From f99626d68b94846f19335260965df659f48e162e Mon Sep 17 00:00:00 2001
From: Joe Esquibel <squid-protocol@users.noreply.github.com>
Date: Tue, 28 Jul 2026 22:42:41 -0400
Subject: [PATCH] Fix #587: Strict parsing tests for html structural signatures

Adds strict positive/negative, ambiguity-sweep, and ReDoS regression
coverage in tests/core_engine/test_language_standards_strict.py for all 39
non-None html structural signatures (54 tests). Found and fixed 8 real bugs
in html's rules dict, all the same root shape: a `\b` sitting adjacent to a
non-word character inside a shared alternation group.

Also found and filed a separate, real pipeline bug as issue #733 before
writing any tests: html is tagged `line_exclusive` but should be
`block_exclusive` (its own inline comment already says so), and
block_exclusive's own delimiter config is empty/broken -- net effect,
<!-- --> comments are never actually stripped from code_stream for html
today. Not fixed here (matches the epic's established pattern of keeping
per-language issues scoped to the rules-dict regexes and filing pipeline
gaps separately, e.g. #691/#694/#697). Tests below are written against
html's real (unstripped) code_stream behavior -- dead_code/macros search
for the literal "<!--" prefix directly, which is why they still work
despite the pipeline bug.

Real bugs found and fixed (8, all the shared-`\b`-next-to-non-word-char trap):

1. `branch`: `*ngIf` (Angular) was inside `\b(...)"[^"]*"` -- `*` is always
   preceded by whitespace in real markup, so the leading `\b` (boundary
   between two non-word chars) never fired. Never matched.
2. `comprehensions`: `*ngFor`, identical shape to #1.
3. `safety`: `pattern="..."`/`sandbox="..."`/`rel="noopener..."`/
   `integrity="..."` all ended on `"` inside a shared `\b(...)\b` group --
   the char after a closing attribute quote is also non-word, so the
   trailing `\b` never fired. 4 of 7 alternatives were dead.
4. `concurrency`: `loading="lazy"`/`fetchpriority="high"/"low"`, same shape
   as #3 (`decoding="async"` happened to self-heal via a coincidental
   substring match on the separate bare "async" alternative -- not a real
   rescue, still fixed for the right reason).
5. `immutability_locks`: `aria-disabled="true"`, same shape as #3 (also
   self-healed via "disabled" being a substring of "aria-disabled" --
   matched regardless of true/false value, which was never the intent).
6. `dependency_injection`: `<script type="importmap"\b` -- trailing `\b`
   right after the closing `"`. Never matched at all, unconditionally.
7. `decorators`: `hidden`/`inert` are true boolean attributes almost always
   written bare (`<div hidden>`); the pattern required `[ \t]*=`
   unconditionally, so the dominant real-world bare form never matched.
   Found while writing this test's own positive case.
8. `reflection_metaprogramming`: `style="[^"]*;"` required a literal
   trailing semicolon before the closing quote -- CSS allows omitting the
   last declaration's semicolon and most real inline styles don't carry
   one. Dropped the requirement.

All 8 independently verified: old-pattern-reproduces / new-pattern-fixes
for each regression, including the two "self-heals but for the wrong
reason" cases (concurrency's decoding=async, immutability_locks'
aria-disabled=true).

Noted but NOT fixed (deliberate scope, not a bug): every attribute-value
pattern in this file assumes double-quoted values only (`"[^"]*"`). HTML
permits single quotes too. Double-quotes are the dominant real-world/
tooling-enforced convention; fixing this would mean doubling nearly every
one of the 39 patterns rather than a narrow, isolated change -- flagged for
awareness, not attempted here.

Verification: strict test file (1502 passed), full default suite (2446
passed, 1 deselected, 1 xfailed, no regressions), ruff/mypy/dead-key audits
clean (3 pre-existing, non-deterministic mypy findings in untouched files
confirmed unrelated), golden_crucible via tests/tools/crucible_check.py:
real diff found (118 differences, confined to exactly 5 real .html files
across 3 different corpus repos), fixtures regenerated and re-verified
clean in both venvs.

Part of #518, closes #587. Pipeline bug filed separately as #733.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 gitgalaxy/standards/language_standards.py     |  67 +++-
 .../test_language_standards_strict.py         | 376 ++++++++++++++++++
 tests/golden_master_audit.json                | 240 +++++------
 tests/golden_master_zero_dep_audit.json       | 240 +++++------
 4 files changed, 675 insertions(+), 248 deletions(-)

diff --git a/gitgalaxy/standards/language_standards.py b/gitgalaxy/standards/language_standards.py
index 1e882191..e3b57ff7 100644
--- a/gitgalaxy/standards/language_standards.py
+++ b/gitgalaxy/standards/language_standards.py
@@ -4767,8 +4767,13 @@ class PrismConfigSchema(TypedDict):
             # --- PHASE 1: LOGIC TOPOLOGY & STRUCTURE ---
             # 1. branch (Control Flow / Branching)
             # User-driven branching and declarative framework conditionals.
+            # BUG FIX: `*ngIf` was inside the shared `\b(...)"[^"]*"` group.
+            # `*` is a non-word char always preceded by whitespace in real
+            # markup (`<div *ngIf="cond">`) -- a `\b` between two non-word
+            # characters can never fire, so Angular's structural directive
+            # never matched. Pulled out with no leading `\b` (self-delimiting).
             "branch": re.compile(
-                r'<(?:details|summary|noscript)\b|\b(?:v-if|ng-if|\*ngIf|x-if|hx-swap)="[^"]*"|\{%\s*(?:if|elif|else|endif)\s*[^%]*%\}|\{\{#if\s+[^}]+\}\}',
+                r'<(?:details|summary|noscript)\b|\b(?:v-if|ng-if|x-if|hx-swap)="[^"]*"|\*ngIf="[^"]*"|\{%\s*(?:if|elif|else|endif)\s*[^%]*%\}|\{\{#if\s+[^}]+\}\}',
                 re.I,
             ),
             # 2. args (Parameters / Coupling)
@@ -4794,8 +4799,16 @@ class PrismConfigSchema(TypedDict):
             # --- PHASE 2: RISK ENGINE (Structural Integrity & Debt) ---
             # 6. safety (Defensive Programming / Validation)
             # Browser security and validation constraints.
+            # BUG FIX: `pattern="..."`/`sandbox="..."`/`rel="noopener..."`/
+            # `integrity="..."` were inside the shared `\b(...)\b` group.
+            # Each ends on a literal `"`, and the char immediately after a
+            # closing attribute quote (a space or `>`) is also non-word --
+            # `\b` between two non-word characters can never fire, so all
+            # four never matched. Pulled out with no trailing `\b`
+            # (self-delimiting on the closing quote).
             "safety": re.compile(
-                r'\b(?:required|readonly|disabled|pattern="[^"]*"|sandbox="[^"]*"|rel="noopener(?: noreferrer)?"|integrity="[^"]*")\b|<meta\s+http-equiv="Content-Security-Policy"',
+                r'\b(?:required|readonly|disabled)\b|pattern="[^"]*"|sandbox="[^"]*"|rel="noopener(?: noreferrer)?"'
+                r'|integrity="[^"]*"|<meta\s+http-equiv="Content-Security-Policy"',
                 re.I,
             ),
             # 7. safety_neg (Safety Bypasses / Unchecked Types)
@@ -4839,8 +4852,13 @@ class PrismConfigSchema(TypedDict):
             # --- PHASE 3: ARCHITECTURE & DOMAIN SENSORS ---
             # 15. concurrency (Asynchronous Execution)
             # Prioritization and asynchronous fetching logic.
+            # BUG FIX: same trailing-`\b`-after-quote trap as `safety` above --
+            # `loading="lazy"`/`fetchpriority="..."`/`decoding="async"` all end
+            # on `"`, and the shared trailing `\b` can't fire against the
+            # non-word char that follows a closing attribute quote. Pulled out.
             "concurrency": re.compile(
-                r'\b(?:async|defer|loading="lazy"|fetchpriority="(?:high|low)"|decoding="async")\b|<link\s+rel="(?:preload|prefetch|preconnect|modulepreload|prerender)"',
+                r'\b(?:async|defer)\b|loading="lazy"|fetchpriority="(?:high|low)"|decoding="async"'
+                r'|<link\s+rel="(?:preload|prefetch|preconnect|modulepreload|prerender)"',
                 re.I,
             ),
             # 16. ui_framework (UI / View Components)
@@ -4860,16 +4878,30 @@ class PrismConfigSchema(TypedDict):
             "globals": None,
             # 19. decorators (Decorators / Annotations)
             # Directive-based logic mutation (HTMX, Vue, Alpine).
+            # BUG FIX: `hidden`/`inert` are true HTML boolean attributes,
+            # almost always written bare (`<div hidden>`) with no `=` at
+            # all -- the old pattern required `[ \t]*=` unconditionally
+            # after every alternative, so the dominant real-world form of
+            # these two never matched. Made the `=...` suffix optional only
+            # for hidden/inert; the rest (class/style/tabindex/etc.) always
+            # require an explicit value in real markup, so they keep the
+            # mandatory `=`.
