(--load-prescan)
2m38s, identical 31270 violations both ways — only ~10% wall-time win since
prescan is a small fraction of total per-file analysis cost, which always runs
fresh regardless. Not worth the cache-invalidation complexity + staleness risk
for a benchmark whose whole point is precise measurement. Removed the dead
rebuild_prescan param from run_analysis/run_all/_build_sqc_cmd in
mcp_servers/realworld_server.py; documented always-cold behavior there and in
docs/design/macro-expansion.md. Unblocked 208 (closed) on the same conclusion.done2026-06-19T00:13:22Z2026-07-06T15:49:24Z2026-07-06T15:49:51Z�P�P
w�-555Record cache warm/cold state on Juliet benchmark runsMirror of the realworld warm/cold tracking (task 205 sub-item). Juliet runs (bench.runner / mcp_servers/server.py, runs table in benchmarks.db) should record whether the run was cache-warm (reused prescan/per-CWE cache) or cache-cold (regenerated). Owner wants this tracked from now on so version-to-version deltas can be read correctly — a cache-warm run after an analysis change can under-report movement. Design: add the warm/cold flag to the runs table (notes or a dedicated column) and surface it in list_runs/get_status/compare_runs output. Confirm first whether Juliet fast-mode actually consumes a prescan cache and where; if it does not, record 'cache:n/a'. Pairs with the ~monthly prescan-refresh cadence.

--- 2026-06-18 note ---
Cross-check the realworld finding (task 205): realworld caching is currently unwired
(rebuild_prescan is a no-op, runs are always cold). Confirm whether Juliet fast-mode
actually loads/saves a prescan cache before building warm/cold recording; if Juliet
is also always-cold, record 'cache:cold' (or n/a) rather than inventing a warm path.

--- 2026-06-18 CONFIRMED ---
Juliet runner (bench/runner.py:124) invokes: sqc <cwe_dir> -m <manifest>
-d <cwe_dir> -d <testcasesupport> -e <csv> -j 1 — NO --load/--save-prescan.
So Juliet ALSO always prescans fresh (cold); it does not use a prescan db.
Both benchmarks are always-cold. --save/--load-prescan exist in sqc (src/main.rs,
CI-oriented, in docs) but no runner uses them; data/prescan_cache/*.cache is
referenced by nothing (vestigial). => For now, record 'cache:cold' (or n/a) on
Juliet runs; a real warm path requires wiring --load-prescan into the runner
first (joint with task 205). Lower priority since there is no warm path to
distinguish yet.done2026-06-18T23:47:25Z2026-07-06T15:34:04Z2026-07-06T15:34:04Z
p
�p�l�S�A�555ARR30 FN 2b: helper-function over-read across a tainted blob arg (nextchar/readUtf8 class)DONE v0.4.55 (dfa1e177). Interprocedural over-read at tainted-blob callsite.

Approach (within-TU, no prescan/FunctionSummary changes — canonical case is
same-file): per-file summary helper_overread_summary maps function name ->
positional indices of const char* params (no paired length) walked unbounded
(embedded-increment subscript inside a loop, index never relationally bounded).
On each call_expression, check_overread_helper_callsite flags when the arg at
an over-read index resolves (stripping +offset/casts) to a blob/value-accessor-
tainted pointer in the caller. Double gate = caller taint + callee unbounded
param walk + no length arg. Reuses task-210 embedded-increment + relational-
bound analysis and task-172 blob-taint collector.

Results:
  - Canonical FN recovered: nextchar.c:184 readUtf8(zOut+p->nPrefix, &cNext),
    zOut = sqlite3_column_text(...). Fires exactly there.
  - Precision: 1 hit / 0 FP across ALL 315 sqlite C files (the nextchar.c TP).
  - Juliet: delta-0 (TP 22615 / FP 4607 identical v0.4.52->v0.4.55; zero rule
    movement) — Juliet has no blob/value accessors so no delta expected.
  - Tests: 67 ARR30 + full suite (3391) pass.

Limitation / follow-up: covers same-TU case (helper + caller in one file, the
disclosed nextchar.c shape and the sqlite3.c amalgamation). True cross-FILE
(separate-TU) over-read helpers would need the cross-TU FunctionSummary infra
rather than the per-file map. Defer until a cross-TU instance surfaces.done2026-06-19T12:48:23Z2026-06-19T16:58:02Z2026-06-20T14:16:34Z��R��%555ARR30 FN 2b: param-decoder index over-read (os_kv kvvfsDecode class)Follow-up to task 172. The disclosed sqlite §2a FNs are mostly param-based index decoders, NOT blob-pointer walks, so the v0.4.52 conservative detector (blob/value-accessor pointer + varint/terminator chase) catches 0/14. Target shape: a function whose input buffer is a (cast of a) const char*/const unsigned char* PARAMETER with NO sibling length parameter, containing a while/for loop that indexes that buffer with an in-expression increment (aIn[++i], aIn[i++]) or while(1)+break, where the index is never bounded against any length in the function. Canonical: src/os_kv.c:469 kvvfsDecode(const char *a, char *aOut, int nOut) — dest aOut bounded by j+n>nOut but source aIn[i]/aIn[++i] unbounded (disclosed heap over-read). FP risk: plain while(*s)/while(s[i]) NUL-terminated C-string walks — must gate those out (stop-at-NUL is the caller contract). Requires full Juliet benchmark to tune; revert broadening if it regresses Juliet char*-walker precision. Detector scaffolding (collect_blob_tainted_pointers, check_unbounded_decode_loop, pointer_walk_is_bounded, UNTRUSTED_BLOB_ACCESSORS, VARINT_READERS) already in src/rules/cert_c/ARR/ARR30-C/arr30_c.rs.done2026-06-19T12:48:23Z2026-06-19T13:57:00Z2026-06-19T16:17:56Z
|���V�=�w555EXP34-C bucket 2b: interprocedural caller-contract (all-callers-non-null) FP suppressionDONE v0.4.57 (83ccb394). Root cause: error/cleanup null assignments whose statement is immediately followed by a divergent jump (e.g. 'pWInfo = 0; goto whereBeginError;') were the textually-last write, so flow-insensitive collect_local_var_states recorded them as the variable's null state and cast a null call-site vote that poisoned callee params every reachable caller passes non-null (whereOmitNoopJoin pWInfo; growOp3 p via forwarding). Fix: stmt_diverges_after skips recording such dead-end null assignments (goto/return/break/continue follow). Malloc-then-deref FN untouched (no trailing jump). RESULTS: sqlite EXP34-C 1656->1633 (-23); all 19 adjudicated removals oracle-confirmed FP + 4 unaudited Tcl-shell tooling, 0 TP loss; all 7 oracle TPs preserved. Juliet 100% FLAT (TP 22615, FP 4607, tp_rate 83.1%) — zero recall/precision delta across all 74 CWEs, CWE-476 unchanged. NOTE: -d <repo> is essential to reproduce the interprocedural mechanism; without it EXP34 drops to 310 and the fix is dormant.done2026-06-21T01:49:14Z2026-06-21T13:03:46Z2026-06-21T15:25:07Z�T�U�1�y555Fix realworld auto-ingest 'already ingested' short-circuit blocking full re-ingest_auto_ingest_to_sqlite (mcp_servers/realworld_server.py ~L1389) skips ingest entirely if ANY existing realworld_run has the sqc dir_name in its notes. A partial/test run (e.g. libcrc-only) ingested first for a given version+sha permanently blocks the later full 5-codebase run from auto-ingesting — we had to manually DELETE the run row from benchmarks.db then re-call get_status. Fix: either upsert/merge missing project+tool rows into the existing run, or re-ingest when the on-disk result set is more complete than what's stored, instead of all-or-nothing skip.done2026-06-20T22:54:48Z2026-06-20T23:15:26Z2026-06-20T23:21:27Z��T��}555Ingest cppcheck + clang-tidy realworld rows (timing + LOC/s)Follow-up from task 205 (sqc timing fixed). realworld_results only ever gets sqc rows: _auto_ingest_to_sqlite globs sqc-*.json and ingest_realworld_run hardcodes tool='sqc'. So cppcheck/clang-tidy have 0 timed rows, blocking the tool-vs-tool throughput (LOC/s) figure. Need: (a) parse cppcheck .xml + clang-tidy .txt result files into realworld_violations, (b) insert their realworld_results rows with tool name + per-codebase duration (the _completion_time mtime approach + state durations now work for all tools; _extract_run_durations currently filters tool=='sqc' — generalize), (c) reuse _count_c_source for loc (same curated source_dirs denominator across tools => fair LOC/s). Cache warm/cold tracking is separate (tasks 208/209).
2026-06-20 DONE: _ingest_competitors attaches cppcheck+clang-tidy per-project rows (violation_count + loc + mtime-based duration) to the sqc run row, called from _auto_ingest_to_sqlite. loc reuses _count_c_source (shared denominator across tools => fair LOC/s). _extract_run_durations generalized with a tool param. Also fixed a pre-existing run_all fragility: auto-ingest trigger now locates the sqc dir via _latest_completed_version_dir (was _get_version_dir/latest-by-mtime, which in a run_all batch is a competitor dir => ingest silently skipped). Per-finding detail not stored (competitors aren't scored vs the CERT-rule-keyed oracle; matches historical backfill). Picks the latest completed competitor run per codebase from state (competitor versions are stable, so every run row carries all 3 tools). VERIFIED offline against real libcrc artifacts (temp state+DB): sqc 391 finds/0.7s, cppcheck 40/0.1s, clang-tidy 2/0.4s, all loc=1034; counts match raw .xml/.txt. Live auto-attach needs an MCP server restart (next run_all populates it).done2026-06-20T16:10:35Z2026-06-20T16:24:03Z2026-06-20T16:47:10Z
``��W�7�M5CWE-680 interprocedural integer-range propagation (param/global/cross-file sink args)Follow-on to task 145. After the v0.4.58 constant-overflow fix (INT32-C check_allocation_overflow now flags malloc/calloc/realloc size args that fit 64-bit but definitely wrap a 32-bit size_t, via expression_overflows_unsigned_vra(...,32,...)), CWE-680 per-file detection moved 125->135/336 (~40%). Frama-C is at 82.6%.

