precision: read the named false positives, and the misses that named themselves

Six false-positive causes the README had written down, closed by cause rather
than by rule, because the six had three causes between them.

Four rules matched a variable's NAME and read that as evidence about its value.
semantics.py grew a local value trace -- what a scope binds, what each name was
assigned, whether an expression is certainly an integer, whether its root came
from outside the file -- and float-comparison, path-join and decimal-for-money
moved onto it. onchange-is-not-validation had a different fault: the regex read
400 characters past the decorator and could not see where the method ended, so
all three of its false positives were a short onchange followed by an action
method that raises. Scoped to the decorated function by an AST pass.

Docstrings are emptied before matching, quotes and geometry preserved. A
suppression marker that names a worded code now covers only rules sharing one
of those words; an opaque code keeps the line as before, and the gap that
leaves is named in _marker_is_about. check_compliance runs semantic checkers
too, having silently lost every rule that moved to AST.

sudo-bypasses-record-rules now checks four clauses instead of one. The fourth,
`self = self.sudo()`, came out of the harvest: it is the miss the README names
by hand, and it is an on-target catch. The company_id exemption became the
fields the model's own ir.rule is written about, which is the narrowing 3.40
called a worklist entry and could not do without guessing.

Recall, re-measured over three ecosystems and 1,164 fix commits: 6% on OpenSPP
(was 4%), 6% on OCA (was 2%), 5% on odoo core. Nine more rules graded from
recall --aim, seven of them unproven on the evidence of firing nowhere in
820,000 lines -- which needed the third tree, because four rules that looked
identical on two trees fire on core.

Two new classifications, 84 findings read by hand. sudo is 0 true of 24. odoo
core is the first sample rather than census here, 60 findings across the four
rules making 70% of its output: ondelete 13/15, stored-compute 11/15, assert
3/15, sudo 0/15. The spread is the finding -- precision depends on what kind of
code is under review, and a framework's asserts have no outside to come from.

Seven checker defects fell out of reading: sudo(False), sudo(flag=False) and
sudo(self.env.su) read as escalation; display_name treated as maybe-stored when
the framework declares it unstored; _auto = False models treated as having a
foreign key; a statement-span tie that lost a marker; and scan_source matching
prose in docstrings.

244 of 244 hand-classified true positives still found, checked by re-running
against the same checkouts rather than by reading the diff.

ARCHITECTURE.md

@@ -2170,12 +2170,12 @@ framework's answer to precision is `float_round`/`float_compare`, not `Decimal`.
 rule fires on the idiom and names a fix that cannot be taken. Three findings do not
 settle a checker either way, so it is recorded rather than removed.
 
-**Two defects the classification found that no test would have.** `scan_source` strips
+**Two defects the classification found that no test would have.** `scan_source` stripped
 `#` comments before matching and not string literals, so `eval()` named in a docstring
-reads as code. And suppression reads any marker within a simple statement without
-asking which rule it names, so a `# nosemgrep: odoo-sudo-without-context` silenced a
+read as code. And suppression read any marker within a simple statement without
+asking which rule it named, so a `# nosemgrep: odoo-sudo-without-context` silenced a
 datetime finding four lines above it — the mute button of §3.42 reached from the other
-side. Both are named in the README rather than quietly fixed.
+side. Both were named in the README first, and both are closed in §3.47.
 
 **What the id prefix means now.** `python.decimal-for-money-not-float` carries
 `stack: odoo`. The prefix is **provenance** — where the rule came from and which
@@ -2192,6 +2192,413 @@ stopped being retrieved at all against 27 — that probe is the generic validati
 question every constraint rule here answers. Reworded to the one only it answers.
 **27 of 27 retrievable, 25 in the top 3.**
 