             "decorators": re.compile(
-                r'\b(?:class|style|hidden|inert|tabindex|draggable|spellcheck|dir|lang|translate)[ \t]*=|hx-[a-z-]+="[^"]*"|x-[a-z-]+="[^"]*"|v-[a-z-]+="[^"]*"',
+                r"\b(?:hidden|inert)\b(?:[ \t]*=)?"
+                r"|\b(?:class|style|tabindex|draggable|spellcheck|dir|lang|translate)[ \t]*="
+                r'|hx-[a-z-]+="[^"]*"|x-[a-z-]+="[^"]*"|v-[a-z-]+="[^"]*"',
                 re.I,
             ),
             # 20. generics (Generics / Type Parameters)
             "generics": re.compile(r"<slot\b[^>]*>", re.I),
             # 21. comprehensions (Iterators / Comprehensions)
             # Declarative array iteration in markup.
+            # BUG FIX: same leading-`\b`-before-`*` trap as `branch` above --
+            # `*ngFor` is always preceded by whitespace in real markup, so
+            # the shared leading `\b` (boundary between two non-word chars)
+            # never fired. Pulled out with no leading `\b`.
             "comprehensions": re.compile(
-                r'\b(?:v-for|ng-repeat|\*ngFor|x-for)="[^"]*"|\{%\s*for\b[^%]*%\}|\{\{#each\b[^}]*\}\}',
+                r'\b(?:v-for|ng-repeat|x-for)="[^"]*"|\*ngFor="[^"]*"|\{%\s*for\b[^%]*%\}|\{\{#each\b[^}]*\}\}',
                 re.I,
             ),
             # 22. scientific (Numerical / Compute Libraries)
@@ -4880,7 +4912,15 @@ class PrismConfigSchema(TypedDict):
             ),
             # 23. heat_triggers (Metaprogramming & Reflection)
             # Extreme logic heat: heavy inline styles and JS pollution.
-            "reflection_metaprogramming": re.compile(r'style="[^"]*;"|\bon[a-z]+="[^"]*"', re.I),
+            # BUG FIX: `style="[^"]*;"` required a literal trailing `;`
+            # immediately before the closing quote. CSS allows omitting the
+            # last declaration's semicolon, and most real inline styles
+            # (hand-written or minified) don't carry one -- confirmed
+            # `style="color:red"` and `style="color:red;font-size:12px"`
+            # (multi-declaration, no trailing `;`) never matched under the
+            # old pattern. Dropped the semicolon requirement; presence of
+            # any inline style attribute is the actual intent here.
+            "reflection_metaprogramming": re.compile(r'style="[^"]*"|\bon[a-z]+="[^"]*"', re.I),
             # 24. import (Dependency Inclusions)
             "import": re.compile(
                 r'<script\s+type="(?:importmap|module)"|<link\s+(?:rel="stylesheet"|rev="[^"]*")',
@@ -4914,7 +4954,11 @@ class PrismConfigSchema(TypedDict):
                 re.I,
             ),
             # 33. dependency_injection (Dependency Injection / IoC)
-            "dependency_injection": re.compile(r'<script\s+type="importmap"\b', re.I),
+            # BUG FIX: trailing `\b` right after the closing `"` -- same
+            # shared-boundary trap as safety/concurrency above (the char
+            # after a closing attribute quote is never a word char), so
+            # this never matched at all. Self-delimiting on the quote.
+            "dependency_injection": re.compile(r'<script\s+type="importmap"', re.I),
             # 34. macros (Preprocessor Directives / Macros)
             # Server Side Includes (SSI).
             "macros": re.compile(r"<!--#\s*(?:include|exec|echo|config|if|else|endif)\b", re.I),
@@ -4949,7 +4993,14 @@ class PrismConfigSchema(TypedDict):
             # 44. sync_locks (Resource Management & Stability)
             "sync_locks": None,
             # 45. immutability_locks (Immutability Constraints)
-            "immutability_locks": re.compile(r'\b(?:readonly|disabled|inert|aria-disabled="true")\b', re.I),
+            # BUG FIX: `aria-disabled="true"` ended on `"`, inside the same
+            # shared trailing-`\b` trap as safety/concurrency above. It
+            # happened to still match in practice only because "disabled" is
+            # a substring of "aria-disabled" and self-heals via the bare
+            # `disabled` alternative (matching regardless of the actual
+            # true/false value, which was never the intent) -- pulled out so
+            # the match is for the right reason.
+            "immutability_locks": re.compile(r'\b(?:readonly|disabled|inert)\b|aria-disabled="true"', re.I),
             # 46. cleanup (Resource Cleanup / Teardown)
             "cleanup": re.compile(
                 r'\b(?:removeEventListener|clearInterval|clearTimeout|remove|innerHTML\s*=\s*[\'"][\'"])\s*\(',
diff --git a/tests/core_engine/test_language_standards_strict.py b/tests/core_engine/test_language_standards_strict.py
index 0f783a8c..ac589a63 100644
--- a/tests/core_engine/test_language_standards_strict.py
+++ b/tests/core_engine/test_language_standards_strict.py
@@ -8355,3 +8355,379 @@ def test_jcl_redos_immunity():
     # sanity: all still match their real positive cases after the sweep
     assert JCL_RULES["branch"].search("//         IF (STEP1.RC = 0) THEN")
     assert JCL_RULES["structural_boundaries"].search("//STEPLIB  DD DSN=SYS1.LINKLIB,DISP=SHR")
+
+
+# ==============================================================================
+# HTML: STRICT STRUCTURAL SIGNATURE COVERAGE (Issue #587, part of epic #518)
+# ==============================================================================
+# NOTE: html is currently tagged `lexical_family: "line_exclusive"`, which is
+# wrong (it should be `block_exclusive`) -- filed separately as issue #733,
+# not fixed here. Confirmed empirically that <!-- --> comments are NEVER
+# stripped from code_stream for html today; the whole raw file (comments
+# included) is what every rule below actually scans in a real run. Tests here
+# are written against that real behavior, not an idealized stripped-comment
+# one -- e.g. dead_code/macros search for the literal "<!--" prefix directly,
+# which only works because comments survive unstripped.
+HTML_RULES = LANGUAGE_DEFINITIONS["html"]["rules"]
+
+_HTML_SIMPLE_CASES = [
+    # (signature, positive snippet, text expected to NOT match / None to skip)
+    ("branch", '<div v-if="cond">', '<div class="x">'),
+    ("args", '<input data-foo="bar">', '<input type="text">'),
+    ("structural_boundaries", "<div>", "<not-a-real-boundary-tag>"),
+    ("func_start", "<script>", "<div>"),
+    ("class_start", "<form>", "<div>"),
+    ("safety", "<input required>", '<input type="text">'),
+    ("safety_bypasses", 'href="javascript:alert(1)"', 'href="https://example.com"'),
+    ("io", 'src="app.js"', "<div>plain text</div>"),
+    ("api", 'id="main"', "<div>"),
+    ("dead_code", '<!-- <div class="old"></div> -->', "<div>live content</div>"),
+    ("doc", "<title>Page Title</title>", "<div>Page Title</div>"),
+    ("test", 'data-testid="submit-btn"', 'id="submit-btn"'),
+    ("concurrency", "<script async>", "<script>"),
+    ("ui_framework", "<strong>bold</strong>", "<div>plain</div>"),
+    ("closures", '<template shadowrootmode="open">', "<template>"),
+    ("decorators", "<div hidden>", "<div>"),
+    ("generics", "<slot></slot>", "<div></div>"),
+    ("comprehensions", 'v-for="item in items"', "<div>"),
+    ("scientific", "<svg></svg>", "<div></div>"),
+    ("reflection_metaprogramming", 'onclick="doThing()"', "<div>"),
+    ("import", '<script type="module">', "<script>"),
+    ("ownership", '<meta name="author" content="Jane Doe">', '<meta name="viewport">'),
+    ("planned_debt", "<!-- TODO: fix this -->", "<!-- done -->"),
+    ("fragile_debt", "<!-- HACK: workaround -->", "<!-- clean -->"),
+    ("spec_exposure", "<!-- [SPEC-123] compliance tag -->", "<!-- just a note -->"),
+    ("ssr_boundaries", "<%= value %>", "<div></div>"),
+    ("events", 'hx-trigger="click"', "<div></div>"),
+    ("dependency_injection", '<script type="importmap">', "<script>"),
+    ("macros", '<!--#include file="header.html" -->', "<!-- regular comment -->"),
+    ("telemetry", '<script src="https://www.google-analytics.com/analytics.js">', '<script src="app.js">'),
+    ("debug_prints", "console.log('debug')", "logger.info('ok')"),
+    ("panics_and_aborts", "window.close()", "window.open()"),
+    ("thread_sleeps", "setTimeout(fn, 1000)", "requestAnimationFrame(fn)"),
+    ("immutability_locks", "<input readonly>", "<input>"),
+    ("cleanup", "clearTimeout(t)", "setTimeout(fn, 0)"),
+    ("encapsulation", "<template></template>", "<div></div>"),
+    ("listeners", "addEventListener('click', fn)", "<div>no listener here</div>"),
+    ("test_skip", "data-skip", "data-run"),
+]
+
+
+@pytest.mark.parametrize("signature,positive,negative", _HTML_SIMPLE_CASES)
+def test_html_signature_positive_and_negative(signature, positive, negative):
+    pattern = HTML_RULES[signature]
+    assert pattern is not None, f"html's {signature!r} rule is unexpectedly None"
+    assert pattern.search(positive), f"html {signature!r} failed to match its own documented positive case"
+    if negative is not None:
+        assert not pattern.search(negative), f"html {signature!r} incorrectly matched an excluded case: {negative!r}"
+
+
+def test_html_dependency_capture_extracts_src_and_href():
+    pattern = HTML_RULES["_dependency_capture"]
+    m = pattern.search('<script src="app.js"></script>')
+    assert m and m.group(1) == "app.js"
+    m2 = pattern.search('<link href="styles.css">')
+    assert m2 and m2.group(1) == "styles.css"
+
+
+def test_html_func_start_and_class_start_no_capture_group_expected():
+    # func_start/class_start don't capture a name in html (unlike many
+    # languages) -- they anchor on the tag keyword itself. Confirm the match
+    # span is the tag, and that they don't collide with each other.
