A measurable fact is not yet a recommendation. Every finding passes three gates: is the fact itself resolved correctly, does the code's role change the right fix, and is the idiom deliberate for this shape. This page is the standing catalogue those gates route into; every class was earned on a real false positive and is pinned by a regression test.
Before a scan the tree shows only the gates. After a scan, the report's own Analysis Precision view shows the same tree with this repository's finding counts at every gate and classifies each finding into the exact classes below, with file and function examples.
Cases where naive parsing or resolution would manufacture a wrong fact. Each was found on a reference repository or a customer scan, fixed at the resolution level, and the finding it used to produce can no longer occur.
An absolute import of a stdlib module was stitched into a fake 13-module cycle through a local file of the same name.
A Windows-only import guard was graded as a hard import-time cycle.
A cycle closed by module-scope re-exports was called lower-risk than import-time, although one import order still crashes.
One implementation drew three parameter-count findings, and stub entries polluted the call graph and ownership.
handle.close() extracts as a dotted callee, so every textbook try/finally close was flagged as an unbalanced resource.
A factory that hands its handle to the caller was flagged as a leak.
Opening outside the with-block to catch the open error alone was flagged.
A handler delegating to a NoReturn error rewriter was graded a swallow.
__del__ swallows, logging.Handler.handleError and handlers that render the error as output were graded as silent swallows.
x = default; try: x = risky() except: pass keeps a deliberate prior value.
POSIX error-code semantics collided with Python names such as list.remove, where failures raise instead.
A best-effort per-item close at the end of a loop body was graded a silent swallow instead of skip-and-continue.
A dispatch branch whose nested loop only extracts fields still drops the unmatched record; only an append inside the branch-local loop exempts.
One lazy import inside a strongly-connected cluster downgraded a genuine top-level import cycle; the hard edges alone still formed the loop.
A function whose body sat inside one try measured a level deeper than it reads, pushing at-threshold code over the deep-nesting line.
An else: block holding a single if parses identically to elif, so real else-plus-nested-if lost both its nesting level and its real-else cognitive increment.
A raise inside an inner function marked the enclosing except handler as re-raising; six per-function analyses walked into scopes they did not own.
A diamond hierarchy with a mid-level override resolved self.m() to the shared base's method — depth-first pre-order, not Python's MRO.
A renamed file's commit history stopped at the rename, skewing bus-factor young; non-ASCII paths escaped matching entirely.
A bare 'await f()' read as a consumed result, and async factories were never recognised as ownership transfer.
The fact is real, but the code's role rewrites the right response: a security boundary must stay one auditable unit, a parser's branching belongs to the format, measured extraction friction argues against a mechanical split.
Complex validation code whose branches are the defense. Splitting it would scatter the checks and weaken review; the advice is one auditable unit with a test on every rejection path.
Liveness analysis shows every split point carries four or more locals across the cut, so helper extraction would only thread state through parameters. The advice steers toward grouping the state or leaving the code inline.
The same liveness analysis found a split point where at most one local crosses, so the finding names the seam where extraction is actually safe.
Parsers, adapters and evaluators branch with the format they handle. The advice is to review growth and extract only a named sub-case worth testing on its own.
An unbalanced file-descriptor acquire in a test module. Test code never ships, so a leaked descriptor cannot affect production; it is documented for awareness rather than queued as a must-fix leak (leaked locks are not demoted — their harm is intra-run).
A Temporal workflow/signal name one language references that no other-language literal definition matches — a candidate drift (typo or half-finished rename). Kept at INFO because a name built from a variable/constant is invisible to the literal-only check, so it is a lead to confirm, not a proven bug.
The path is only the tail of a URL assembled at runtime — the base comes from a setting, an environment variable or an attribute — so this scan cannot tell whose server it addresses. A third-party endpoint (an LLM gateway, a payment API) has no counterpart in the repository BY DESIGN, so an unmatched path here is not evidence of drift. Reported at INFO with the base named, for a human to resolve in one look.
A validator's guard-and-record branches are its job, so its complexity grades informational rather than as a defect.
Parallel task and adapter implementations share their code shape on purpose. The duplicates are reported for awareness and kept out of the fix queue.
A wide parameter list that models an integration contract is advised to preserve compatibility first, not to be reshaped mechanically.
A module that defines nothing and exists to assemble the public surface: its fan-out is the interface (a package barrel), and for a widely-imported package its fan-in is every consumer importing that surface — neither is coupling debt. The advice guards the shape — a thin re-export, children never import back through it.