The remaining ~200 missed files are NOT recoverable without interprocedural integer-range propagation, which task 150 deliberately deferred (no major infra). Two miss buckets:

1. Interprocedural dataflow variants (Juliet 41 param-in, 44, 45, 51-54 cross-file, 62-68) across all 6 patterns (~155 files). Sink is e.g. badSink(int data){ malloc(data*sizeof(int)); } called as badSink(data) where the caller set data=INT_MAX/2+2. The call passes a VARIABLE, so the existing const-callsite mechanism (callsite_param_const_int, tasks 115/116) can't seed it -- that only fires on literal call-site args. Needs caller->callee VRA range propagation (or extend callsite_param_const_int to fold the caller's intra-fn VRA of the arg variable before propagating).

2. Straddling control-flow variants (08-15, 17): data = -1; if(staticReturnsTrue()){ data = INT_MAX/2+2; }. VRA merges to a POSSIBLE-not-definite large range [-1, 1.07e9], so the precise definite-wrap check correctly doesn't fire. Catching these means flagging range.MAX>UINT32_MAX (possible wrap) instead of range.MIN -- FP-prone in the broad suite/real-world; needs path-sensitivity or branch-condition folding (staticReturnsTrue/GLOBAL_CONST_TRUE), not a blunt threshold.

Gated on the same infra decision as task 150; revisit only if the ceiling decision flips to invest in interprocedural range tracking. INT32-C is already a top real-world FP rule (4502), so any range-propagation work must measure real-world precision, not just Juliet recall.pending2026-06-21T18:20:06Z
�n�X�M�[5Project-relevance prescan: auto-gate inapplicable rule classes (CON/WIN/C11/Annex-K) per projectFollow-up to task 151. Today, per-project rule applicability is curated BY
HAND in conf/realworld/<project>-rules.toml: each file enable/disables rule
classes and explains the rationale in its [metadata].description prose (e.g.
curl: "WIN*, FIO*, POSIX socket/thread, SIG*, CON* are IN scope"; sqlite drops
the 14-rule advisory baseline). This is correct-by-construction but manual and
doesn't scale to arbitrary user codebases.

GOAL: a lightweight project-characterization prescan that detects which rule
CLASSES are even relevant to a given codebase, then auto-gates the categorically
-inapplicable ones (the way the realworld configs do manually). This is about
RELEVANCE/applicability, NOT FP-suppression — same principle as memory
'fn-focus-vs-perproject-disable' (we only ever drop categorically-inapplicable
rules; genuine FPs stay measured in the ground_truth oracle).

Dimensions to detect (examples):
  - Threading/concurrency: no pthread/threads.h/_Atomic/std::thread, no
    mtx_*/atomic_* usage  => CON0x / CON3x not relevant.
  - Platform: no <windows.h>/Win32 API  => WIN* not relevant; conversely
    POSIX-only daemon vs cross-platform lib changes SIG*/FIO* scope.
  - Language level: strict C99 target (no <stdatomic.h>, <threads.h>,
    Annex-K *_s funcs, _Generic) => C11/Annex-K-specific rules not relevant.
    Ties into the C99-benchmark tasks (191/193/194).

Design questions:
  - Detection signal: header includes + symbol/identifier scan (cheap, fits
    existing prescan) vs compile_commands.json / build flags (-std=, defines).
  - Output: emit a generated rules-<project>.toml override, or an in-process
    relevance mask applied at scan time? Former is auditable + matches current
    workflow; latter is zero-config for end users.
  - Guardrails: detection must be conservative (false "irrelevant" = silent FN).
    Prefer "disable only when we're confident the whole class can't apply."

Deliverable: design first (like task 151), then implement behind a flag.
Relates to: 151 (concurrency relevance is one dimension), 191/193/194 (C99),
188 (Windows benchmarks), and the conf/realworld/*-rules.toml manual configs.pending2026-06-21T19:53:49Z
�%��R�Z
�)555MCP realworld server leaks zombie children (doesn't reap)mcp_servers/realworld_server.py spawns cppcheck/clang-tidy subprocesses but never wait()s on them after capturing output, so finished children become defunct zombies (Zs state). This makes PID-based liveness checks unreliable: a clang-tidy run that finished in ~1min showed as 'alive' for ~3h via ps -p <pid>. Fix: ensure the server reaps child processes (proc.wait()/communicate() completion) so PIDs free correctly. Surfaced during Lua baseline run (task 191).done2026-06-21T23:44:17Z2026-06-22T21:53:04Z2026-06-22T21:57:40Z�W�Y�	�'555Find an idiomatic structural-C99 codebase for conformance-rule validation (API05-C / designated-init / restrict / FAM / _Bool)Spun off from task 191. Lua (now in the suite as a general oracle) turned out
to be PORTABILITY-C99, not STRUCTURAL-C99: it uses long long / snprintf /
strtod / %a (gated behind !LUA_USE_C89) but ZERO designated initializers,
compound literals, _Bool/stdbool, restrict, flexible array members, or
conformant array parameters (verified 2026-06-21 by grep over the pinned
checkout). So it gives no positive-validation target for API05-C or the other
C99-conformance rules — same reason cgltf was rejected earlier.

GOAL (unchanged from 191's original rationale): find a permissively-licensed C
codebase that GENUINELY uses structural C99 idioms, so the conformance rules
have real TPs to validate against (not just FPs measured on non-adopting code).

Verify BEFORE adopting (the lesson from Lua + cgltf): grep the actual checkout
for the idioms, don't trust the project's reputation as "modern C":
  - conformant/VLA array params:  f(size_t n, char buf[n])  /  buf[static N]
  - designated initializers in aggregate inits:  = { .field = ..., [i] = ... }
  - compound literals:  (struct T){ ... }
  - _Bool / <stdbool.h>, restrict, flexible array members ( x[]; at struct end )
  - mixed declarations-after-statements

Candidate directions: numerics/DSP or scientific libs (often use VLA params),
modern crypto (monocypher was floated), modern parsers/codecs. API05-C's
'[static N]' specifically may have NO real-world user at all -> that sliver
stays on the synthetic-conformance-corpus track (task 194), not here.