+    func_start = HTML_RULES["func_start"]
+    class_start = HTML_RULES["class_start"]
+    assert func_start.search("<script>")
+    assert not class_start.search("<script>"), "func_start's <script>/<style> incorrectly matched by class_start"
+    assert class_start.search("<form>")
+    assert not func_start.search("<form>"), "class_start's tags incorrectly matched by func_start"
+
+
+def test_html_star_ngif_leading_boundary_regression():
+    """
+    Regression test for a real bug: `branch`'s `*ngIf` (Angular's structural
+    directive) was inside the shared `\\b(...)"[^"]*"` group. `*` is a
+    non-word character always preceded by whitespace in real markup
+    (`<div *ngIf="cond">`) -- a `\\b` between two non-word characters can
+    never fire, so `*ngIf` never matched at all. Same shape confirmed
+    separately for `comprehensions`' `*ngFor` below.
+    """
+    old_pattern = re.compile(
+        r'<(?:details|summary|noscript)\b|\b(?:v-if|ng-if|\*ngIf|x-if|hx-swap)="[^"]*"'
+        r"|\{%\s*(?:if|elif|else|endif)\s*[^%]*%\}|\{\{#if\s+[^}]+\}\}",
+        re.I,
+    )
+    realistic = '<div *ngIf="cond">'
+    assert not old_pattern.search(realistic), "sanity check: bug must reproduce against the old pattern"
+
+    branch = HTML_RULES["branch"]
+    assert branch.search(realistic), "*ngIf still didn't match"
+    assert branch.search('<div v-if="cond">'), "v-if form regressed"
+
+
+def test_html_star_ngfor_leading_boundary_regression():
+    old_pattern = re.compile(
+        r'\b(?:v-for|ng-repeat|\*ngFor|x-for)="[^"]*"|\{%\s*for\b[^%]*%\}|\{\{#each\b[^}]*\}\}',
+        re.I,
+    )
+    realistic = '<li *ngFor="let item of items">'
+    assert not old_pattern.search(realistic), "sanity check: bug must reproduce against the old pattern"
+
+    comprehensions = HTML_RULES["comprehensions"]
+    assert comprehensions.search(realistic), "*ngFor still didn't match"
+    assert comprehensions.search('<li v-for="item in items">'), "v-for form regressed"
+
+
+def test_html_safety_quoted_attribute_trailing_boundary_regression():
+    """
+    Regression test for a real bug: `pattern="..."`, `sandbox="..."`,
+    `rel="noopener..."`, and `integrity="..."` were all inside the shared
+    `\\b(...)\\b` group. Each ends on a literal `"`, and the character
+    immediately following a closing attribute quote (space or `>`) is also
+    non-word -- `\\b` between two non-word characters can never fire, so
+    none of the four quote-terminated alternatives ever matched; only the
+    bare-word alternatives (required/readonly/disabled) worked.
+    """
+    old_pattern = re.compile(
+        r'\b(?:required|readonly|disabled|pattern="[^"]*"|sandbox="[^"]*"|rel="noopener(?: noreferrer)?"'
+        r'|integrity="[^"]*")\b|<meta\s+http-equiv="Content-Security-Policy"',
+        re.I,
+    )
+    for snippet in (
+        '<input pattern="[0-9]+">',
+        '<iframe sandbox="allow-scripts">',
+        '<a rel="noopener">',
+        '<script integrity="sha384-abc">',
+    ):
+        assert not old_pattern.search(snippet), f"sanity check: bug must reproduce for {snippet!r}"
+
+    safety = HTML_RULES["safety"]
+    assert safety.search('<input pattern="[0-9]+">'), "pattern=... still didn't match"
+    assert safety.search('<iframe sandbox="allow-scripts">'), "sandbox=... still didn't match"
+    assert safety.search('<a rel="noopener">'), "rel=noopener still didn't match"
+    assert safety.search('<a rel="noopener noreferrer">'), "rel=noopener noreferrer still didn't match"
+    assert safety.search('<script integrity="sha384-abc">'), "integrity=... still didn't match"
+    assert safety.search("<input required>"), "bare-word required regressed"
+    assert not safety.search('<input type="text">'), "unrelated attribute incorrectly matched"
+
+
+def test_html_concurrency_quoted_attribute_trailing_boundary_regression():
+    """
+    Same shared-`\\b`-after-quote trap as safety, in `concurrency`.
+    `decoding="async"` happened to still match under the old pattern (a
+    coincidental self-heal: "async" is also a standalone earlier
+    alternative, and it appears as the *value* of decoding= too) -- but
+    `loading="lazy"` and `fetchpriority="high"/"low"` have no such rescue and
+    never matched at all.
+    """
+    old_pattern = re.compile(
+        r'\b(?:async|defer|loading="lazy"|fetchpriority="(?:high|low)"|decoding="async")\b'
+        r'|<link\s+rel="(?:preload|prefetch|preconnect|modulepreload|prerender)"',
+        re.I,
+    )
+    assert not old_pattern.search('<img loading="lazy">'), "sanity check: bug must reproduce for loading=lazy"
+    assert not old_pattern.search('<img fetchpriority="high">'), "sanity check: bug must reproduce for fetchpriority"
+    assert old_pattern.search('<img decoding="async">'), "sanity check: decoding=async self-heals on old pattern too"
+
+    concurrency = HTML_RULES["concurrency"]
+    assert concurrency.search('<img loading="lazy">'), "loading=lazy still didn't match"
+    assert concurrency.search('<img fetchpriority="high">'), "fetchpriority=high still didn't match"
+    assert concurrency.search('<img fetchpriority="low">'), "fetchpriority=low still didn't match"
+    assert concurrency.search("<script async>"), "bare-word async regressed"
+    assert concurrency.search("<script defer>"), "bare-word defer regressed"
+
+
+def test_html_decorators_bare_boolean_attribute_regression():
+    """
+    Regression test for a real bug: `hidden`/`inert` are true HTML boolean
+    attributes, almost always written bare (`<div hidden>`) with no `=` at
+    all -- the old pattern required `[ \\t]*=` unconditionally after every
+    alternative in the group, so the dominant real-world bare form of these
+    two never matched (only `hidden=""`/`hidden="until-found"` would have).
+    Found while writing this test's own positive case, not pre-derived.
+    """
+    old_pattern = re.compile(
+        r"\b(?:class|style|hidden|inert|tabindex|draggable|spellcheck|dir|lang|translate)[ \t]*="
+        r'|hx-[a-z-]+="[^"]*"|x-[a-z-]+="[^"]*"|v-[a-z-]+="[^"]*"',
+        re.I,
+    )
+    assert not old_pattern.search("<div hidden>"), "sanity check: bug must reproduce for bare hidden"
+    assert not old_pattern.search("<div inert>"), "sanity check: bug must reproduce for bare inert"
+
+    decorators = HTML_RULES["decorators"]
+    assert decorators.search("<div hidden>"), "bare hidden still didn't match"
+    assert decorators.search("<div inert>"), "bare inert still didn't match"
+    assert decorators.search('<div hidden="until-found">'), "explicit-value hidden form regressed"
+    assert decorators.search('<div class="x">'), "class=... (always requires a value) regressed"
+    assert not decorators.search("<div class>"), (
+        "bare class with no value incorrectly matched -- class always requires an explicit value in real markup"
+    )
+
+
+def test_html_dependency_injection_trailing_boundary_regression():
+    """
+    Regression test for a real bug: `<script\\s+type="importmap"\\b` had a
+    trailing `\\b` right after the closing `"`. The character following a
+    closing attribute quote (space or `>`) is non-word, same as `"` itself
+    -- `\\b` between two non-word characters can never fire, so this rule
+    never matched at all, regardless of input.
+    """
+    old_pattern = re.compile(r'<script\s+type="importmap"\b', re.I)
+    assert not old_pattern.search('<script type="importmap">'), "sanity check: bug must reproduce"
+    assert not old_pattern.search('<script type="importmap" src="x">'), "sanity check: bug must reproduce"
+
+    dependency_injection = HTML_RULES["dependency_injection"]
+    assert dependency_injection.search('<script type="importmap">'), "closing > form still didn't match"
+    assert dependency_injection.search('<script type="importmap" src="x">'), (
+        "trailing-attribute form still didn't match"
+    )
+
+
+def test_html_reflection_metaprogramming_style_semicolon_regression():
+    """
+    Regression test for a real bug: `style="[^"]*;"` required a literal
+    trailing semicolon immediately before the closing quote. CSS allows
+    omitting the last declaration's semicolon, and most real inline styles
+    don't carry one -- neither a single declaration nor a multi-declaration
+    style with no trailing `;` matched under the old pattern.