The entrypoint that wires the application touches everything once by design. Moving the wiring only renames the file; the watched risk is business logic accumulating beside it.
A widely-imported module that defines the classes everyone consumes and depends on almost nothing itself. The fan-in is the type doing its job; the advice is compatibility discipline, not a split.
When one person wrote effectively the whole repo, per-file silo advice is the project's structure wearing a file name. The findings stay visible in the governance lens, reframed to the real unit of action: staffing.
A function that returns the memory it allocates is a factory, not a leak. The audit moves to the call sites that own the free.
A class registered with a runtime registry (@X.register) is reached by string/entry-point dispatch the static call graph cannot see. Its methods are never judged dead, and their leverage says 'registry-dispatched' instead of a false low caller count.
A package barrel and its children import each other, but the loop is closed only by deferred/lazy imports, so importing the package never reaches a partially-initialized module. The back-reference is the deliberate barrel pattern, not import-time debt; a barrel whose loop closes with an import-time edge stays a warning.
The import-time core of a circular cluster where every edge binds a module OBJECT referenced only inside function bodies (never at module-init). Importing it cannot read a partially-initialized module, so the cycle is load-bearing by construction (asyncio's tasks/timeouts) rather than a fix-first hazard. A symbol import or any top-level use of a cyclic name in the core keeps it a must-tier warning.
A shell command that silences stderr and swallows failure (2>/dev/null + || true) but whose enclosing call's result is captured, returned, or inspected downstream — the failure surfaces as an empty/degraded result the caller acts on, so the silencing is a deliberate probe rather than a hidden swallow. A fallback whose result is discarded stays a warning.
Deliberate idioms graded by what the code actually does: broad handlers by how they treat the error, ordered de-duplication by why the list stays a list, long-but-linear flows by their cognitive load. The fact stays visible at informational grade; only unexplained shapes escalate.
close(), __exit__() and finalizers must not raise; the broad swallow is the documented convention there.
A best-effort swallow inside cleanup for an already-failing operation.
The handler skips the current item and moves on, including a pass-only handler that ends a loop body, which is equivalent to continue.
Partial discovery is acceptable at a parser or adapter boundary; the advice is to narrow the exception type, not to remove the handler.
The handler turns the exception into a fallback value. Intentional, with a reminder that the original traceback is lost.
The handler prints the failure; the advice is to keep the cause recoverable with exc_info or a re-raise.
The caught error reaches another call's arguments, so it leaves the handler as data instead of being dropped. Whether that callee surfaces it is not statically decidable — a state setter reports it, a predicate consumes it — so the finding says that much and asks you to confirm the receiving call.
A constructor stores a handle or allocation that the class releases in close(), __exit__() or its C++ destructor. Function-local counting does not apply; the check moves to instance lifetimes and call sites.
An append-if-missing list preserves output order on purpose. The O(n*m) fact holds, so the advice is a sidecar seen-set, never a semantics-changing set conversion.
Two or more loops nest and both sides grow, which is what the rule measures — but a guard clause ABOVE the reported loop tests membership in a set the traversal itself grows, so an element already reached skips that whole loop rather than one pass of its body. The nest can therefore visit each element once, making the total linear in elements and edges rather than quadratic. Depth is what decides it: a guard inside the loop skips work without skipping an iteration, and keeps the full claim. The O(n^k) claim is withheld here, and so is the usual advice to introduce a set: the set is already there.
A membership test against a fixed literal collection scans a small constant. Only a collection that grows or carries input-sized data escalates.
The membership test's enclosing loop is bounded by a compile-time constant (`while (x.length < 8)`, `for (i=0;i<4;i++)`), so it runs a fixed number of times regardless of input — not the O(n*m) the rule targets.
Whether a missing default is a bug turns on exhaustiveness — is the discriminant a closed set already covered? — which needs the type. A 0-LLM check can't confirm it, so it advises at INFO instead of warning.
A user function that merely sounds like a search grades informational, and the wording says the name alone cannot confirm a re-scan.
A dispatch loop iterating a constant table: the domain is the table itself, so the missing else is defensive rather than lossy; the advice is to make the domain explicit, not to alarm. Literal guards alone no longer qualify — the guarded value can come from a source the chain does not cover.
A long function with low cognitive complexity, such as a printer or a sequential orchestrator, stays informational. Length alone is not a defect.