fix(review): preserve semantic leaf from retry regressions

CHANGELOG.md

@@ -1,3 +1,210 @@
+### OpenCode normalizer tree mode matches tested publication
+
+- Restore the OpenCode review normalizer's executable mode after its published
+  blob matched the tested source but its Git tree entry did not. Exact-tree
+  publication evidence now includes file mode as well as content identity.
+
+### OpenCode quoted coverage labels cannot replace measured evidence
+
+- Reject a `coverage:` occurrence immediately preceded by a Markdown backtick
+  when selecting the authoritative coverage section or locating its boundary.
+  A reviewer warning that quotes a false full-coverage claim can therefore no
+  longer replace an earlier fail-closed coverage result.
+- A durable regression first reproduced the false approval on PR #2564's
+  reviewed head, then passed with the bounded label-admission repair alongside
+  the existing repeated-label, identifier-suffix, and full-summary cases.
+  Fresh exact-head hosted Checks and a qualifying independent approval remain
+  required before ordinary merge.
+
+### OpenCode duplicate JSON members cannot replace review identity
+
+- Reject repeated object member names at every JSON nesting depth before a
+  value can become review-control evidence. A later duplicate `head_sha`,
+  `run_id`, or `run_attempt` can no longer replace the earlier value through
+  Python's default last-wins decoder behavior.
+- RED against draft PR #2564 head
+  `3ecb54b896fbf4c9b7fea1bf8749c28cc558c0cd` reproduced both a direct
+  duplicate-object admission and an exact-run identity rewrite. The bounded
+  repair uses the standard decoder's `object_pairs_hook`, preserves mixed
+  prose recovery and non-finite-number behavior, and fails closed without
+  rewriting the model artifact.
+- Focused normalizer verification is 174/174 with 100% statement, branch, and
+  public-doc coverage for the target module. The warning-fatal repository
+  suite passes 5,375 tests, 10 optional skips, and 40 subtests. Fresh
+  exact-head hosted Checks and a qualifying independent approval remain
+  required before ordinary merge.
+
+### OpenCode tilde fence delimiter lines cannot carry approval evidence
+
+- Classify CommonMark tilde fence delimiters with the same line-local,
+  non-authoritative boundary as backtick fence delimiters. An exact-run control
+  in either an opening tilde-fence info string or a closing delimiter suffix can
+  no longer be promoted as top-level approval evidence; fenced-body controls
+  and later independent controls retain their existing contract.
+- RED `11c9c5ca2dce8d7ef32b078d76d7cd31101557e2` reproduces both false
+  admissions against exact parent `420f631b3b8bc0bb3c8dae4d69134ce97d932e02`.
+  GREEN `02f2763ff08d05060c66c8d6531df1aa8e49d035` generalizes the existing
+  delimiter-run classifier. Independent review then found the same bypass in
+  valid blockquote and list-item containers. RED
+  `0c226a1587b089a1ab267e48ab00ec9b0b69214c` binds four nested opening and
+  closing forms; GREEN `3ddd31841b73c6d5ae8555f6c8a838cb2b5f4e55`
+  closes those same-line forms. A second independent pass found exponential
+  regex backtracking plus four-space and ordered-list continuation gaps. RED
+  `f2aada37f6aa904442105d653d1217b834d8a18f` binds those cases and the
+  no-prefix-copy invariant; GREEN `e5ef765fb523596fdcc683876d80bc1bc644e566`
+  replaces the grammar regex with a conservative fail-closed container-marker
+  allowlist and evaluates at most one fence candidate per line. A 100,000-marker
+  failing prefix completes in about 0.03 seconds. Focused normalizer
+  verification is 171/171; the warning-fatal repository suite is 5,372 passed,
+  10 optional skips, and 40 subtests. Fresh exact-head hosted Checks and a
+  qualifying independent approval remain required before ordinary merge.
+
+### OpenCode fence delimiter lines cannot carry approval evidence
+
+- Ignore every character after a line-start Markdown fence delimiter until the
+  newline. A balanced exact-run control embedded in an opening fence info
+  string or appended to a closing fence line therefore remains prose instead
+  of acquiring top-level approval authority; controls on later independent
+  lines retain the existing contract.
+- RED `807fba4b845cba193126c1484b52e803315865a7` records both false admissions.