+    """
+    old_pattern = re.compile(r'style="[^"]*;"|\bon[a-z]+="[^"]*"', re.I)
+    assert not old_pattern.search('<div style="color:red">'), "sanity check: bug must reproduce (no trailing ;)"
+    assert not old_pattern.search('<div style="color:red;font-size:12px">'), (
+        "sanity check: bug must reproduce (multi-declaration, no trailing ;)"
+    )
+    assert old_pattern.search('<div style="color:red;">'), "sanity check: trailing-; form already worked"
+
+    reflection = HTML_RULES["reflection_metaprogramming"]
+    assert reflection.search('<div style="color:red">'), "no-trailing-semicolon style still didn't match"
+    assert reflection.search('<div style="color:red;font-size:12px">'), (
+        "multi-declaration no-trailing-semicolon style still didn't match"
+    )
+    assert reflection.search('<div style="color:red;">'), "trailing-semicolon form regressed"
+    assert reflection.search('<div onclick="doThing()">'), "on* event handler form regressed"
+
+
+def test_html_immutability_locks_aria_disabled_trailing_boundary_regression():
+    """
+    Same shared-`\\b`-after-quote trap as safety/concurrency, in
+    `immutability_locks`. `aria-disabled="true"` happened to still match
+    under the old pattern via an accidental self-heal ("disabled" is a
+    substring of "aria-disabled", and the bare `disabled` alternative's own
+    `\\b` fires correctly on that embedded substring) -- meaning it matched
+    regardless of whether the value was "true" or "false", which was never
+    the intent. Pulled the alternative out so the match is for the right
+    reason and confirm it still fires.
+    """
+    old_pattern = re.compile(r'\b(?:readonly|disabled|inert|aria-disabled="true")\b', re.I)
+    assert old_pattern.search('<button aria-disabled="true">'), (
+        "sanity check: old pattern self-heals via the embedded 'disabled' substring"
+    )
+
+    immutability_locks = HTML_RULES["immutability_locks"]
+    assert immutability_locks.search('<button aria-disabled="true">'), "aria-disabled=true still didn't match"
+    assert immutability_locks.search("<input readonly>"), "bare-word readonly regressed"
+
+
+def test_html_func_start_vs_macros_no_false_collision():
+    """
+    Known ambiguity pattern from the issue template (a run of macro/
+    preprocessor-shaped lines fooling func_start, as seen in C++). html's
+    func_start is scoped to `<script`/`<style` tags only; macros maps to
+    SSI directive comments (`<!--#include ...-->`) -- structurally distinct
+    token shapes (`<script`/`<style` vs `<!--#`), no realistic overlap.
+    """
+    func_start = HTML_RULES["func_start"]
+    macros = HTML_RULES["macros"]
+
+    ssi_directive = '<!--#include file="header.html" -->'
+    assert macros.search(ssi_directive)
+    assert not func_start.search(ssi_directive)
+
+    script_tag = "<script>"
+    assert func_start.search(script_tag)
+    assert not macros.search(script_tag)
+
+
+def test_html_func_start_vs_generics_no_false_collision():
+    """
+    Known ambiguity pattern from the issue template (deeply nested generic
+    return types triggering catastrophic backtracking against func_start,
+    as seen in C#). html's generics maps to `<slot>` tags; func_start maps
+    to `<script`/`<style` -- distinct tag names, no overlap, and neither
+    pattern has adjacent unbounded quantifiers for a nested-slot payload to
+    exploit.
+    """
+    func_start = HTML_RULES["func_start"]
+    generics = HTML_RULES["generics"]
+
+    slot_tag = '<slot name="header"></slot>'
+    assert generics.search(slot_tag)
+    assert not func_start.search(slot_tag)
+
+    assert_redos_immune(generics, "<slot " + 'a="b" ' * 20000, timeout_sec=3.0)
+
+
+def test_html_dead_code_and_macros_rely_on_unstripped_comments():
+    """
+    Documents the interaction with issue #733 (html's lexical_family is
+    mistagged, so <!-- --> comments are never actually stripped from
+    code_stream -- confirmed via direct Prism.split_streams() execution).
+    dead_code and macros both search for the literal "<!--" prefix directly
+    against raw text, which is why they still function correctly today
+    despite that pipeline bug -- they were evidently authored already
+    assuming comments survive unstripped, not against an idealized
+    stripped-comment code_stream. This test exists to make that dependency
+    explicit rather than leaving it implicit.
+    """
+    dead_code = HTML_RULES["dead_code"]
+    assert dead_code.search('<!-- <div class="old-widget"></div> -->')
+    assert dead_code.search("<!--<script>legacy()</script>-->")
+    assert not dead_code.search("<div>this is live, uncommented code</div>")
+
+    macros = HTML_RULES["macros"]
+    assert macros.search('<!--#include file="header.html" -->')
+    assert not macros.search("<!-- a normal, non-SSI comment -->")
+
+
+def test_html_lexical_family_no_block_terminator_state_to_confuse():
+    """
+    Lexical-family audit (Rule per how_to_add_a_language.md): none of
+    html's rules track open/close comment-block state themselves -- every
+    keyword-presence rule matches via flat scanning. Confirms a stray
+    closing `-->` with no matching opener doesn't fool any rule into a
+    false structural match.
+    """
+    branch = HTML_RULES["branch"]
+    stray_close = 'some text --> <div v-if="cond">'
+    assert branch.search(stray_close), "branch should still see v-if regardless of the stray --> before it"
+
+
+def test_html_redos_immunity_sweep():
+    """
+    ReDoS immunity sweep across html's unbounded-quantifier rules (mostly
+    `[^"]*"`-delimited attribute values, each a single quantifier bounded
+    by its own closing delimiter with no adjacent overlapping-charset
+    quantifier to backtrack against). Verified via a systematic scaling
+    sweep before writing this test (payload shapes: unterminated quotes,
+    parens, angle brackets, template braces, hyphen-chains, dotted calls,
+    at n=2000/8000/32000) -- nothing in html's rules exceeded 0.5s at
+    n=32000 against any shape, confirming linear behavior throughout. This
+    test locks that in with assert_redos_immune's subprocess-kill timeout.