Relates to: 191 (Lua added there as general oracle), 190 (API05-C correctness),
194 (synthetic C99 corpus), 216 (project-relevance gating).
FINDING (2026-06-23): raylib is the structural-C99 codebase. Verified by a high-precision idiom detector calibrated so Lua -> 0 across all idioms (loose grep gave Lua 100+ false hits from 'if(x){', 'obj.field=', local 'buf[SIZE]' — useless; tightened to anchor designated-inits to {/,/line-start, restrict compound literals to value-position tagged/typedef types excluding control kw, and use the unambiguous '[static' token for API05-C). raylib @962bbfc (zlib license, permissive): its 7 OWN .c TUs (rcore/rshapes/rmodels/rtext/rtextures/raudio/rglfw) carry 166 compound literals + 61 designated-init fields; (Vector2){x,y}/(Color){...}/(Rectangle){...} — the compound-literal idiom is ABSENT from every existing suite member and from Lua/monocypher. Exclude src/external/ (98 bundled glad/dr_mp3/glfw files). monocypher REJECTED (portability-C99 like Lua: 8 designated, 0 compound, 1 restrict — reputation failed the grep again). Existing suite ALREADY covers the other structural idioms: hostap 918 designated-field +202 designated-index +45 FAM; sqlite 167 designated; curl/mosquitto FAM+restrict+stdbool. _Bool spelled literally is rare (codebases use <stdbool.h> bool); gd_toolchain=newlib has the only literal _Bool (15). API05-C '[static N]': ZERO real-world adoption anywhere (only a doc comment in newlib cdefs.h) — confirms 194's synthetic-only call. Adoption into the realworld suite spun off as a follow-up.done2026-06-21T20:27:57Z2026-06-23T14:43:02Z2026-06-23T15:17:58Z
%
�x/u%�L�_�'�s555FIO42-C double-reports the same handle as both unclosed FILE* and unclosed fdFIO42-C reports the SAME variable at the SAME line:col under two different messages: 'FILE pointer data opened with fopen/freopen but never closed with fclose()' AND 'File descriptor data opened with open() but never closed with close()'. Repro: sqc --rules FIO42-C on CWE404_Improper_Resource_Shutdown__fopen_w32CloseHandle_01.c -> both at 29:5. This is a MISCLASSIFICATION (one resource matched by both the fopen-class and open-class detectors), not just a textual dup -- so a plain (rule,file,line,col,msg) dedup will NOT collapse it; the resource-type classification must be made mutually exclusive. Run sqc-0.4.58-fa49d057: 914 total / 598 distinct, ratio 1.53. Inflates CWE-404 counts.done2026-06-22T22:36:25Z2026-06-23T12:18:57Z2026-06-23T13:14:36Z�6�^�'�G555SIG31-C double-emits per shared-object reference instead of per (object,line)SIG31-C reports the same 'accesses shared object X which is not volatile sig_atomic_t' finding twice for some accesses. Repro: sqc --rules SIG31-C on CWE364_Signal_Handler_Race_Condition__basic_01.c -> line 32:9 emitted 2x and 40:9 emitted 2x (identical message), while 30:9 and 38:9 emit once. Run sqc-0.4.58-fa49d057: 108 total / 72 distinct, ratio 1.5. Looks like it emits per textual reference/occurrence rather than deduping on (object, line). Engine has no dedup backstop (mod.rs:312). Fix: dedup per (shared-object, access-statement).done2026-06-22T22:36:25Z2026-06-23T03:35:05Z2026-06-23T03:44:39Z�E�]
q�555POS37-C emits each finding twice (exact duplicate)POS37-C reports the identical finding twice on the same line:col with the same message. Repro: sqc --rules POS37-C on CWE273_Improper_Check_for_Dropped_Privileges__w32_ImpersonateNamedPipeClient_01.c -> two byte-identical hits at 53:9 ('ImpersonateNamedPipeClient() return value not checked'). Confirmed across every CWE273 testcase (run sqc-0.4.58-fa49d057: 72 total / 36 distinct file:line, ratio 2.0). Same bug CLASS as DCL02-C (task 220) but a distinct root cause -- the check() likely visits the call node via two traversal paths or matches two patterns. Engine does NOT dedup (analyze_project only sorts, mod.rs:312), so the dup reaches output and inflates FP counts. Fix: emit one finding per (call-site).done2026-06-22T22:36:25Z2026-06-22T22:38:32Z2026-06-22T22:47:29Z�-�\
o�o555DCL02-C emits duplicate findings (100x same line)Lua oracle b12 (lgc.c) found DCL02-C fired the identical n/h identifier-similarity finding 100x on line 793 and 100x on line 811 (200 of 203 DCL02-C hits are exact dupes of 2 lines). Finding dedup is failing for DCL02-C — inflates finding counts and FP volume in benchmarks. Repro: sqc on lgc.c @ Lua 40b76de2 with lua-rules.toml. Likely the similar-identifier pairwise scan re-emits per comparison instead of per declaration site.done2026-06-22T13:33:13Z2026-06-22T22:02:24Z2026-06-22T22:21:16Z�S�[�
�555sqc DB result reports whole-repo c_files/loc, ignoring --excludeWhen sqc runs with --exclude globs (e.g. Lua: onelua.c/ltests.c/testes), the benchmark DB row reports c_files/loc for the FULL repo set (counted via cppcheck source_dirs), not the reduced fileset sqc actually scanned. E.g. Lua showed c_files:40 loc:34183 though sqc scanned 33 files. The LOC/file-count metric should reflect the post-exclude set sqc analyzed. Cosmetic but skews per-codebase density/normalization. Surfaced during Lua baseline (task 191).done2026-06-21T23:44:21Z2026-06-23T14:30:20Z2026-06-23T14:32:57Z
�	���p�a��M555Paper: duplicate-finding bug class as a Juliet blind-spot case studyCapture a concrete example of real-world oracle findings that the Juliet benchmark MISSES, for the Juliet-vs-realworld hedge (relates to task 152 and memory realworld-oracle-paper-context). Story: DCL02-C re-emitted the same visually-similar-identifier finding ~100x per nested block (203 findings, 200 exact dupes of 2 lines, on Lua lgc.c @40b76de2; task 220). Juliet did NOT surface this bug at all -- its tiny synthetic testcases lack the deep block nesting that triggered the O(depth) scope recursion; the Lua real-world oracle caught it. Juliet DID independently surface a weaker flavor of the same bug class (per-statement/per-reference double-emit): POS37-C (2.0x), SIG31-C (1.5x), FIO42-C misclassification (1.53x) -- tasks 221/222/223. Paper angle: (a) synthetic micro-benchmarks under-detect structural/scale-dependent defects; real codebases exercise depth, size, and idiom that expose them; (b) absence of an engine dedup invariant (task 224) let these reach output. Use as evidence for why the 5 real-world oracles complement Juliet rather than duplicate it. Pull final numbers after 221/222/223 fixes land.done2026-06-22T22:36:44Z2026-06-23T14:13:57Z2026-06-23T14:22:33Z� �`��A555Engine-level duplicate-finding backstop in analyze_projectanalyze_project (src/analyze/mod.rs:312) only SORTS violations before returning -- there is no dedup, so any rule that double-emits silently inflates findings (and FP counts in the benchmark DB). Confirmed offenders: DCL02-C (task 220, fixed), POS37-C (221), SIG31-C (222); FIO42-C (223) is a misclassification a plain dedup won't fix. Add a cheap defensive dedup at the per-file collection point: collapse exact duplicate (rule_id, file_path, line, column, message) within a file before pushing to file_violations. Also add a debug_assert / opt-in warning that fires when a rule emits an exact dup, so future rules can't regress unnoticed. This is a BACKSTOP, not a substitute for fixing the rules (a dup usually signals a real traversal/classification bug worth fixing at the source). Keep it after suppression filtering and before the sort. Verify Juliet TP/FP deltas are dup-only (recall unchanged).
RESOLUTION (won't-do, 2026-06-23): Closing without implementing. Rule-level fixes (220 DCL02-C, 221 POS37-C, 222 SIG31-C) address the root causes; 223 FIO42-C was a misclassification a dedup wouldn't fix anyway. An engine-level dedup backstop would MASK future double-emit bugs rather than surface them. Duplicates are observable enough as-is: they inflate findings on any real project and show up directly in benchmark FP counts, so they get caught and fixed at design time. Decided the masking risk outweighs the backstop value.done2026-06-22T22:36:44Z2026-06-23T13:58:23Z2026-06-23T13:58:23Z
