rosetta[swift]: cross-language consistency — 5 red / 0 amber metrics, 4 ledgered shapes

[squid-protocol]

Part of #2560 — per-language tracking for the keyword-rosetta control corpus (built for #1096). Planted intent is identical in every language, so every deviation below is measured bias vs. the 46-language median, validated in the corpus's deviation ledger. 🔴 = beyond ±50% of the cross-language median, 🟡 = ±25–50%.

Triage order (per the epic): structure detection first, then signal/keyword rules, then risk-score consequences — §3's numbers are downstream of §1–§2 and re-baseline as those fix. Cross-cutting engine issues (e.g. #2535/#2546) fix many languages at once; this issue tracks this language's residual after each cross-cutting fix lands, and closes when the language sits inside the ±25% band on every comparable metric (or every remaining deviation is ledgered as intended morphology).

1. Structure detection (fix first)

• 🔴 dependency_links: 0 vs median 3 (-100%)

2. Signal / keyword deviations

• 🔴 safety_bypasses: 0 vs median 2 (-100%)

3. Risk-exposure consequences (downstream)

• 🔴 risk_api_exposure: 0.89698 vs median 5.31104 (-83%)
• 🔴 risk_documentation: 9.74282 vs median 57.1208 (-83%)
• 🔴 risk_tech_debt: 75.87 vs median 39.9576 (+90%)

Ledgered shapes touching swift

defect	type	issue	evidence	summary
census-requires-git-tracked	engine-semantic	—	—	GalaxyScope's census enumerates git-tracked files only; an untracked folder scans as '0 files mapped' with no per-file warning
state-flux-branch-weighting	engine-semantic	#2546	b.swift	state_mutation is recorded x3 when branch context exists in the file ('flux' semantics, matching the state_flux column name)
string-literal-selective-shielding	upstream-question	#2535	b.swift	Keywords inside one string literal ('if eval fails, try open') count toward branch (+2), safety (+1), io (+1) but eval does NOT count toward high_risk_execution (routes …
swift-import-capture-min-two-chars	upstream-question	#2543	(notes)	swift's dependency_capture requires module names of 2+ characters ([a-zA-Z][\w.]+), so 'import a' captures nothing: the corpus's swift chain never resolves, popularity…

Decoy outcomes (file-level evidence)

• b.swift · let note = "if eval fails, try open" (string): if + try count branch +2 (swift branch includes try, finditer-confirmed) and OPEN counts api +1: swift's api rule includes the open access modifier, so a string containing 'open' adds API-exposure mass. var x2 raw state tripled to 6. Ledger: string-literal-selective-shielding, state-flux-branch-weighting
• c.swift · let hackLevel = level (code): inert (camelCase)

Reproduce / evidence

• Corpus folder: data/swift/ — expected_signals.json carries the shape-by-shape accounting
• Gate: GALAXYSCOPE_BIN=<venv>/bin/galaxyscope python tools/verify_language.py swift in the corpus repo
• Full context: findings_by_language.md#swift · bias_report.md · bias chart