+    """
+    assert_redos_immune(HTML_RULES["args"], '<input data-foo="' + "a" * 100000, timeout_sec=3.0)
+    assert_redos_immune(HTML_RULES["safety"], '<input pattern="' + "a" * 100000, timeout_sec=3.0)
+    assert_redos_immune(HTML_RULES["io"], 'src="' + "a" * 100000, timeout_sec=3.0)
+    assert_redos_immune(HTML_RULES["api"], 'id="' + "a" * 100000, timeout_sec=3.0)
+    assert_redos_immune(HTML_RULES["ui_framework"], 'class="' + "a" * 100000, timeout_sec=3.0)
+    assert_redos_immune(HTML_RULES["decorators"], 'hx-foo="' + "a" * 100000, timeout_sec=3.0)
+    assert_redos_immune(HTML_RULES["comprehensions"], "{% for " + "a" * 100000, timeout_sec=3.0)
+    assert_redos_immune(HTML_RULES["scientific"], 'd="' + "M" * 100000, timeout_sec=3.0)
+    assert_redos_immune(HTML_RULES["reflection_metaprogramming"], 'style="' + "a" * 100000, timeout_sec=3.0)
+    assert_redos_immune(HTML_RULES["ssr_boundaries"], "{{ " + "a" * 100000, timeout_sec=3.0)
+    assert_redos_immune(HTML_RULES["events"], '@click="' + "a" * 100000, timeout_sec=3.0)
+    assert_redos_immune(HTML_RULES["spec_exposure"], "[SPEC-123 " + "a" * 100000, timeout_sec=3.0)
+    assert_redos_immune(HTML_RULES["class_start"], "<" + ("a-" * 20000), timeout_sec=3.0)
+    assert_redos_immune(HTML_RULES["_dependency_capture"], "<script " + "a" * 100000, timeout_sec=3.0)
+
+    # sanity: all still match their real positive cases after the sweep
+    assert HTML_RULES["args"].search('<input data-foo="bar">')
+    assert HTML_RULES["safety"].search("<input required>")
diff --git a/tests/golden_master_audit.json b/tests/golden_master_audit.json
index 8885b8b8..745c45ea 100644
--- a/tests/golden_master_audit.json
+++ b/tests/golden_master_audit.json
@@ -12,8 +12,8 @@
             },
             "Target Root Name": "data",
             "Absolute Project Path": "/home/joe/nyx_projects/language-crucible/data",
-            "Analysis ISO Timestamp": "2026-07-29T01:29:06.121501+00:00",
-            "Total Scan Duration": "25.27 seconds"
+            "Analysis ISO Timestamp": "2026-07-29T02:40:34.453045+00:00",
+            "Total Scan Duration": "23.83 seconds"
         },
         "Source Control Footprint (Immutable Anchor)": {
             "Active Branch": "main",
@@ -196,7 +196,7 @@
             }
         },
         "health": {
-            "avg_cognitive_load": 23.496,
+            "avg_cognitive_load": 23.539,
             "avg_safety_score": 23.301,
             "avg_tech_debt": 25.419,
             "avg_documentation": 28.636
@@ -1664,7 +1664,7 @@
                 "file_count": 3,
                 "total_mass": 5.62,
                 "avg_exposures": {
-                    "cognitive_load": 2.45,
+                    "cognitive_load": 4.66,
                     "safety_score": 0.0,
                     "tech_debt": 0.0,
                     "verification": 1.53,
@@ -1740,7 +1740,7 @@
                 "total_mass": 17.25,
                 "avg_exposures": {
                     "cognitive_load": 0.0,
-                    "safety_score": 1.8,
+                    "safety_score": 1.72,
                     "tech_debt": 0.0,
                     "verification": 1.15,
                     "api_exposure": 6.74,
@@ -1764,7 +1764,7 @@
                 "file_count": 4,
                 "total_mass": 7.76,
                 "avg_exposures": {
-                    "cognitive_load": 6.27,
+                    "cognitive_load": 14.64,
                     "safety_score": 0.0,
                     "tech_debt": 0.0,
                     "verification": 1.68,
@@ -289506,7 +289506,7 @@
             },
             "Average Risk Exposures": {
                 "Cognitive Load Exposure": "0.0%",
-                "Error & Exception Exposure": "1.8%",
+                "Error & Exception Exposure": "1.72%",
                 "Tech Debt Exposure": "0.0%",
                 "Testing Exposure": "1.15%",
                 "API Exposure": "6.74%",
@@ -289705,26 +289705,26 @@
                     },
                     "3. Architectural Profile": {
                         "Repository Archetype": "file_cluster_0",
-                        "Repository Drift (Z-Score)": 9.273,
+                        "Repository Drift (Z-Score)": 9.361,
                         "Repository Fingerprint": {
-                            "file_cluster_0": 9.273,
-                            "file_cluster_1": 10.66,
-                            "file_cluster_2": 10.081,
-                            "file_cluster_3": 11.996,
-                            "file_cluster_4": 10.894,
-                            "file_cluster_5": 11.271,
-                            "file_cluster_6": 11.084,
-                            "file_cluster_7": 10.418,
-                            "file_cluster_8": 9.77,
-                            "file_cluster_9": 10.858,
-                            "file_cluster_10": 12.126,
-                            "file_cluster_11": 11.076,
-                            "file_cluster_12": 11.394,
-                            "file_cluster_13": 10.343,
-                            "file_cluster_14": 14.441,
-                            "file_cluster_15": 11.614,
-                            "file_cluster_16": 10.933,
-                            "file_cluster_17": 10.418
+                            "file_cluster_0": 9.361,
+                            "file_cluster_1": 10.755,
+                            "file_cluster_2": 10.176,
+                            "file_cluster_3": 12.066,
+                            "file_cluster_4": 10.976,
+                            "file_cluster_5": 11.359,
+                            "file_cluster_6": 11.162,
+                            "file_cluster_7": 10.514,
+                            "file_cluster_8": 9.87,
+                            "file_cluster_9": 10.936,
+                            "file_cluster_10": 12.196,
+                            "file_cluster_11": 11.13,
+                            "file_cluster_12": 11.371,
+                            "file_cluster_13": 10.428,
+                            "file_cluster_14": 14.501,
+                            "file_cluster_15": 11.689,
+                            "file_cluster_16": 11.019,
+                            "file_cluster_17": 10.499
                         },
                         "File Archetype": null,
                         "File Drift (Z-Score)": 0.0,
@@ -289742,7 +289742,7 @@
                     },
                     "4. Vulnerability & Risk Exposures": {
                         "Cognitive Load Exposure": "0.0%",
-                        "Error & Exception Exposure": "3.6%",
+                        "Error & Exception Exposure": "3.44%",
                         "Tech Debt Exposure": "0.0%",
                         "Testing Exposure": "2.3%",
                         "API Exposure": "13.49%",
@@ -289769,7 +289769,7 @@
                         "Function Parameters": 70,
                         "Function/Method Declarations": 0,
                         "Class/Entity Declarations": 7,
-                        "Defensive Programming Constructs": 23,
+                        "Defensive Programming Constructs": 25,
                         "Type/Safety Bypasses": 1,
                         "High-Risk Execution Commands": 0,
                         "I/O and Network Boundaries": 28,
@@ -289782,11 +289782,11 @@
                         "UI / View Layer Components": 25,
                         "Closures and Anonymous Functions": 0,
                         "Global State Dependencies": 0,
-                        "Decorators and Annotations": 135,
+                        "Decorators and Annotations": 136,
                         "Generic Type Abstractions": 0,
                         "Collection Iterators / Comprehensions": 0,
                         "Scientific & Mathematical Operations": 0,
-                        "Metaprogramming & Reflection": 0,
+                        "Metaprogramming & Reflection": 1,
                         "Module Dependencies (Imports)": 2,
                         "Authorship Metadata": 0,
                         "Planned Work (TODOs)": 0,
@@ -294001,7 +294001,7 @@
                 "Static: Literature & Documentation": "25.0%"
             },
             "Average Risk Exposures": {
-                "Cognitive Load Exposure": "6.27%",
+                "Cognitive Load Exposure": "14.64%",
                 "Error & Exception Exposure": "0.0%",
                 "Tech Debt Exposure": "0.0%",
                 "Testing Exposure": "1.68%",
@@ -294201,26 +294201,26 @@
                     },
                     "3. Architectural Profile": {
                         "Repository Archetype": "file_cluster_8",
-                        "Repository Drift (Z-Score)": 6.452,
+                        "Repository Drift (Z-Score)": 6.666,
                         "Repository Fingerprint": {
-                            "file_cluster_0": 7.365,
-                            "file_cluster_1": 7.852,
-                            "file_cluster_2": 6.969,
-                            "file_cluster_3": 9.969,
-                            "file_cluster_4": 8.94,
-                            "file_cluster_5": 8.949,
-                            "file_cluster_6": 9.083,
-                            "file_cluster_7": 7.77,
-                            "file_cluster_8": 6.452,
-                            "file_cluster_9": 8.843,
-                            "file_cluster_10": 10.167,
-                            "file_cluster_11": 9.312,
-                            "file_cluster_12": 9.171,
-                            "file_cluster_13": 8.281,
-                            "file_cluster_14": 12.845,
-                            "file_cluster_15": 9.563,
-                            "file_cluster_16": 8.611,
-                            "file_cluster_17": 8.209
+                            "file_cluster_0": 7.529,
+                            "file_cluster_1": 8.029,
+                            "file_cluster_2": 7.16,
+                            "file_cluster_3": 10.049,
+                            "file_cluster_4": 9.095,
+                            "file_cluster_5": 9.098,
+                            "file_cluster_6": 9.212,
+                            "file_cluster_7": 7.949,
+                            "file_cluster_8": 6.666,
+                            "file_cluster_9": 8.985,
+                            "file_cluster_10": 10.235,
+                            "file_cluster_11": 9.282,
+                            "file_cluster_12": 8.515,
+                            "file_cluster_13": 8.421,
+                            "file_cluster_14": 12.954,
+                            "file_cluster_15": 9.65,
+                            "file_cluster_16": 8.753,
+                            "file_cluster_17": 8.374
                         },
                         "File Archetype": null,
                         "File Drift (Z-Score)": 0.0,
@@ -294234,10 +294234,10 @@
                         "Raw Churn Frequency": 0.0,
                         "Authorship Centralization": 0.0,
                         "Ownership Entropy": 0.0,
-                        "Raw Cognitive Density": 0.217
+                        "Raw Cognitive Density": 0.435
                     },
                     "4. Vulnerability & Risk Exposures": {