�{�b��i555Adopt raylib (zlib, @962bbfc) as structural-C99 real-world oracleFrom task 217: raylib is the verified structural-C99 codebase (166 compound literals + 61 designated-init in its 7 own .c TUs; the compound-literal idiom no other oracle has). Adopt it as the 6th real-world oracle, mirroring the Lua adoption under task 191. STEPS: (1) clone/pin raylib @962bbfc under ~/toolchain/raylib; (2) register in mcp_servers/realworld_server.py CODEBASES with sqc --exclude for src/external/** (bundled glad/dr_mp3/glfw/miniaudio — not raylib's code), and matching cppcheck -i / clang-tidy exclude so the fileset is identical across tools (the lesson from Lua, and now counted correctly by task 219's _count_c_source fix); scan_path/includes = src + raylib.h; (3) build conf/realworld/raylib-rules.toml dropping categorically-inapplicable rules only (per fn-focus-vs-perproject-disable memory); (4) run, then adjudicate ground_truth focusing on the conformance rules that now have real inputs (compound-literal/designated-init/FAM/restrict handling). GOAL: give those conformance rules a positive-validation oracle. API05-C [static N] stays synthetic (task 194).
PROGRESS (2026-06-23, commit 7122bdfc): steps 1-3 DONE + validated. raylib pinned @962bbfc under ~/toolchain/raylib. Registered in CODEBASES (scan_path={path}/src, --exclude **/external/**, matching cppcheck -i / clang-tidy exclude; added {path} expansion to scan_path in _build_sqc_cmd). conf/realworld/raylib-rules.toml created (14-rule advisory baseline). Smoke run (sqc direct): 6351 findings across all 22 own files, 0 external-leaked, no parse errors/panics, 108 headers resolved; structural-C99-heavy files all analyzed (rmodels.c 849 / raymath.h 363 / rtextures.c 1156). Top rules FLP34(976)/FLP03(888)/INT33(523) — graphics/math profile. REMAINING: step 4 = formal MCP run (sqc+cppcheck+clang-tidy -> benchmarks.db) BLOCKED on restarting the realworld MCP server (it cached the pre-raylib CODEBASES dict at import); step 5 = ground-truth adjudication (large manual audit, the conformance-rule subset is the high-value target — should likely be its own task mirroring how each oracle's audit was a dedicated effort).
STEP 4 DONE (2026-06-23): realworld run #66 ingested into benchmarks.db (codebase_commit 962bbfc, 17 files / 56107 LOC — task-219 _count_c_source correctly counts the post-exclude own-code set). Findings: sqc 6351 (38.7s) / cppcheck 1060 (1940s) / clang-tidy 469 (51.8s); all three on the identical 17-file fileset. sqc count matches the pre-commit smoke run exactly. No ground-truth labels yet -> measured precision unscored. STEP 5 (adjudication) spun off as its own task, mirroring how each oracle's audit (sqlite/curl/lua) was a dedicated effort.done2026-06-23T15:17:27Z2026-06-23T15:21:13Z2026-06-23T16:36:54Z�
BATCH 3 DONE (rcore.c, 2026-06-23): 532 raw -> 489 unique labels (20 TP / 469 FP) + 1 FN. Core module = real-bug harvest: TPs = ARR00-C+ARR30-C:4002 (GetGamepadAxisCount unchecked gamepad index OOB; siblings bounds-check), POS30-C:2646 (readlink full-size no NUL room), MEM05-C:2934/4265 (recursive dir scan), MSC30-C:1745 (rand() used), FIO11-C x3 (non-standard rt/wt modes), FIO14-C x3 (fseek SEEK_END on binary = UB), DCL37-C x4 (reserved-id macros), DCL13-C:3691, DCL00-C x3 genuine (1738/3161/3214). Adversary flipped 11 DCL00-C TP->FP (false never-modified on branch/loop-reassigned locals incl crypto round vars -> filed as new task) and found FN ARR30-C:3937 (GetGamepadName twin OOB sqc missed). FP mass = pure advisories (CON/FLP/STR/ERR/API) + misfires (INT33 on float, ARR00 static/heap-return, FIO30 ternary-format). CUMULATIVE (3 batches, 7/23 files=30.4%): precision 4.4% (39 TP/883), recall 81.2% (39/48, 9 FN). NEXT: batch 4 = another big module (rtextures.c 1149, rshapes.c 879, rmodels.c 848, rtext.c 545) or the platform backends group.
BATCH 4 DONE (rtext.c, 2026-06-23): 545 raw -> 509 unique labels (5 TP / 504 FP) + 3 FN. UTF-8/font-decode module. TPs: INT30-C:2688/2689 (glyphCount*sizeof RL_MALLOC overflow, unchecked .fnt field), DCL13-C:2021 (const ptr), DCL00-C:217 (const local), and the standout ARR38-C:1922 = REAL public-API buffer overflow (TextReplaceBetween strncpy into static char[1024] with no clamp, siblings clamp). Adversary flipped 217 DCL00 + 1922 ARR38 up, flipped 2096 DCL13 down (TextAppend writes text via TextCopy -> not const). 3 real FNs sqc MISSED, all on the BDF decode path: EXP34-C:2894 (glyphs=NULL; glyphs=&glyphs[index]; write -> wild near-NULL pointer write), ARR30-C:2802 (malloc(codepointCount) BEFORE defaulting codepointCount=95 -> OOB heap write + leak on 2793), ARR30-C:2503 (GetCodepointNext over-reads truncated UTF-8, no NUL guard unlike sibling). New FP signal filed as MEM30 task. CUMULATIVE (4 batches, 8/23 files=34.8%): precision 3.2% (44 TP/1392), recall 78.6% (44/56, 12 FN). NEXT: batch 5 = a drawing module (rtextures.c 1149 / rshapes.c 879 / rmodels.c 848 — expect raymath-style FP storms) or raudio.c (304) / rlgl.h (252).
BATCH 5 DONE (rtextures.c, 2026-06-23): 1149 raw -> 897 unique labels (20 TP / 877 FP) + 0 FN. Image load/convert/pixel-pack module = pixel-math FP storm (FLP34 264 + FLP03 160 + INT08 64 ...). 20 TP all DCL00-C compute-once pixel consts (r/g/b = round(coln.*) used once in a shift). Adversary flipped 14 DCL00 FP->TP and CORRECTED my over-broad batch-3 heuristic: the DCL00 discriminator is REASSIGNMENT-AFTER-INIT, not loop proximity — compute-once-then-read consts are TP even when read inside a loop (ImageColorReplace/ImageColorTint/ColorTint/ImageDrawPixel cases), vs =0-then-reassigned-in-loop which is the genuine false claim (ImageFormat). Verified FPs: faceRecs[6] indexed [0..5] = size-misparse from {0} init (ARR00:4242-55), INT32 memcpy width*bpp on loader-capped dims, INT34/EXP46 5461/5483 = intentional half-float branchless bit hack (& of 0/1 bools, not &&), EXP39 format-matched void* pixel writes, DCL13 false-const on casted-member-write output params. No FNs (real image decode lives in external stb/qoi headers, not this file). CUMULATIVE (5 batches, 9/23 files=39.1%): precision 2.8% (64 TP/2289), recall 84.2% (64/76, 12 FN). NEXT: batch 6 = rshapes.c (879) or rmodels.c (848, 3D model decode = higher TP/FN potential).
BATCH 6 DONE (rmodels.c, 2026-06-23): 759 unique labels (36 TP / 723 FP) + 4 FN. 3D model loaders. KEY FINDING: the trust boundary splits by LOADER not file — raylib's OWN IQM parser does ZERO header validation (magic+version only, dataSize unused), so 35 ARR38/INT32 findings on the IQM memcpy/alloc sites (4786-5131) are GENUINE OOB-read/overflow TPs on malformed .iqm (adversary flipped all 35 up from my conservative FP default + DCL13:2149). OBJ/glTF/M3D delegate to tinyobj/cgltf/m3d (validate internally) -> correctly FP. 4 FNs sqc missed (index-loops, not memcpy call sites): IQM indices[] write 4850, IQM per-mesh vertex OOB 4877, OBJ face v_idx no-upper-bound 4603, glTF JOINTS temp overflow 6232. Confirmed-FP families: MEM30 reused-temp-across-branches (29), ARR00 points[4]/tmp[4] size-misparse + worldTransform out-param-fill, EXP34 cgltf result-guarded, FLP storm. Filed upstream-report task. CUMULATIVE (6 batches, 10/23 files=43.5%): precision 3.3% (100 TP/3048), recall 86.2% (100/116, 16 FN). NEXT: batch 7 = rshapes.c (879, FLP storm) then raudio.c(304)/rlgl.h(252) then platform backends.
BATCH 7 DONE (rshapes.c, 2026-06-23): 568 unique labels (4 TP / 564 FP) + 0 FN. Pure 2D-drawing float-geometry storm, as predicted. 4 TP all DCL00-C compute-once (float c=powf(t,2) bezier coeffs, 2106/2152/2239/2254). Adversary: 0 flips, 0 FNs (verified every array decl: point[12], point[16], spline points[50] indexed to 49; MEM05 #define-not-VLA; ARR36 float scalar swaps; INT33 float div; collision routines all caller-trusted bounded). Surfaced ARR00 initializer-misparse as THE dominant FP driver (98 here) -> filed task 234. CUMULATIVE (7 batches, 11/23 files=47.8%): precision 2.9% (104 TP/3616), recall 86.7% (104/120, 16 FN). Drawing storms done (rtextures/rshapes); rmodels was the TP jackpot (IQM). NEXT: raudio.c(304) + rlgl.h(252) = batch 8, then 8 platform backends + raylib.h = batch 9.