+  GREEN `705ac4a0a76d8160cc229e2b5e5a0337b7dfb2c9` adds one line-local state bit
+  and preserves executable mode. Focused normalizer verification is 158/158;
+  the warning-fatal repository suite is 5,359 passed, 10 optional skips, and
+  40 subtests. Fresh exact-head hosted Checks and a qualifying independent
+  approval remain required before ordinary merge.
+
+### OpenCode inline examples and hostile nesting fail closed
+
+- Treat top-level single-quoted and inline backtick spans as prose rather
+  than approval evidence. An example exact-run control can no longer be
+  promoted merely because its JSON is balanced, and a quoted `{` or `[` can no
+  longer hide the later independent control. Apostrophes inside words remain
+  ordinary prose; triple-or-longer Markdown fences remain transparent to the
+  existing embedded-JSON contract.
+- Catch decoder `RecursionError` at both JSON admission points so excessively
+  nested model output returns no candidate instead of crashing the review
+  step. Integrated source commit
+  `10b32952bae391d794a5d1af36be71f80b32a252` adds single-quote,
+  backtick, contraction, Markdown-fence, delimiter, and 10,000-level nesting
+  cases. Independent review then found that a contraction inside a
+  single-quoted span and a longer backtick run could end the span early; the
+  integrated repair applies word-internal apostrophe handling symmetrically
+  and closes only on an exact complete backtick run. A second independent pass
+  found that fence classification copied each same-line prefix; RED measured
+  800,863 copied characters across 400 spans. The same integrated repair
+  short-circuits by the constant three-character fence indent before slicing.
+  Focused normalizer
+  verification is 156/156; the warning-fatal repository suite is 5,357 passed,
+  10 optional skips, and 40 subtests. Fresh exact-head hosted Checks, coverage
+  evidence, and a qualifying independent approval remain required before
+  ordinary merge.
+
+### OpenCode quoted prose and unfinished wrappers preserve control identity
+
+- Restore the mixed-output scanner's linear-time security contract after an
+  independent exact-head review found per-nested-opener prefix rescans. RED
+  `e9a080f59ff6d85101c78da8ac1d4eddcd53c7b7` records 129 reverse-prefix
+  searches for 64 adversarial openers; GREEN
+  `5f5c2dc9b3ad8e7476663ce4d3c32ee49a8de4a4` preclassifies exact
+  `Diagnostic:` opener positions in one pass and reduces the same probe to one
+  decoder-internal search. Exact-function scaling from 16k to 128k nested
+  openers remains linear while quoted-prose and invalid-wrapper cases stay
+  fail-closed.
+- Ignore `{` and `[` while they occur inside prose quotation state; an
+  unfinished quote remains fail-closed rather than promoting a quoted
+  multi-line control. Keep unfinished invalid-token wrappers fail-closed unless
+  the nested value follows the exact newline-separated
+  `Diagnostic: [pending` or `Diagnostic: {pending` recovery frame.
+- Replace the Strix runtime-quality self-test's stale `decoder.raw_decode`
+  implementation-string assertion with its executable normalizer CLI contract;
+  that contract now includes a quoted-brace transcript before a valid current-run
+  control. Exact successor head `618471110757c74bcf6b7ac3a5783989dd010213`
+  produced 11 focused RED failures across three test-first cycles plus the
+  expected Strix self-test failures; the repaired focused normalizer suite
+  passes 134/134 with 100% statement,
+  branch, and public-doc coverage for the target module. The complete
+  repository suite passes 5,335 tests with 10 optional skips and 40 subtests;
+  the complete Strix harness also passes.
+- Concurrent RED commit
+  `4de4805502e0fa2cae1178919ec31eec9fcd7249` binds parser and CLI
+  regressions; concurrent GREEN `a16431475a223d213b7e827b274282feda92286c`
+  first separated top-level prose quotation framing. The integrated repair
+  preserves both commits while superseding their newline-reset behavior with
+  the fail-closed unfinished-quote contract. The normalizer remains executable
+  (`100755`).