-                        "Cognitive Load Exposure": "10.62%",
+                        "Cognitive Load Exposure": "22.08%",
                         "Error & Exception Exposure": "0.0%",
                         "Tech Debt Exposure": "0.0%",
                         "Testing Exposure": "2.3%",
@@ -294282,7 +294282,7 @@
                         "Generic Type Abstractions": 0,
                         "Collection Iterators / Comprehensions": 0,
                         "Scientific & Mathematical Operations": 0,
-                        "Metaprogramming & Reflection": 0,
+                        "Metaprogramming & Reflection": 1,
                         "Module Dependencies (Imports)": 0,
                         "Authorship Metadata": 0,
                         "Planned Work (TODOs)": 0,
@@ -294381,26 +294381,26 @@
                     },
                     "3. Architectural Profile": {
                         "Repository Archetype": "file_cluster_8",
-                        "Repository Drift (Z-Score)": 6.272,
+                        "Repository Drift (Z-Score)": 6.613,
                         "Repository Fingerprint": {
-                            "file_cluster_0": 7.207,
-                            "file_cluster_1": 7.705,
-                            "file_cluster_2": 6.745,
-                            "file_cluster_3": 9.851,
-                            "file_cluster_4": 8.801,
-                            "file_cluster_5": 8.819,
-                            "file_cluster_6": 8.952,
-                            "file_cluster_7": 7.621,
-                            "file_cluster_8": 6.272,
-                            "file_cluster_9": 8.707,
-                            "file_cluster_10": 10.048,
-                            "file_cluster_11": 9.177,
-                            "file_cluster_12": 9.04,
-                            "file_cluster_13": 8.127,
-                            "file_cluster_14": 12.734,
-                            "file_cluster_15": 9.436,
-                            "file_cluster_16": 8.475,
-                            "file_cluster_17": 8.038
+                            "file_cluster_0": 7.475,
+                            "file_cluster_1": 7.985,
+                            "file_cluster_2": 7.053,
+                            "file_cluster_3": 9.995,
+                            "file_cluster_4": 9.047,
+                            "file_cluster_5": 9.056,
+                            "file_cluster_6": 9.164,
+                            "file_cluster_7": 7.904,
+                            "file_cluster_8": 6.613,
+                            "file_cluster_9": 8.936,
+                            "file_cluster_10": 10.177,
+                            "file_cluster_11": 9.187,
+                            "file_cluster_12": 8.252,
+                            "file_cluster_13": 8.357,
+                            "file_cluster_14": 12.906,
+                            "file_cluster_15": 9.593,
+                            "file_cluster_16": 8.705,
+                            "file_cluster_17": 8.302
                         },
                         "File Archetype": null,
                         "File Drift (Z-Score)": 0.0,
@@ -294414,7 +294414,7 @@
                         "Raw Churn Frequency": 0.0,
                         "Authorship Centralization": 0.0,
                         "Ownership Entropy": 0.0,
-                        "Raw Cognitive Density": 0.357
+                        "Raw Cognitive Density": 0.429
                     },
                     "4. Vulnerability & Risk Exposures": {
                         "Cognitive Load Exposure": "5.0%",
@@ -294462,7 +294462,7 @@
                         "Generic Type Abstractions": 0,
                         "Collection Iterators / Comprehensions": 0,
                         "Scientific & Mathematical Operations": 0,
-                        "Metaprogramming & Reflection": 0,
+                        "Metaprogramming & Reflection": 1,
                         "Module Dependencies (Imports)": 0,
                         "Authorship Metadata": 0,
                         "Planned Work (TODOs)": 0,
@@ -294561,26 +294561,26 @@
                     },
                     "3. Architectural Profile": {
                         "Repository Archetype": "file_cluster_8",
-                        "Repository Drift (Z-Score)": 6.351,
+                        "Repository Drift (Z-Score)": 6.769,
                         "Repository Fingerprint": {
-                            "file_cluster_0": 7.28,
-                            "file_cluster_1": 7.769,
-                            "file_cluster_2": 6.975,
-                            "file_cluster_3": 9.91,
-                            "file_cluster_4": 8.885,
-                            "file_cluster_5": 8.878,
-                            "file_cluster_6": 9.018,
-                            "file_cluster_7": 7.688,
-                            "file_cluster_8": 6.351,
-                            "file_cluster_9": 8.779,
-                            "file_cluster_10": 10.113,
-                            "file_cluster_11": 9.262,
-                            "file_cluster_12": 9.108,
-                            "file_cluster_13": 8.228,
-                            "file_cluster_14": 12.832,
-                            "file_cluster_15": 9.506,
-                            "file_cluster_16": 8.54,
-                            "file_cluster_17": 8.182
+                            "file_cluster_0": 7.543,
+                            "file_cluster_1": 8.115,
+                            "file_cluster_2": 7.346,
+                            "file_cluster_3": 10.103,
+                            "file_cluster_4": 9.174,
+                            "file_cluster_5": 9.171,
+                            "file_cluster_6": 9.284,
+                            "file_cluster_7": 8.037,
+                            "file_cluster_8": 6.769,
+                            "file_cluster_9": 9.065,
+                            "file_cluster_10": 10.29,
+                            "file_cluster_11": 9.31,
+                            "file_cluster_12": 8.373,
+                            "file_cluster_13": 8.511,
+                            "file_cluster_14": 13.044,
+                            "file_cluster_15": 9.713,
+                            "file_cluster_16": 8.829,
+                            "file_cluster_17": 8.499
                         },
                         "File Archetype": null,
                         "File Drift (Z-Score)": 0.0,
@@ -294594,10 +294594,10 @@
                         "Raw Churn Frequency": 0.0,
                         "Authorship Centralization": 0.0,
                         "Ownership Entropy": 0.0,
-                        "Raw Cognitive Density": 0.185
+                        "Raw Cognitive Density": 0.556
                     },
                     "4. Vulnerability & Risk Exposures": {
-                        "Cognitive Load Exposure": "9.46%",
+                        "Cognitive Load Exposure": "31.48%",
                         "Error & Exception Exposure": "0.0%",
                         "Tech Debt Exposure": "0.0%",
                         "Testing Exposure": "2.3%",
@@ -294638,11 +294638,11 @@
                         "UI / View Layer Components": 3,
                         "Closures and Anonymous Functions": 0,
                         "Global State Dependencies": 0,
-                        "Decorators and Annotations": 6,
+                        "Decorators and Annotations": 7,
                         "Generic Type Abstractions": 0,
                         "Collection Iterators / Comprehensions": 0,
                         "Scientific & Mathematical Operations": 0,
-                        "Metaprogramming & Reflection": 0,
+                        "Metaprogramming & Reflection": 2,
                         "Module Dependencies (Imports)": 0,
                         "Authorship Metadata": 0,
                         "Planned Work (TODOs)": 0,
@@ -294924,7 +294924,7 @@
                 "Static: Literature & Documentation": "33.3%"
             },
             "Average Risk Exposures": {
-                "Cognitive Load Exposure": "2.45%",
+                "Cognitive Load Exposure": "4.66%",
                 "Error & Exception Exposure": "0.0%",
                 "Tech Debt Exposure": "0.0%",
                 "Testing Exposure": "1.53%",
@@ -295304,26 +295304,26 @@
                     },
                     "3. Architectural Profile": {
                         "Repository Archetype": "file_cluster_8",
-                        "Repository Drift (Z-Score)": 7.321,
+                        "Repository Drift (Z-Score)": 7.483,
                         "Repository Fingerprint": {
-                            "file_cluster_0": 7.916,
-                            "file_cluster_1": 8.259,
-                            "file_cluster_2": 8.902,
-                            "file_cluster_3": 10.184,
-                            "file_cluster_4": 9.233,
-                            "file_cluster_5": 8.782,
-                            "file_cluster_6": 9.192,
-                            "file_cluster_7": 7.974,
-                            "file_cluster_8": 7.321,
-                            "file_cluster_9": 9.099,
-                            "file_cluster_10": 10.234,
-                            "file_cluster_11": 9.501,
-                            "file_cluster_12": 9.346,
-                            "file_cluster_13": 8.753,
-                            "file_cluster_14": 13.736,
-                            "file_cluster_15": 9.617,
-                            "file_cluster_16": 8.795,
-                            "file_cluster_17": 9.308
+                            "file_cluster_0": 8.045,
+                            "file_cluster_1": 8.403,
+                            "file_cluster_2": 9.03,
+                            "file_cluster_3": 10.246,
+                            "file_cluster_4": 9.361,
+                            "file_cluster_5": 8.91,
+                            "file_cluster_6": 9.3,
+                            "file_cluster_7": 8.123,
+                            "file_cluster_8": 7.483,
+                            "file_cluster_9": 9.215,
+                            "file_cluster_10": 10.286,
+                            "file_cluster_11": 9.464,
+                            "file_cluster_12": 8.743,
+                            "file_cluster_13": 8.864,
+                            "file_cluster_14": 13.823,
+                            "file_cluster_15": 9.687,
+                            "file_cluster_16": 8.912,
+                            "file_cluster_17": 9.433
                         },
                         "File Archetype": null,
                         "File Drift (Z-Score)": 0.0,
@@ -295337,10 +295337,10 @@
                         "Raw Churn Frequency": 0.0,
                         "Authorship Centralization": 0.0,
                         "Ownership Entropy": 0.0,
-                        "Raw Cognitive Density": 0.185
+                        "Raw Cognitive Density": 0.37
                     },
                     "4. Vulnerability & Risk Exposures": {
-                        "Cognitive Load Exposure": "7.35%",