BATCH 8 DONE (raudio.c + rlgl.h, 2026-06-23): 466 unique labels (3 TP / 463 FP) + 1 FN. Infrastructure files; audio decode fully DELEGATED to external libs (dr_wav/dr_flac/stb_vorbis/qoa/jar_xm/jar_mod, internally validated + NULL-safe) and rlgl trusts caller indices -> NO own parser -> no IQM-style TP cluster (confirms the loader-trust-boundary thesis). 3 TP all DCL00 compute-once (rlgl 3835/3837/3838 e/r/g pixel-flip). Adversary: 0 flips (verified eye-index 4804/4814 = trusted 0/1 contract no sibling bounds-checks; MEM30:1793 jar_mod_unload-frees-internal-vs-RL_FREE-wrapper + 2625 extList-aliases-into-extensionsDup = container-vs-member, both FP; MSC37 2092/4757 every GL-backend config returns; EXP34 drwav/drflac_free reduce to free() NULL-safe). FN found: rlgl.h:1248 rlPushMatrix stack OOB write (overflow check TRACELOGs but no return -> 33rd push writes stack[32] past [32]; rlPopMatrix is guarded, asymmetric). New FN class = sqc doesn't model warning-without-return guards. False-claim DCL00 globals AUDIO:404/RLGL:1149 confirmed FP. CUMULATIVE (8 batches, 13/23 files=56.5%): precision 2.6% (107 TP/4082), recall 86.3% (107/124, 17 FN). NEXT: batch 9 (final) = 8 platform backends (rcore_desktop_sdl/win32/glfw/rgfw/drm/android/web/web_emscripten ~1265) + raylib.h (32); highly repetitive (rcore_template/rcore_memory already audited as TPs in batch 1) so calibration applies heavily.
BATCH 9 DONE + AUDIT COMPLETE (2026-06-23): 8 platform backends + raylib.h, 1181 labels (30 TP / 1151 FP) + 3 FN. TP: CON33/CON34 (strtok/strerror/readdir non-thread-safe), ENV33 system() x3 (OpenURL), DCL37 (__wrap_fopen/_XTYPEDEF_FONT reserved-id), rgfw DCL00 lookup tables. Adversary 0 flips (confirmed: DCL00 width/height all out-param-written =FP; FIO24 fd per-error-path-close not double-close; MEM31 gbm stored in global cleaned in ClosePlatform; MEM05 kernel-#define-sized not VLA; POS01 trusted /dev paths; button/key indices OS-guaranteed or guarded; API05 [static N] suggestion = FP per task194). 3 FN (OS-input-index OOB sqc missed): sdl:1717 mouse-button, drm:2273 gamepadAbsAxisRange dim-mismatch, android:1308 key-queue-no-guard. ===== FINAL (frozen oracle raylib-v1.0, run #66): 23/23 files 100% coverage, 5263 labels, 137 TP / 5126 FP / 20 FN -> precision 2.6%, recall 87.3%. ===== TP rules: DCL37 100%(22), ARR38 56%(19 IQM), INT32 37%(17 IQM), DCL00 29%(34), CON34 75%(9), DCL13(9), CON33/ENV33/MSC30/POS30 100%, FIO11/FIO14 75%, MEM05(2),INT30(2). All semantic advisories 0%. Tool-improvement tasks filed: 228(INT33-float) 229(cpp-block) 230(FLP06) 231(DCL00-reassign) 232(MEM30-freetrack) 234(ARR00-init-misparse) 235(warn-without-return FN); upstream 233(IQM). raylib is now a fully-adjudicated 6th oracle (frozen raylib-v1.0).done2026-06-23T16:36:27Z2026-06-23T16:47:02Z2026-06-23T22:59:02Z
�\�c���555Adjudicate raylib ground-truth (run #66, conformance-rule subset first)raylib is registered + run (#66, commit 962bbfc): sqc 6351 / cppcheck 1060 / clang-tidy 469 findings on 17 own-code files. Adjudicate to give raylib ground_truth labels and make it a true oracle. PRIORITIZE the structural-C99 conformance subset (the reason raylib was adopted, task 217): findings on/around compound literals ((Vector2){...}), designated initializers, FAM, restrict — confirm sqc handles these idioms correctly (TP vs FP), since that's the positive-validation goal. Then broaden file-at-a-time like the sqlite/curl/lua audits. Workflow: bench realworld-unlabeled <run> to list unlabeled findings; bench realworld-import-labels to append TP/FP; bench audit-complete per fully-read file; bench audit-score for precision/recall on the audited corpus. API05-C [static N] has no instances here (synthetic, task 194).
BATCH 1 DONE (2026-06-23): 5 smallest files (rglfw.c, rcore_template.c, rcore_memory.c, rgestures.h, rcamera.h) — 83 raw findings -> 76 unique labels + 6 FN. Workflow proven: primary adjudication -> adversarial agent (general-purpose) challenged all 76 -> reconciled -> import-labels (source=precision_audit_0.4.63_batch1, adjudicator=claude-opus-4.8) -> audit-complete. Adversary flipped 3 (DCL37-C _POSIX_C_SOURCE/_GNU_SOURCE FP->TP: verified live CERT text has NO feature-test-macro exception, so they're the same reserved-id construct as the _GLFW_* TPs) and found a POS54-C FN cluster (kbhit ignores fcntl/tcsetattr/tcgetattr returns; sqc fired ERR33-C on ungetc but missed the POSIX siblings). RESULT: precision 23.7% (18 TP/76), recall 75.0% (18/24). TP rules: DCL37-C 10/10, DCL13-C 6/6 (const-correctness), ENV33-C 1/1 (system()), ERR33-C 1/1 (ungetc). All semantic advisories 0% (API00-C 0/15, FLP34-C 0/12, FLP03-C 0/10, CON03-C, INT33-C...). Coverage 5/23 files (21.7%). CALIBRATION for next batches: DCL37 reserved-id=TP (incl feature-test macros), DCL13 unmodified-ptr=TP, API00 ptr-validation on trusted-caller API=FP, FLP03/FLP06 firing on integer division=FP, INT33 on float-context/nonzero-constant divisor=FP, DCL31 implicit-decl from unresolved #include=FP, CON03 on single-threaded statics=FP. NEXT: batch 2 = raymath.h (363, the compound-literal centerpiece).
BATCH 2 DONE (raymath.h, 2026-06-23): 363 raw -> 318 unique labels (1 TP / 317 FP) + 2 FN. The compound-literal/designated-init centerpiece: sqc parses it cleanly (no crash, no spurious findings ON the literals) — conformance handling VALIDATED. Near-total FP storm, all verified by adversarial agent (0 FP flipped): INT33-C 83 + FLP03-C 67 (integer/advisory rules on FLOAT division), FLP06-C 45 (float-arith misread as integer), FLP32-C 42 (sqrtf of sum-of-squares / atan2f), FLP34-C 24 (benign conversions), DCL40-C 32 (C++ operator-overloads collapsed to one 'operator' fn — no-preprocessor misparse of inactive __cplusplus block), CON03-C 19 (static constexpr immutable C++ constants), API00-C 3 (output-ptr helpers, trusted contract), FLP00/02-C (intentional exact float compares incl != 0.0f div-guard). Only TP: DCL00-C:937 (local c never modified). Adversary found 2 DCL00-C FNs: lines 936/938 (siblings b,d identical to flagged c — sqc flags only first of a run). CUMULATIVE (batches 1+2, 6/23 files = 26.1%): precision 4.8% (19 TP/394), recall 70.4% (19/27, 8 FN). Now in the real-world precision range (cf sqlite 6.3%, curl 0.89%). NEXT: batch 3 = a big module, e.g. rshapes.c (879) or rcore.c (532), or group the remaining platform backends.�
��9��D�f�%�e555FLP06-C: suppress 'init with integer arithmetic' when all operands are floatraylib audit (task 227): FLP06-C fired 45x in raymath.h, all FP — it claims a float var is 'initialized with integer arithmetic' on expressions whose operands are ALL float (e.g. Lerp line 229 'start + amount*(end-start)' where start/amount/end are float params; Normalize/Remap etc.). The rule should only fire when the initializer genuinely contains integer arithmetic that is then implicitly converted; float*float/float+float is not it. FIX: check operand types of the initializer expression; suppress when no integer subexpression is present. Lower volume than INT33/C++-block but same root cause family (no operand typing). Corpus: ground_truth raylib@962bbfc FLP06-C FP rows.done2026-06-23T19:03:04Z2026-06-24T21:06:17Z2026-06-25T01:21:43Z��e�W�i555No-preprocessor: skip inactive #if defined(__cplusplus) blocks (kills DCL40-C/CON03-C C++ FP classes)raylib audit (task 227, raymath.h) found 2 entire FP classes caused by sqc parsing the inactive C++ compat block (#if defined(__cplusplus) && !defined(RAYMATH_DISABLE_CPP_OPERATORS), lines 2772-3154): DCL40-C 32x ('incompatible declarations of function operator' — sqc collapses distinct C++ operator+/*/... overloads into one fn named 'operator'), and CON03-C 19x (static constexpr immutable C++ constants flagged as unsynchronized shared vars). raylib (and most headers: raylib.h, raymath.h, rcamera.h) compile as C, so the __cplusplus branch is dead code in the C build but sqc has no preprocessor and parses it anyway. FIX: detect top-level '#if defined(__cplusplus)' / '#ifdef __cplusplus' guards and skip the guarded region when analyzing as C (it is unreachable in a C TU). Contained, cross-codebase (every C lib with a C++ compat shim benefits). Relates to [[macro-expansion-strategy]] and task 187. Feeds task 151 (CON03 methodology). Corpus: ground_truth raylib@962bbfc DCL40-C/CON03-C FP rows.done2026-06-23T19:03:04Z2026-06-24T16:13:12Z2026-06-24T18:30:40Z� �d�+�555INT33-C: suppress div-by-zero on FLOAT-typed divisions (operand type inference)Biggest single FP bucket found in the raylib audit (task 227, run #66): INT33-C fired 83x in raymath.h alone (523x across raylib), EVERY ONE a false positive — it flags FLOAT division as integer div-by-zero. INT33-C (integer div/0) is UB only for INTEGER operands; float x/0.0 is defined inf/nan, not UB. Today int33_c.rs only parses float *literals* (try_parse_float_literal) so a float *expression* divisor like '(end - start)', 'length', 'v2.x' (all float vars/params) slips through and fires. FIX: gate INT33-C to fire only when the divisor is integer-TYPED — infer type from float params/locals/return types (float/double/Vector*.x style member access) and suppress when float. Validate recall stays intact on Juliet INT33 + the real bridge.c:930 integer div TP (task 182). Cross-codebase win (INT33-C is noisy on every math-heavy oracle). Corpus: ground_truth raylib@962bbfc INT33-C FP rows.done2026-06-23T19:03:04Z2026-06-24T00:45:56Z2026-06-24T16:11:35Z
