Non-blocking items from the independent review of #2614 (blockers B1/M1 + n1 fixed in the PR).
- m1:
revalidate's AC-10 net keys on ConfigPath but the rename-class warning finding uses the bare field name while the applied fix uses the full pointer — they can't match, so a rename that failed to clear its finding wouldn't be caught. Also, AC-10 says 'introduces no new finding' but revalidate only checks applied paths cleared. Fix the convention mismatch or document the narrower guarantee.
- m2:
repair f.yaml --apply --yes with only a restart-class fix returns no_fixes_available (confusing after read mode showed a fix). Distinguish 'nothing safe to auto-apply; N need explicit --fix' from genuinely clean.
- m3: the read-mode
Before diff renders the YAML anchor name for an aliased value (st -> running) instead of the resolved value. Apply is correct; preview is misleading.
- n2:
/description truncation cuts on a byte boundary and can split a multibyte rune; truncate on a rune boundary (utf8-aware).
- n3:
codes.go:23 comment says 'All five map to exit 2' — the feature registers six codes.
Source: fresh-context review of #2614.
Non-blocking items from the independent review of #2614 (blockers B1/M1 + n1 fixed in the PR).
revalidate's AC-10 net keys on ConfigPath but the rename-class warning finding uses the bare field name while the applied fix uses the full pointer — they can't match, so a rename that failed to clear its finding wouldn't be caught. Also, AC-10 says 'introduces no new finding' but revalidate only checks applied paths cleared. Fix the convention mismatch or document the narrower guarantee.repair f.yaml --apply --yeswith only a restart-class fix returnsno_fixes_available(confusing after read mode showed a fix). Distinguish 'nothing safe to auto-apply; N need explicit --fix' from genuinely clean.Beforediff renders the YAML anchor name for an aliased value (st -> running) instead of the resolved value. Apply is correct; preview is misleading./descriptiontruncation cuts on a byte boundary and can split a multibyte rune; truncate on a rune boundary (utf8-aware).codes.go:23comment says 'All five map to exit 2' — the feature registers six codes.Source: fresh-context review of #2614.