+
+### OpenCode separatorless invalid wrappers remain fail-closed
+
+- Preserve balanced malformed wrapper identity even when an invalid first
+  token is followed directly by a nested object or array without a comma or
+  colon. RED commit `8b1bd4a43be7604d6aa7b9e524295fea7501334c`
+  proves `[unquoted_token {control}]` and `{unquoted_key {control}}` promoted
+  the nested exact-run control. GREEN commit
+  `5261145a73e7b5a0b53c224317002fe98961f16f` records balanced parent spans in
+  one linear scan, suppresses their nested candidates, and still recovers a
+  complete control after an unclosed prose delimiter. The production
+  normalizer remains executable (`100755`). Focused verification is 120/120;
+  the repository suite passed 5,321 tests plus both pip-dependent cases in a
+  pip-equipped locked environment, with 5 optional skips and 40 subtests.
+
+### OpenCode invalid-token wrappers remain fail-closed
+
+- Preserve the outer-container identity boundary when an invalid token reaches
+  a nested opener without a comma or colon. RED commit
+  `4752398da1aef77ab8172126e2d3668870f628aa` reproduces nested-control
+  promotion from separatorless array and object wrappers; GREEN commit
+  `f6d6e255ed479150dbbd48490f0a527ce06e0917` records matched container spans
+  before decoding, so balanced malformed parents suppress nested controls while
+  unclosed prose delimiters still permit a later independent control.
+
+- Treat a balanced object or array whose first token is invalid JSON as one
+  outer evidence container instead of skipping its opener and promoting a
+  nested exact-run control. RED commit
+  `b5a0507b8ee4ec70cc5fca751f34df98719f219b` binds `undefined`, arbitrary
+  unquoted array tokens, and unquoted object keys; GREEN commit
+  `443c29aa6f56735f7fcf0ee6a550b6bad5f7e2f8` preserves the proven prose
+  delimiter recovery while keeping balanced malformed wrappers fail-closed.
+  The production normalizer remains executable (`100755`).
+
+### OpenCode mixed-output framing preserves later controls
+
+- Ignore prose `{` or `[` delimiters whose next non-whitespace token cannot
+  start the corresponding JSON container. This preserves a later complete
+  exact-run control after diagnostics such as `Diagnostic: [pending` without
+  weakening the existing fail-closed rule for malformed outer objects or
+  arrays. RED commit `42099a359cdfb8126ea4e3d9118c60f6d98af1fa`
+  records the lost-control case; GREEN commit
+  `07baba20259c9061fbb647963f09745a9ca6931b` restores the framing boundary.
+  Fresh exact-head hosted Checks and a qualifying independent approval remain
+  required before ordinary merge.
+
+### OpenCode embedded JSON evidence is outermost and linear-time
+
+- Parse prose-wrapped JSON by scanning each outermost object or array once,
+  with string and escape awareness, instead of retrying `raw_decode` at every
+  nested `{`. A malformed outer container can no longer promote a nested
+  exact-run control object into top-level approval evidence, and adversarial
+  nested prefixes no longer cause quadratic decoding work. RED commit
+  `d05f67f6c5f164309d3cbf15f4858c5fa3d176cd` preserves the malformed-object
+  exploit; GREEN commit `86f52f320e8eb5ac56efdf9a3e2552b20bf409de`
+  replaces the retry loop, and `1a00c73a752b45d9d2a808d9bc96baae51ea8402`
+  extends the same invariant to malformed array nesting. Fresh exact-head
+  hosted Checks and a qualifying independent approval remain required before
+  ordinary merge.
+
+### OpenCode evidence labels require standalone identity boundaries
+
+- Reject a purported verification label when it is only the suffix of an
+  identifier-like token such as `uncoverage:`. The OpenCode normalizer now
+  applies the same boundary rule while selecting the last admissible label and
+  while finding the next label that terminates its section. RED commit
+  `af06cf9c87de4ac76db575d087a170746d6ab83d` proves that a forged suffix could
+  override an earlier fail-closed coverage statement; GREEN commit
+  `4d49b8307706ab8d4565cca8b0d9728bcdad2a35` preserves repeated labels,
+  Markdown decoration, and the distinct `docstring coverage:` label while
+  rejecting the identity-confused form. Fresh exact-head hosted Checks and a
+  qualifying independent approval remain required before ordinary merge.
+
 ### Maturin download failures close every transport response
 
 - Refactor the bounded Maturin asset downloader so successful and rejected