fix: two rule #5 violations, a framework change hiding 137 routes, and a test that rewrote a tracked report

[Hashevolution]

Summary

Standing CI failures, worked cause by cause rather than silenced. Measured the same way both sides: the CI command replayed locally against main and against this branch.

Paired local replay at the mid-point commit: 66 failed → 52 failed (14 fixed, 0 regressions). Six further commits of UI / CSS / docs re-anchoring followed. CI on the final head (169715b): 6 failed, 5 errors, 4,362 passed — see What is still red below.

The largest cluster was a framework change, not our code. Seven suites failed with '/query/' not found in {...} while the endpoint worked. FastAPI used to flatten a router's routes into app.routes on include_router; under the installed versions (fastapi 0.141.1 / starlette 1.6.0) it appends one _IncludedRouter wrapper per call instead. The wrapper routes correctly but carries no path, so the usual comprehension silently dropped every included endpoint — 19 wrappers hiding ~137 paths, leaving the 16 declared directly on the app. tests/_app_routes.py holds the unwrapping in one place instead of nine.

Two real CLAUDE.md rule #5 violations, neither introduced recently:

File	Size	Action
core/response_style.py	22,036	Split → 4,383 + 19,065
core/reasoning/engine.py	21,464	Grandfathered with a split plan

response_style.py is split rather than grandfathered because the gate's own comment records an anti-creep rule. The StylePreset dataclass and the three preset bodies moved to core/response_style_presets.py; the resolver and every public name stay put, so the eleven call sites are untouched.

engine.py is not split here on purpose. It is core/reasoning, so rule #2 requires STEP 7 bench numbers and a Quality Delta Card — and bench.py needs a live server plus Ollama, neither of which exists in a session container. Shipping an unmeasured refactor of the hottest path to make a gate green is what that rule exists to prevent. The grandfather entry names the seam for an operator who can run the bench.

Three more package-split casualties. gemma_client and reflect became packages; inspect.getsource() on a package returns only __init__.py, so structural tests reported features deleted when they had only moved. This is the third occurrence, so the helper is now public as module_source.

A test was rewriting a tracked measurement. Every suite run left reports/research-runs/cascade-consistency-probe.json modified — the test called probe.main(), which hardcoded that path. The committed copy still holds the pre-fix numbers (leakage 3, 1/4 consistent, generated on Windows), so each run overwrote a historical record. main() now takes an optional out_path; running the script by hand is unchanged.

Two real UI defects, found by re-anchoring the tests rather than the tests being wrong. admin.html's password toggle rendered as an empty <button></button> (no label, no icon); chat.js's next-actions header carried a second empty decorative span. Both are the same defect class, and both are fixed rather than asserted around.

Verification

Local runs replay the CI command exactly — same --ignore list, same env, same flags. One deviation, needed only here: sentence_transformers is stubbed via PYTHONPATH, because huggingface.co is blocked in a session container and the server cannot boot without it. CI downloads the real model, so CI is unaffected.

	failed	passed
main (6d6a079), local replay	66	4,316
this branch at the mid-point, local replay	52	4,335
this branch at 169715b, CI	6 (+5 errors)	4,362

Every fixed item corresponds to a change here; the diff of FAILED sets shows no new entries.

The route cluster was established, not inferred. With the stub in place the import reproduced CI's route set exactly, and driving the app with TestClient showed no 404 anywhere: /healthz 200, /llm/active 422, /query/ 422, /workspace/info 401, /templates/ 405 — all handler-reached. The defect was in how the tests looked.

The split was proved equivalent, not assumed. The pre-split module is loaded out of git alongside the new one and compared field by field: all three presets fingerprint identically (NATURAL 3,632 chars, TERSE 967, DETAILED 1,305), the five constants match, and resolve_style agrees on eight inputs including the env path, an unknown id and whitespace/case variants. Re-exports are the same objects, not copies.

ruff check . clean; bandit clean. Working tree clean after a full suite run (it was not before).

One measurement of my own was invalid and was redone. A first tally compared a tail-truncated branch output (22 items) against main's full output (49) and claimed 27 fixed. Spot-checking three supposedly-fixed tests showed them failing identically on both sides. Re-measured properly: 14 fixed, 0 regressions — the number above.

Two bugs caught while working, both by running rather than reading:

• @dataclass(frozen=True) sat one line above its class and was left behind by the first cut, making StylePreset a plain class — every preset construction raised TypeError.
• out_path.relative_to(ROOT) raises for any path outside the repo, and fired the moment a test passed a temp dir. Same trap found earlier in track2c_remeasure.py.

What is still red

Item	Why it is not fixed here
test_lrb_v021_cross_model (1)	Deliberately red — records the LRB-S2 non-reproduction (0.6875 vs published 0.7125). Operator decision, four options recorded.
test_measurement_critical_surfaces (3)	Needs the external MultiHop-RAG dataset; the download is blocked in a session container.
test_mobile_responsive (1)	Real CSS debt: 29 !important against a budget of 25.
test_native_done_reason (1) + test_entity_name_markdown_strip (5 errors)	One slow runner. The 5 are 30 s pytest-timeout errors on a file tests/conftest.py already names as intermittent on cold runners; the 1 is its documented cascade, from the timeout leaking patch("llm.router.RouterWrapper"). A single flake accounts for all six.

Quality Delta vs baseline

Quality delta: exempt (label: fix)

core/ changes are response_style.py and the new response_style_presets.py — not core/retrieval, core/graph or core/reasoning, and no behaviour changed (proved above). Everything else is test-side, measurement-side and docs.

Out of scope

• Splitting core/reasoning/engine.py — blocked on rule wiki_reset.py crashes on Windows CP949 console (UnicodeEncodeError) #2, as above. Plan recorded in the grandfather entry.
• _looks_like_text rejecting transcribed markdown tables — a realistic Korean financial table scores 0.38 against a 0.40 floor, so vision output is discarded and the image is re-OCR'd. Pinned by a test that records the behaviour; not fixed, because changing the gate is a retrieval-quality change that wants measurement.
• The vision model default, split three ways — PR feat(v0.6.1): default vision model → qwen2.5vl:7b (proven OCR win over llava) #1070 moved config.py to qwen2.5vl:7b while model_resolver.py:152 and llm_settings.py:51 still say llava:13b. Recorded in reports/research-runs/vision-model-default-split-20260828.md.
• Arabic language support — audited in a prior PR, untouched here; a v0.6 scope conversation.
• The Track 2c re-measurement — harness landed earlier, needs an operator machine.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Jttr1R2aJ3YjJkS1odiLC3

---

Generated by Claude Code