_
��_�@�i�5�M555Upstream: report raylib IQM-loader missing header validation (OOB on malformed .iqm)raylib audit (task 227, rmodels.c @962bbfc) found LoadIQM/LoadModelAnimationsIQM validate ONLY magic+version (lines 4766-4778, 5085-5097); dataSize from LoadFileData is captured (4658) but NEVER checked against any header field. Every num_*/ofs_* (unsigned int, struct 4663-4678) is used directly: 18 memcpy(fileDataPtr+ofs_*, num_*-sized) = OOB reads from the file heap buffer, plus index-loops at 4850 (indices[] write) and 4877/4895/4913/4930/4947/4966 (per-mesh first_vertex+num_vertexes vs header num_vertexes, unchecked) = OOB read/write. 32-bit count*sizeof arithmetic (num_vertexes*3 etc) can wrap -> undersized alloc. A crafted .iqm crashes/corrupts. This is sqc's biggest real-bug cluster on raylib (36 TP + 4 FN, run #66 ground_truth). ACTION: file a raylib GitHub issue (relates to task 164 upstream-contribution); fix is to bound-check all ofs_*+count*size <= dataSize before each memcpy/loop. Note: OBJ/glTF/M3D loaders delegate to tinyobj/cgltf/m3d which validate internally, so IQM is the unique gap. NOT a sqc bug — sqc correctly flagged it (ARR38/INT32 TPs); the 4 FNs are index-loops sqc missed (it sees memcpy call sites but not array[file_index] in bare loops).done2026-06-23T21:36:35Z2026-06-24T16:07:40Z2026-06-24T16:07:40Z�	�h�9�[555MEM30-C: false double-free/UAF from untracked reassignment & container-vs-member freesraylib audit (task 227, rtext.c) found MEM30-C emits alarming false double-free/use-after-free reports — 6 FP in one file — from three misfire patterns: (1) free-then-reassign: RL_FREE(p); p = newbuf; ... use p (rtext.c:987 atlas.data); (2) free-then-reassign-then-return flagged as 'returning freed pointer' (2274 text, 2311 codepoints: RL_FREE(text); text=temp; return text); (3) freeing a CONTAINER conflated with freeing copied-out members (2682/2720/2729: Image fullFont=imFonts[0]; RL_FREE(imFonts) frees the struct array, NOT fullFont.data). Same root cause as DCL00 task 231: the dataflow does not track pointer REASSIGNMENT after free, and does not distinguish a container's storage from a pointee copied out of it. FIX: in MEM30-C, after a free, clear the freed-state if the pointer is reassigned before next use; treat 'free(array)' as freeing the array object, not values previously copied out by value. False UAF/double-free are high-erosion FPs (they look critical). Genuine MEM30 TPs must still fire. Corpus: ground_truth raylib@962bbfc MEM30-C FP rows. Related: [[fn-focus-vs-perproject-disable]], task 231.done2026-06-23T19:59:40Z2026-06-26T00:40:18Z2026-06-26T22:26:43Z�L�g�9�a555DCL00-C: false 'never modified' on locals reassigned in branches/loops (precision bug)raylib audit (task 227) found DCL00-C systematically emits false 'initialized but never modified, const-qualify it' claims on variables that ARE modified later — it misses reassignments inside if/else branches and loops, and whole-struct claims when only MEMBERS are written. Confirmed FP instances: rcore.c CORE:399 (global mutated everywhere), width:803/height:814 (reassigned in branches), r:1741 (loop r=rand()), and a cluster of crypto round-loop state vars 3273/3279/3380/3382/3484/3486/3488/3489 (c=b; e=d; etc.); plus rgestures.h GESTURES:237 (struct-member writes) from batch 1. 11 false claims in rcore.c alone. FIX: DCL00-C must scan the ENTIRE scope (all branches/loop bodies) for any assignment/compound-assignment/address-of-nonconst/member-write to the variable before recommending const; today it appears to only see the initializer. Genuine TPs remain (read-only locals/tables like rcore.c 1738/3161/3214) so don't disable — tighten the modification analysis. Corpus: ground_truth raylib@962bbfc DCL00-C FP rows. Also surfaced: ARR30-C gamepad-accessor inconsistency (flags axisCount[gamepad]:4002 but misses identical name[gamepad]:3937) = a recall/FN gap, lower priority.done2026-06-23T19:36:21Z2026-06-25T12:35:18Z2026-06-25T13:41:17Z
\
�\�0�k�w�55Detect warning-without-return guards (e.g. overflow check that logs but does not return) -> stack/buffer OOB FN classraylib audit (task 227, rlgl.h:1248) found a real bug sqc MISSED: rlPushMatrix (public RLAPI) checks 'if (stackCounter >= RL_MAX_MATRIX_STACK_SIZE) TRACELOG(ERROR, ...)' but has NO return/else, so the next line writes stack[stackCounter]=*currentMatrix one Matrix past the fixed [32] array -> OOB write. The guard EXISTS but is ineffective (logs without bailing). rlPopMatrix IS guarded (if stackCounter>0), making the missing Push return asymmetric/clearly a bug. sqc's ARR30/ARR00 sees the array write but treats the preceding if() as a guard and suppresses -> false negative. FIX: when an index/bounds check's then-branch does NOT alter control flow (no return/break/goto/continue, no index reset) before the guarded access, do NOT treat it as a protective guard. This is a recall improvement (find more real OOB). Corpus: ground_truth raylib@962bbfc rlgl.h:1248 FN. Related tasks 231/232/234 (sqc dataflow gaps).pending2026-06-23T22:27:29Z�l�j�+�/555ARR00-C: array-size misparse of braced/designated/{0} initializers -> false OOBraylib audit (task 227) found ARR00-C's biggest FP driver is initializer SIZE-MISPARSE: it undercounts braced array initializers and then flags every legitimate subscript as OOB. rshapes.c alone: 98 findings, all FP — e.g. 'const Vector2 point[12]={...}' (12 braced rows) read as point[9] then point[10/11] flagged OOB; 'Vector2 points[2*SPLINE_SEGMENT_DIVISIONS+2]' (=50) miscounted; rtextures.c faceRecs[6]={0} read as size 1 (4242-4255); rmodels.c points[4] read as size 1 (4047-4049). Root cause: when an array is declared with a braced/designated/{0} initializer (no explicit numeric size, or size as a macro/const expr), sqc derives the bound from a miscount of the initializer elements instead of the declared/maximal size. FIX: when the declarator has an initializer, take the array size as max(explicit-size-expr-evaluated, initializer-element-count); resolve macro/const-expr size bounds (e.g. 2*SPLINE_SEGMENT_DIVISIONS+2) via const_eval. High-volume cross-file FP (structural-C99 braced-init idiom = exactly what raylib was adopted to expose). Genuine OOB TPs must still fire (e.g. the IQM index loops, task 233). Corpus: ground_truth raylib@962bbfc ARR00-C FP rows. Related [[macro-expansion-strategy]], tasks 231/232.done2026-06-23T22:01:25Z2026-06-24T18:36:36Z2026-06-24T20:54:12Z