+                        "Cognitive Load Exposure": "13.98%",
                         "Error & Exception Exposure": "0.0%",
                         "Tech Debt Exposure": "0.0%",
                         "Testing Exposure": "2.3%",
@@ -295385,7 +295385,7 @@
                         "Generic Type Abstractions": 0,
                         "Collection Iterators / Comprehensions": 0,
                         "Scientific & Mathematical Operations": 0,
-                        "Metaprogramming & Reflection": 0,
+                        "Metaprogramming & Reflection": 1,
                         "Module Dependencies (Imports)": 0,
                         "Authorship Metadata": 0,
                         "Planned Work (TODOs)": 0,
diff --git a/tests/golden_master_zero_dep_audit.json b/tests/golden_master_zero_dep_audit.json
index 7aac62e4..a9656e9e 100644
--- a/tests/golden_master_zero_dep_audit.json
+++ b/tests/golden_master_zero_dep_audit.json
@@ -12,8 +12,8 @@
             },
             "Target Root Name": "data",
             "Absolute Project Path": "/home/joe/nyx_projects/language-crucible/data",
-            "Analysis ISO Timestamp": "2026-07-29T01:29:38.552228+00:00",
-            "Total Scan Duration": "23.59 seconds"
+            "Analysis ISO Timestamp": "2026-07-29T02:41:03.794482+00:00",
+            "Total Scan Duration": "22.26 seconds"
         },
         "Source Control Footprint (Immutable Anchor)": {
             "Active Branch": "main",
@@ -196,7 +196,7 @@
             }
         },
         "health": {
-            "avg_cognitive_load": 23.496,
+            "avg_cognitive_load": 23.539,
             "avg_safety_score": 23.301,
             "avg_tech_debt": 25.419,
             "avg_documentation": 28.636
@@ -1664,7 +1664,7 @@
                 "file_count": 3,
                 "total_mass": 5.62,
                 "avg_exposures": {
-                    "cognitive_load": 2.45,
+                    "cognitive_load": 4.66,
                     "safety_score": 0.0,
                     "tech_debt": 0.0,
                     "verification": 1.53,
@@ -1740,7 +1740,7 @@
                 "total_mass": 17.25,
                 "avg_exposures": {
                     "cognitive_load": 0.0,
-                    "safety_score": 1.8,
+                    "safety_score": 1.72,
                     "tech_debt": 0.0,
                     "verification": 1.15,
                     "api_exposure": 6.74,
@@ -1764,7 +1764,7 @@
                 "file_count": 4,
                 "total_mass": 7.76,
                 "avg_exposures": {
-                    "cognitive_load": 6.27,
+                    "cognitive_load": 14.64,
                     "safety_score": 0.0,
                     "tech_debt": 0.0,
                     "verification": 1.68,
@@ -289506,7 +289506,7 @@
             },
             "Average Risk Exposures": {
                 "Cognitive Load Exposure": "0.0%",
-                "Error & Exception Exposure": "1.8%",
+                "Error & Exception Exposure": "1.72%",
                 "Tech Debt Exposure": "0.0%",
                 "Testing Exposure": "1.15%",
                 "API Exposure": "6.74%",
@@ -289705,26 +289705,26 @@
                     },
                     "3. Architectural Profile": {
                         "Repository Archetype": "file_cluster_0",
-                        "Repository Drift (Z-Score)": 9.273,
+                        "Repository Drift (Z-Score)": 9.361,
                         "Repository Fingerprint": {
-                            "file_cluster_0": 9.273,
-                            "file_cluster_1": 10.66,
-                            "file_cluster_2": 10.081,
-                            "file_cluster_3": 11.996,
-                            "file_cluster_4": 10.894,
-                            "file_cluster_5": 11.271,
-                            "file_cluster_6": 11.084,
-                            "file_cluster_7": 10.418,
-                            "file_cluster_8": 9.77,
-                            "file_cluster_9": 10.858,
-                            "file_cluster_10": 12.126,
-                            "file_cluster_11": 11.076,
-                            "file_cluster_12": 11.394,
-                            "file_cluster_13": 10.343,
-                            "file_cluster_14": 14.441,
-                            "file_cluster_15": 11.614,
-                            "file_cluster_16": 10.933,
-                            "file_cluster_17": 10.418
+                            "file_cluster_0": 9.361,
+                            "file_cluster_1": 10.755,
+                            "file_cluster_2": 10.176,
+                            "file_cluster_3": 12.066,
+                            "file_cluster_4": 10.976,
+                            "file_cluster_5": 11.359,
+                            "file_cluster_6": 11.162,
+                            "file_cluster_7": 10.514,
+                            "file_cluster_8": 9.87,
+                            "file_cluster_9": 10.936,
+                            "file_cluster_10": 12.196,
+                            "file_cluster_11": 11.13,
+                            "file_cluster_12": 11.371,
+                            "file_cluster_13": 10.428,
+                            "file_cluster_14": 14.501,
+                            "file_cluster_15": 11.689,
+                            "file_cluster_16": 11.019,
+                            "file_cluster_17": 10.499
                         },
                         "File Archetype": null,
                         "File Drift (Z-Score)": 0.0,
@@ -289742,7 +289742,7 @@
                     },
                     "4. Vulnerability & Risk Exposures": {
                         "Cognitive Load Exposure": "0.0%",
-                        "Error & Exception Exposure": "3.6%",
+                        "Error & Exception Exposure": "3.44%",
                         "Tech Debt Exposure": "0.0%",
                         "Testing Exposure": "2.3%",
                         "API Exposure": "13.49%",
@@ -289769,7 +289769,7 @@
                         "Function Parameters": 70,
                         "Function/Method Declarations": 0,
                         "Class/Entity Declarations": 7,
-                        "Defensive Programming Constructs": 23,
+                        "Defensive Programming Constructs": 25,
                         "Type/Safety Bypasses": 1,
                         "High-Risk Execution Commands": 0,
                         "I/O and Network Boundaries": 28,
@@ -289782,11 +289782,11 @@
                         "UI / View Layer Components": 25,
                         "Closures and Anonymous Functions": 0,
                         "Global State Dependencies": 0,
-                        "Decorators and Annotations": 135,
+                        "Decorators and Annotations": 136,
                         "Generic Type Abstractions": 0,
                         "Collection Iterators / Comprehensions": 0,
                         "Scientific & Mathematical Operations": 0,
-                        "Metaprogramming & Reflection": 0,
+                        "Metaprogramming & Reflection": 1,
                         "Module Dependencies (Imports)": 2,
                         "Authorship Metadata": 0,
                         "Planned Work (TODOs)": 0,
@@ -294001,7 +294001,7 @@
                 "Static: Literature & Documentation": "25.0%"
             },
             "Average Risk Exposures": {
-                "Cognitive Load Exposure": "6.27%",
+                "Cognitive Load Exposure": "14.64%",
                 "Error & Exception Exposure": "0.0%",
                 "Tech Debt Exposure": "0.0%",
                 "Testing Exposure": "1.68%",
@@ -294201,26 +294201,26 @@
                     },
                     "3. Architectural Profile": {
                         "Repository Archetype": "file_cluster_8",
-                        "Repository Drift (Z-Score)": 6.452,
+                        "Repository Drift (Z-Score)": 6.666,
                         "Repository Fingerprint": {
-                            "file_cluster_0": 7.365,
-                            "file_cluster_1": 7.852,
-                            "file_cluster_2": 6.969,
-                            "file_cluster_3": 9.969,
-                            "file_cluster_4": 8.94,
-                            "file_cluster_5": 8.949,
-                            "file_cluster_6": 9.083,
-                            "file_cluster_7": 7.77,
-                            "file_cluster_8": 6.452,
-                            "file_cluster_9": 8.843,
-                            "file_cluster_10": 10.167,
-                            "file_cluster_11": 9.312,
-                            "file_cluster_12": 9.171,
-                            "file_cluster_13": 8.281,
-                            "file_cluster_14": 12.845,
-                            "file_cluster_15": 9.563,
-                            "file_cluster_16": 8.611,
-                            "file_cluster_17": 8.209
+                            "file_cluster_0": 7.529,
+                            "file_cluster_1": 8.029,
+                            "file_cluster_2": 7.16,
+                            "file_cluster_3": 10.049,
+                            "file_cluster_4": 9.095,
+                            "file_cluster_5": 9.098,
+                            "file_cluster_6": 9.212,
+                            "file_cluster_7": 7.949,
+                            "file_cluster_8": 6.666,
+                            "file_cluster_9": 8.985,
+                            "file_cluster_10": 10.235,
+                            "file_cluster_11": 9.282,
+                            "file_cluster_12": 8.515,
+                            "file_cluster_13": 8.421,
+                            "file_cluster_14": 12.954,
+                            "file_cluster_15": 9.65,
+                            "file_cluster_16": 8.753,
+                            "file_cluster_17": 8.374
                         },
                         "File Archetype": null,
                         "File Drift (Z-Score)": 0.0,
@@ -294234,10 +294234,10 @@
                         "Raw Churn Frequency": 0.0,
                         "Authorship Centralization": 0.0,
                         "Ownership Entropy": 0.0,
-                        "Raw Cognitive Density": 0.217
+                        "Raw Cognitive Density": 0.435
                     },
                     "4. Vulnerability & Risk Exposures": {
-                        "Cognitive Load Exposure": "10.62%",
+                        "Cognitive Load Exposure": "22.08%",
                         "Error & Exception Exposure": "0.0%",
                         "Tech Debt Exposure": "0.0%",
                         "Testing Exposure": "2.3%",
@@ -294282,7 +294282,7 @@
                         "Generic Type Abstractions": 0,
                         "Collection Iterators / Comprehensions": 0,
                         "Scientific & Mathematical Operations": 0,
-                        "Metaprogramming & Reflection": 0,
+                        "Metaprogramming & Reflection": 1,
                         "Module Dependencies (Imports)": 0,
                         "Authorship Metadata": 0,