+### 3.47 Reading the value instead of the name, and the rest of the sudo sentence
+
+**Decided 2026-09-21.** Six false-positive causes the README had named were closed in
+one pass, and the pass was ordered by cause rather than by rule, because the six had
+three causes between them.
+
+**The shared cause.** `float-comparison-needs-float-utils` (2 true, 5 false),
+`path-join-does-not-contain-a-path` (0 of 4) and `decimal-for-money-not-float` (0 of 3)
+each matched a variable's *name* and treated that as evidence about its *value*. All
+five float falses compared an integer to zero — `search_count`, a `read_group`
+`<field>_count`, `cr.fetchone()[0]` of a `SELECT COUNT(*)`, a `fields.Integer` — and
+three of the five plus both true positives were spelled `total == 0`. No name could ever
+have separated them. The assignment can.
+
+So `semantics.py` grew a local value trace: which names a scope binds, what each was
+assigned, whether an expression is certainly a whole number, whether its root came from
+outside the file. One file, one function, no imports followed, no types inferred, and
+the limit is written into the limitations section rather than discovered later. Three
+regexes became AST passes on top of it. Every answer the trace gives that *suppresses* a
+finding must be certain — a name assigned twice is an integer only if both assignments
+are — because a suppressing guess is the direction that hides.
+
+**The window that crossed a function.** `onchange-is-not-validation` was 4 true, 3
+false, and the README's reading of the three ("the write is to a Many2one") was wrong.
+Each is a four-line onchange that assigns a field, followed by an action method that
+raises. The regex read `[\s\S]{0,400}` past the decorator; `_onchange_variable_id` is
+200 characters long and the `UserError` it matched belongs to `action_remap`. A regex
+has no way not to do that. Scoped to the decorated function by an AST pass, the three
+are silent, and three new findings surfaced and were read: a phone-number validation
+living only in an onchange with no constraint anywhere in the file; a
+`_check_date_collected` onchange raising `exceptions.ValidationError`, a dotted spelling
+the regex's `\w*` never matched; and one that clears a field and returns the warning
+dict. The finding anchors on the decorator, because that is where the rule is and where
+a marker about it gets written — a `FunctionDef`'s own `lineno` is the `def`, one line
+down, and reporting there lost a suppression a test already relied on.
+
+**Two infrastructure defects, fixed once.** Docstrings are now emptied before any
+pattern sees the file — docstrings only, since `_SQL_COLUMNS` reads triple-quoted SQL
+on purpose — with quotes, newlines and length preserved so no reported line or column
+moves. And a suppression marker that *names* a code with words in it
+(`odoo-sudo-without-context`) now covers only rules sharing one of those words, vendor
+and language words excepted; a code with no words (`B608`, `E501`) or prose after the
+colon cannot be compared with anything and covers its line exactly as before. The
+direction of error is stated in `_marker_is_about`: a code the function cannot relate
+to a rule leaves the finding reported.
+
+Fixing that surfaced a third defect nothing had reached before. Every statement span
+borrows the comment line above it, so consecutive statements overlap by one line, and a
+finding on the first line of one statement is also inside the borrowed line of the next.
+Two spans of equal width tied, and the winner was whichever `ast.walk` reached first.
+On `spp_api_v2/wizards/show_secret_wizard.py` the `return` on line 38 won the marker on
+line 36 away from the write on 37. A span whose statement *covers* the line now beats
+one that only borrows it.
+
+**The rest of the sudo sentence.** The rule says three things — scope `sudo()` to the
+narrowest operation, re-apply company filtering by hand, never pass a sudo recordset
+onward — and the checker tested only `.sudo().search()`. §3.30's harvest put `.sudo(` at
+70 missed against 6 caught, 47 of the 70 in files where a checker fired elsewhere; the
+README's own named miss, *"remove sudo() when importing record"*, is a `create`. Counted
+on the OpenSPP tree, the query clause has 116 call sites and the unchecked one 136.
+`sudo_search_drops_a_real_rule` became `sudo_drops_record_rules` and checks all three:
+queries, touches (`create`, `write`, `unlink`, `copy`, `read`), and a sudo recordset
+bound to a name and then returned or passed as an argument — the bare name only, since
+telling `return p.filtered(...)` from `return p.mapped('name')` means knowing which
+recordset methods return recordsets, and a new clause on a critical rule should
+under-report.
+
+A query decides *which* records exist for you and a touch acts on ones you already hold.
+That line is where the measurement fell, so it is where the code divides.
+
+The record-rule trigger of §3.40 gates every clause, and it needed one more thing to do
+so: `Plan.sudo().create(...)` names no model, so the trigger read UNKNOWN and could not
+suppress. The receiver is now followed through its assignment — `Plan =
+self.env["spp.case.plan"]` a few lines up — and 12 of the 15 unresolved receivers in the
+file that produced them resolve. `check_compliance` also runs semantic checkers now; it
+ran patterns only, so every rule that moved to an AST pass had silently left the
+compliance check of generated answers, including the onchange rule that function's own
+docstring gives as its reason for existing.
+
+**The `company_id` exemption became the rule's own fields.** The old test for "this call
+already re-applied the scoping" was the literal word `company_id`, from the rule's
+correct sample, and §3.40 recorded the cost: 14 of 20 surviving findings were scoped by
+a group, a partner or an area and read as unscoped. It called a narrowing a worklist
+entry because "deciding in general that a domain is already scoped means evaluating it,
+and a narrowing that guesses would cost the 6 true positives this keeps."
+
+There is a version that does not guess. `context` already parses every `ir.rule` in the