����m�y�?555FLP06-C: residual text-heuristic FP sub-classes (arrow-as-minus, byte-subscript-read, unary-literal, array-brace-init)task 230 killed the all-float-operand FP class (~104/111 raylib) via operand typing. 7 residual raylib FPs remain from the crude text 'has_arithmetic' = contains(+,-,*,/): (1) arrow operator '->' read as minus, e.g. rcamera.h:312 'float distance = Vector3Distance(camera->position,...)'; (2) integer byte read into float where arithmetic is in the subscript INDEX, rtextures.c:2656-2659 'float f1 = ((unsigned char*)data)[(y*w+x)*bpp+i]'; (3) unary minus on a single literal rtextures.c:1599 'float pixelValue = -1;'; (4) array brace initializer rmodels.c:2780 'float vertices[] = {...}'. FIX: AST-based arithmetic detection (require a real binary_expression with +-*/ operator on integer operands) instead of text contains(); exclude '->', unary, subscript-value, initializer_list. All are in ground_truth raylib FLP06-C FP rows. Reuse float_typing engine.done2026-06-24T23:08:26Z2026-06-25T01:24:03Z2026-06-25T12:03:39Z�l�l��G555Upstream raylib Tier-1 bugfix PRs (3 public-API memory-safety bugs)Detour from task 227 audit. Tracked in raylib_BUGFIX_PR.md (repo root). Three clean public-API bugs in raylib @962bbfc, independent of the trusted-assets threat model (each has a bounds-checking sibling = clear oversight): (1) rlPushMatrix stack overflow (rlgl.h:1248, guard logs but no return -> 33rd push writes stack[32] past [32]); (2) TextReplaceBetween static-buffer overflow (rtext.c:1922-1924, 3 strncpy into static char[1024] no clamp, siblings TextReplace/TextInsert clamp); (3) GetGamepadAxisCount/GetGamepadName unchecked gamepad index OOB (rcore.c:4002/3937, every sibling guards gamepad<MAX_GAMEPADS). Per bug: branch off raylib master, ASan repro (before=OOB/after=clean), minimal fix matching raylib style, PR description (drafted in the md). Tackle 1-by-1. Brandon checking raylib PR/CLA process in parallel. Tier 2 (IQM/BDF/OBJ/glTF malformed-file robustness) = task 233; Tier 3 (platform input callbacks) separate.
ALL 3 FIXES PREPARED + build-verified (2026-06-23), branches in scratch raylib-pr clone (off master==962bbfc): bug1 fix-rlpushmatrix-overflow 5cfac55 (+5/-1, intra-object corruption repro); bug2 fix-textreplacebetween-overflow 99936bc (+7/-3, ASan global-buffer-overflow); bug3 fix-gamepad-index-bounds fe17e47 (+4/-0, adjacency + standalone-array ASan). Each: own branch off master, [module]-tagged single commit, repro before/after in raylib_pr_artifacts/, libraylib.a builds clean. No CLA. REMAINING: Brandon to push branches to a fork + open 3 PRs (one at a time per CONTRIBUTING), disclosing AI assistance per BISSELL policy.
SUBMITTED (2026-06-23): forked to szarta/raylib, pushed 3 branches, opened 3 PRs vs raysan5/raylib (all OPEN, AI-attribution disclosure in each body): #5935 [rlgl] rlPushMatrix, #5936 [rtext] TextReplaceBetween, #5937 [rcore] gamepad-index. gh auth as szarta. REMAINING: monitor for maintainer review/feedback (raysan5).done2026-06-23T23:38:11Z2026-06-24T16:07:40Z2026-06-24T16:07:40Z
	4�����g4�/�v
o�u	555Refactor MEM30-C scan_function_body below AIRD 85src/rules/cert_c/MEM/MEM30-C/mem30_c.rs:517 — scan_function_body, AIRD 87 > 85. Decompose to pass knots. Rule logic — benchmark after. Verify: pre-commit run knots --all-files.done2026-06-25T14:12:22Z2026-06-25T18:39:20Z2026-06-25T19:01:28Z�$�u
o�_	555Refactor create_test_summary_report below AIRD 85src/rules/cert_c/integration.rs:59 — create_test_summary_report, AIRD 90 > 85. Decompose to pass knots (--aird-threshold=85). Verify: pre-commit run knots --all-files.done2026-06-25T14:12:22Z2026-06-25T18:20:33Z2026-06-25T18:39:11Z�#�t
c�i	555Refactor MEM31-C analyze_node below AIRD 85src/rules/cert_c/MEM/MEM31-C/mem31_c.rs:326 — analyze_node, AIRD 90 > 85. Decompose to pass knots. Rule logic — benchmark after. Verify: pre-commit run knots --all-files.done2026-06-25T14:12:22Z2026-06-25T18:01:48Z2026-06-25T18:20:25Z��s��3	555Refactor build.rs generate_integration_tests below AIRD 85build.rs:315 — generate_integration_tests, AIRD 92 > 85. Decompose to pass knots (--aird-threshold=85). Verify: pre-commit run knots --all-files.done2026-06-25T14:12:22Z2026-06-25T17:48:02Z2026-06-25T18:01:39Z�I�r
c�5	555Refactor MEM31-C process_call below AIRD 85src/rules/cert_c/MEM/MEM31-C/mem31_c.rs:855 — process_call, AIRD 92 > 85. Decompose to pass knots. Rule logic — benchmark after to confirm Juliet/realworld unchanged. Verify: pre-commit run knots --all-files.done2026-06-25T14:12:22Z2026-06-25T17:16:28Z2026-06-25T17:38:05Z�m�q
I�	555Refactor run_app below AIRD 85src/ui/mod.rs:351 — run_app, AIRD 92 > 85. Decompose to pass knots (--aird-threshold=85). Verify: pre-commit run knots --all-files.done2026-06-25T14:12:22Z2026-06-25T16:25:46Z2026-06-25T16:44:35Z�r�p
Y�	555Refactor analyze_project below AIRD 85src/analyze/mod.rs:41 — analyze_project, AIRD 92 > 85. Decompose to pass the knots complexity gate (--aird-threshold=85). Verify with: pre-commit run knots --all-files. Behavior-preserving; likely needs a benchmark run after (touches core analysis driver).done2026-06-25T14:12:22Z2026-06-25T14:14:47Z2026-06-25T14:21:58Z�c�o��5ARR30-C: inconsistent gamepad-accessor flagging (recall/FN gap)Surfaced during task 231 (raylib audit). ARR30-C flags CORE.Input.Gamepad.axisCount[gamepad] (rcore.c GetGamepadAxisCount, ~line 4002) as an unvalidated array index but MISSES the structurally identical CORE.Input.Gamepad.name[gamepad] (GetGamepadName, ~line 3937) — both are 'return CORE.Input.Gamepad.FIELD[gamepad];' over MAX_GAMEPADS-sized arrays with the unchecked 'gamepad' param. The detector is inconsistent on the same subscript-of-struct-member pattern depending on field/type (name[] is char*[], axisCount[] is int[]). This is a recall/FN gap, not an FP. FIX: make the unvalidated-param-index detection fire uniformly across CORE.Input.Gamepad.*[gamepad] member-array accessors regardless of element type. Verify on raylib@962bbfc; guard Juliet recall.pending2026-06-25T13:58:19Z��n��555Realworld bench: auto-reconcile DB ingest on scan completionRoot cause: realworld SQLite ingest was pull-based — the detached scan child (start_new_session=True) only writes JSON to /tmp/realworld_results and exits; ingest happened ONLY as a side effect of an interactive get_status()/get_results() poll. A run finishing while no poll arrives (overnight / session ended / server restarted) was stranded on disk and stuck 'running' in the state file (raylib 0.4.68 hit this twice). Fix (realworld_server.py): _reconcile_pending_ingests() forward-only sweep (ingest dirs at/above DB high-water version; surface older un-ingested dirs as skipped_uningested rather than silently backfilling), driven by (a) startup hook, (b) background edge-triggered watcher thread on scan completion, (c) explicit reconcile_db() MCP tool replacing the manual BenchDB().ingest_realworld_run backfill. Also _finalize_dead_run_statuses() flips dead-pid 'running' runs to 'completed'.done2026-06-25T12:27:56Z2026-06-25T12:28:00Z2026-06-25T12:30:52Z
L�
����L��|�;�555lang-parsing-substrate 0.1.6 query layer: descendant-search is recursive, not iterativesubstrate::query::find_descendants/find_first_descendant (v0.1.6) use plain recursion (collect_descendants/search_first call themselves per child), same shape as the pre-v0.4.22 hand-rolled searches that overflowed the stack on hostap's deep else-if chains (task 153, fixed for ARR00-C/MEM33-C only). Do NOT use these two functions to migrate the ~252 rule files still on recursive self-walks — that would just swap one recursive implementation for another. Safe to use from substrate: find_ancestor/nearest_ancestor_of_kind/nearest_ancestor_of_kinds (while-loop based, no depth risk) and node_text — already adopted in ast_utils.rs. If the descendant-search migration is still wanted, request/implement an iterative variant upstream in the substrate first.done2026-07-02T02:21:30Z2026-07-02T15:47:52Z2026-07-02T16:18:59Z�C�{�K�=555MEM30-C: false double-free from preproc-split if/else-if chains (raudio ctxData, rcore_drm res)Residual from task 232 (2 of the original 45 raylib MEM30 FP rows). Distinct root cause from the three task-232 patterns: #if/#endif directives between else-if arms break tree-sitter's if_statement nesting, so the branch-sensitive merge does not see mutually-exclusive frees. raudio.c:1793 — MP3 and MOD else-if arms each RL_FREE(music.ctxData); only one runs, but the flat scan flags the 2nd as double-free. rcore_drm.c:1364 — drmModeFreeResources(res) (name contains FREE → treated as free) in a diverging else{...return -1;} arm wrapped in #if, then freed again post-#endif. Fix likely needs preproc-aware if/else reconstruction or treating preproc_if-wrapped sibling frees as alternatives. Verify Juliet parity. Corpus: ground_truth raylib@962bbfc MEM30-C FP rows for those 2 files.done2026-06-26T21:03:36Z2026-06-26T23:20:48Z2026-06-26T23:43:39Z�]�z�!�	555Integrate knots complexity gate (pre-commit + CI/CD) + invoke bump-versionBring in the knots complexity gate the way ingot/todo-sqlite-cli did, at the strict default --aird-threshold=85.