                         "Planned Work (TODOs)": 0,
@@ -294381,26 +294381,26 @@
                     },
                     "3. Architectural Profile": {
                         "Repository Archetype": "file_cluster_8",
-                        "Repository Drift (Z-Score)": 6.272,
+                        "Repository Drift (Z-Score)": 6.613,
                         "Repository Fingerprint": {
-                            "file_cluster_0": 7.207,
-                            "file_cluster_1": 7.705,
-                            "file_cluster_2": 6.745,
-                            "file_cluster_3": 9.851,
-                            "file_cluster_4": 8.801,
-                            "file_cluster_5": 8.819,
-                            "file_cluster_6": 8.952,
-                            "file_cluster_7": 7.621,
-                            "file_cluster_8": 6.272,
-                            "file_cluster_9": 8.707,
-                            "file_cluster_10": 10.048,
-                            "file_cluster_11": 9.177,
-                            "file_cluster_12": 9.04,
-                            "file_cluster_13": 8.127,
-                            "file_cluster_14": 12.734,
-                            "file_cluster_15": 9.436,
-                            "file_cluster_16": 8.475,
-                            "file_cluster_17": 8.038
+                            "file_cluster_0": 7.475,
+                            "file_cluster_1": 7.985,
+                            "file_cluster_2": 7.053,
+                            "file_cluster_3": 9.995,
+                            "file_cluster_4": 9.047,
+                            "file_cluster_5": 9.056,
+                            "file_cluster_6": 9.164,
+                            "file_cluster_7": 7.904,
+                            "file_cluster_8": 6.613,
+                            "file_cluster_9": 8.936,
+                            "file_cluster_10": 10.177,
+                            "file_cluster_11": 9.187,
+                            "file_cluster_12": 8.252,
+                            "file_cluster_13": 8.357,
+                            "file_cluster_14": 12.906,
+                            "file_cluster_15": 9.593,
+                            "file_cluster_16": 8.705,
+                            "file_cluster_17": 8.302
                         },
                         "File Archetype": null,
                         "File Drift (Z-Score)": 0.0,
@@ -294414,7 +294414,7 @@
                         "Raw Churn Frequency": 0.0,
                         "Authorship Centralization": 0.0,
                         "Ownership Entropy": 0.0,
-                        "Raw Cognitive Density": 0.357
+                        "Raw Cognitive Density": 0.429
                     },
                     "4. Vulnerability & Risk Exposures": {
                         "Cognitive Load Exposure": "5.0%",
@@ -294462,7 +294462,7 @@
                         "Generic Type Abstractions": 0,
                         "Collection Iterators / Comprehensions": 0,
                         "Scientific & Mathematical Operations": 0,
-                        "Metaprogramming & Reflection": 0,
+                        "Metaprogramming & Reflection": 1,
                         "Module Dependencies (Imports)": 0,
                         "Authorship Metadata": 0,
                         "Planned Work (TODOs)": 0,
@@ -294561,26 +294561,26 @@
                     },
                     "3. Architectural Profile": {
                         "Repository Archetype": "file_cluster_8",
-                        "Repository Drift (Z-Score)": 6.351,
+                        "Repository Drift (Z-Score)": 6.769,
                         "Repository Fingerprint": {
-                            "file_cluster_0": 7.28,
-                            "file_cluster_1": 7.769,
-                            "file_cluster_2": 6.975,
-                            "file_cluster_3": 9.91,
-                            "file_cluster_4": 8.885,
-                            "file_cluster_5": 8.878,
-                            "file_cluster_6": 9.018,
-                            "file_cluster_7": 7.688,
-                            "file_cluster_8": 6.351,
-                            "file_cluster_9": 8.779,
-                            "file_cluster_10": 10.113,
-                            "file_cluster_11": 9.262,
-                            "file_cluster_12": 9.108,
-                            "file_cluster_13": 8.228,
-                            "file_cluster_14": 12.832,
-                            "file_cluster_15": 9.506,
-                            "file_cluster_16": 8.54,
-                            "file_cluster_17": 8.182
+                            "file_cluster_0": 7.543,
+                            "file_cluster_1": 8.115,
+                            "file_cluster_2": 7.346,
+                            "file_cluster_3": 10.103,
+                            "file_cluster_4": 9.174,
+                            "file_cluster_5": 9.171,
+                            "file_cluster_6": 9.284,
+                            "file_cluster_7": 8.037,
+                            "file_cluster_8": 6.769,
+                            "file_cluster_9": 9.065,
+                            "file_cluster_10": 10.29,
+                            "file_cluster_11": 9.31,
+                            "file_cluster_12": 8.373,
+                            "file_cluster_13": 8.511,
+                            "file_cluster_14": 13.044,
+                            "file_cluster_15": 9.713,
+                            "file_cluster_16": 8.829,
+                            "file_cluster_17": 8.499
                         },
                         "File Archetype": null,
                         "File Drift (Z-Score)": 0.0,
@@ -294594,10 +294594,10 @@
                         "Raw Churn Frequency": 0.0,
                         "Authorship Centralization": 0.0,
                         "Ownership Entropy": 0.0,
-                        "Raw Cognitive Density": 0.185
+                        "Raw Cognitive Density": 0.556
                     },
                     "4. Vulnerability & Risk Exposures": {
-                        "Cognitive Load Exposure": "9.46%",
+                        "Cognitive Load Exposure": "31.48%",
                         "Error & Exception Exposure": "0.0%",
                         "Tech Debt Exposure": "0.0%",
                         "Testing Exposure": "2.3%",
@@ -294638,11 +294638,11 @@
                         "UI / View Layer Components": 3,
                         "Closures and Anonymous Functions": 0,
                         "Global State Dependencies": 0,
-                        "Decorators and Annotations": 6,
+                        "Decorators and Annotations": 7,
                         "Generic Type Abstractions": 0,
                         "Collection Iterators / Comprehensions": 0,
                         "Scientific & Mathematical Operations": 0,
-                        "Metaprogramming & Reflection": 0,
+                        "Metaprogramming & Reflection": 2,
                         "Module Dependencies (Imports)": 0,
                         "Authorship Metadata": 0,
                         "Planned Work (TODOs)": 0,
@@ -294924,7 +294924,7 @@
                 "Static: Literature & Documentation": "33.3%"
             },
             "Average Risk Exposures": {
-                "Cognitive Load Exposure": "2.45%",
+                "Cognitive Load Exposure": "4.66%",
                 "Error & Exception Exposure": "0.0%",
                 "Tech Debt Exposure": "0.0%",
                 "Testing Exposure": "1.53%",
@@ -295304,26 +295304,26 @@
                     },
                     "3. Architectural Profile": {
                         "Repository Archetype": "file_cluster_8",
-                        "Repository Drift (Z-Score)": 7.321,
+                        "Repository Drift (Z-Score)": 7.483,
                         "Repository Fingerprint": {
-                            "file_cluster_0": 7.916,
-                            "file_cluster_1": 8.259,
-                            "file_cluster_2": 8.902,
-                            "file_cluster_3": 10.184,
-                            "file_cluster_4": 9.233,
-                            "file_cluster_5": 8.782,
-                            "file_cluster_6": 9.192,
-                            "file_cluster_7": 7.974,
-                            "file_cluster_8": 7.321,
-                            "file_cluster_9": 9.099,
-                            "file_cluster_10": 10.234,
-                            "file_cluster_11": 9.501,
-                            "file_cluster_12": 9.346,
-                            "file_cluster_13": 8.753,
-                            "file_cluster_14": 13.736,
-                            "file_cluster_15": 9.617,
-                            "file_cluster_16": 8.795,
-                            "file_cluster_17": 9.308
+                            "file_cluster_0": 8.045,
+                            "file_cluster_1": 8.403,
+                            "file_cluster_2": 9.03,
+                            "file_cluster_3": 10.246,
+                            "file_cluster_4": 9.361,
+                            "file_cluster_5": 8.91,
+                            "file_cluster_6": 9.3,
+                            "file_cluster_7": 8.123,
+                            "file_cluster_8": 7.483,
+                            "file_cluster_9": 9.215,
+                            "file_cluster_10": 10.286,
+                            "file_cluster_11": 9.464,
+                            "file_cluster_12": 8.743,
+                            "file_cluster_13": 8.864,
+                            "file_cluster_14": 13.823,
+                            "file_cluster_15": 9.687,
+                            "file_cluster_16": 8.912,
+                            "file_cluster_17": 9.433
                         },
                         "File Archetype": null,
                         "File Drift (Z-Score)": 0.0,
@@ -295337,10 +295337,10 @@
                         "Raw Churn Frequency": 0.0,
                         "Authorship Centralization": 0.0,
                         "Ownership Entropy": 0.0,
-                        "Raw Cognitive Density": 0.185
+                        "Raw Cognitive Density": 0.37
                     },
                     "4. Vulnerability & Risk Exposures": {
-                        "Cognitive Load Exposure": "7.35%",
+                        "Cognitive Load Exposure": "13.98%",
                         "Error & Exception Exposure": "0.0%",
                         "Tech Debt Exposure": "0.0%",
                         "Testing Exposure": "2.3%",
@@ -295385,7 +295385,7 @@
                         "Generic Type Abstractions": 0,
                         "Collection Iterators / Comprehensions": 0,
                         "Scientific & Mathematical Operations": 0,
-                        "Metaprogramming & Reflection": 0,
+                        "Metaprogramming & Reflection": 1,
                         "Module Dependencies (Imports)": 0,
                         "Authorship Metadata": 0,
                         "Planned Work (TODOs)": 0,