Already staged (uncommitted, in working tree):
  - .pre-commit-config.yaml: knots hook (repo brandon-arrendondo/knots @ v1.8.2), types_or [rust, python] (C files are noncompliant CERT-C fixtures, not gated).
  - .github/workflows/ci.yml: 'Complexity (knots)' job running 'pre-commit run knots --all-files'.
  - tasks.py: invoke bump-version (heals Cargo.toml + docs/sqc.1 version & date), plus check/build/test. Man page already re-synced 0.4.13 -> 0.4.69.

BLOCKED until all 10 refactor subtasks (240-249) land, because CLAUDE.md forbids --no-verify and the hook must pass at 85. Tackle subtasks one at a time to spare context. Several touch rule logic / core analysis (VRA, MEM30/31, ENV03, STR31, analyze_project) — run a Juliet (+ realworld) benchmark after those to confirm no detection drift before the final commit.

DoD: pre-commit run knots --all-files exits 0; cargo test + clippy + fmt clean; benchmark shows no regression; then commit the tooling + refactors together.done2026-06-25T14:12:38Z2026-06-25T21:03:51Z2026-06-25T21:03:51Z� �y
_�g	555Refactor STR31-C check_node below AIRD 85src/rules/cert_c/STR/STR31-C/str31_c.rs:1759 — check_node, AIRD 86 > 85. Decompose to pass knots. Rule logic — benchmark after. Verify: pre-commit run knots --all-files.done2026-06-25T14:12:22Z2026-06-25T19:24:39Z2026-06-25T20:08:56Z��x
c�]	555Refactor analyze_value_ranges below AIRD 85src/analyze/value_range.rs:1161 — analyze_value_ranges, AIRD 86 > 85. Decompose to pass knots. Core VRA — benchmark after. Verify: pre-commit run knots --all-files.done2026-06-25T14:12:22Z2026-06-25T19:08:17Z2026-06-25T19:24:34Z�#�w
c�i	555Refactor ENV03-C check_writes below AIRD 85src/rules/cert_c/ENV/ENV03-C/env03_c.rs:885 — check_writes, AIRD 86 > 85. Decompose to pass knots. Rule logic — benchmark after. Verify: pre-commit run knots --all-files.done2026-06-25T14:12:22Z2026-06-25T19:01:32Z2026-06-25T19:08:12Z