+tree to decide whether one filters; it now also records **which fields each domain is
+written about**, and the checker compares the call against those instead of against one
+hardcoded word. Not one OpenSPP case model has a company rule at all — they are governed
+by `[('case_worker_id', '=', user.id)]` and `[('case_id.case_worker_id', '=', user.id)]`
+— so a create naming `case_worker_id` or `case_id` lands inside the caller's own
+visibility, and that is the rule's advice followed in the only spelling that model has.
+`company_id` stays as the fallback where the rules could not be read, so nothing exempt
+before stops being exempt now.
+
+Two details cost a true positive each before they were right. The comparison reads the
+call's **arguments**, not the unparsed call: the receiver carries the model name, and
+`spp.group.membership` contains the word `group`, which is one of that model's own rule
+fields — it exempted an unscoped sweep of every membership in the database, classified
+true by hand. And an argument that is a bare name is followed to what it was assigned,
+because `create(vals)` otherwise hides every field it sets behind four letters. All six
+true positives survive, checked explicitly.
+
+**What the re-run says**, against the artifacts of §3.43 and §3.46:
+
+| | OpenSPP before | after | OCA before | after |
+|---|---|---|---|---|
+| `float-comparison` | 7 | **2** | 1 | **3** |
+| `onchange-is-not-validation` | 7 | 7, all three falses replaced | — | — |
+| `decimal-for-money` | 2 | **0** | 1 | **0** |
+| `path-join` | 1 | **0** | 3 | **0** |
+| `eval-and-pickle` (docstring) | 1 | **0** | — | — |
+| `datetimes` wrongly suppressed | 1 | **0** | — | — |
+| `sudo` deciding / advisory / decided | 2 / 0 / 62 | **2 / 11 / 117** | 7 / 0 / 0 | **6 / 10 / 0** |
+| Rate per thousand lines | 0.9 | **0.8** | 3.5 | **3.4** |
+
+The OCA float number went *up*, and that is the old `satisfied_pattern` clearing a
+whole file on a `float_compare` anywhere in it. The three are `Monetary` and `Float`
+fields compared with `!= 0` in files that call `float_compare` somewhere else, each read.
+
+**What the classification says, and what was done about it.** All 23 live sudo findings
+were read by hand against their own files, in `classification-sudo-2026-09.json`.
+**0 true, 23 false.** The touch and escape clauses have not met a real one in 260,897
+lines. Every finding they made is code where the caller is an administrator by
+construction — a demo-data seeder, an accounting wizard behind
+`group_account_manager` — or a framework model with no tenant boundary: an
+`ir.actions.act_window`, an `ir.sequence.date_range`, a postgres tuning row.
+
+So the two new clauses emit `unproven` **per finding**. That grade already exists for
+exactly this position — "a real defect nothing measured here has met yet, so it is
+reported and not trusted to stop a build" — and `scan_source` now derives a hit's
+`advisory` flag from the hit's own grade as well as its rule's, which is the same
+derivation the corpus builder already does one level up. The query clause keeps the
+rule's `defect` and its 6 true positives, because a grade travels with the finding.
+
+Not deleted, and not by path. Skipping `*_demo` modules would be a heuristic invented to
+make a number smaller; grading a clause on what it was measured at is the thing this
+project does everywhere else. `touches-a-record-already-held` is 7 of the 23 and
+`scoped-to-a-record-already-held` an eighth of the same shape — a recordset the caller
+obtained under its own rules, then written under sudo. That is not nothing, because
+`ir.rule` governs write permission as well as visibility, but it is a different claim
+from the one the rule's `why` paragraph makes. Whether it is a second rule or a
+narrowing wants a tree where it fires on production code, and neither of these two is
+that tree.
+
+### 3.48 A fourth sudo clause, taken from the missed list
+
+**Decided 2026-09-21.** The harvest is supposed to be a worklist, so it was used as one.
+
+`--harvest` over the OCA trees puts `.sudo(` at the top again, and one row in it is the
+miss the README had been naming by hand since §3.30: server-tools `cbefaa511485`,
+*"[FIX] excel_import_export: remove sudo() when importing record"*. The diff deletes one
+line.
+
+```python
+self = self.sudo()
+```
+
+Nothing below it mentions sudo. Every clause in §3.47 looks for `.sudo().<method>()` or
+a sudo recordset handed to something, and this is neither: it **replaces the receiver
+the whole method is written against**, so each subsequent `self.env[...]` inherits the
+elevated environment while naming nothing. The commit says what it cost — *"finding
+multiple records across all companies during import when they have same record name.
+Previously, importing with sudo could bypass multi-company record rules"* — which is the
+rule's own `why` paragraph, written by somebody who had just been bitten by it.
+
+Three sites in 260,000 lines, so the clause is narrow as well as real. Run against that
+commit's own before and after images the finding sits on line 283, is gone afterwards,
+and 283 is one of the two lines the fix touched: an on-target catch by recall's own
+definition, which is why this clause carries no grade of its own and keeps the rule's
+`defect` where the touch clause takes `unproven`.
+
+The same commit **adds** `ModelData = self.sudo().env["ir.model.data"]`, a deliberate
+and narrowly scoped elevation. That is the evidence for not also flagging `.sudo().env[`,
+and it is worth stating: the author of the fix reached for the shape one clause would
+have reported, in the commit that fixed the thing another clause did report.
+
+### 3.49 What the re-measurement says, and the grades that came out of it
+
+**Measured 2026-09-21**, over 795 fix commits across both ecosystems.
+
+| | OpenSPP before | after | OCA before | after |
+|---|---|---|---|---|
+| Fix commits examined | 406 | 409 | 385 | 386 |
+| …touching a covered construct | 160 | **173** | 56 | **64** |
+| Caught | 6 | **11** | 1 | **4** |
+| Recall against in-scope fixes | 4% | **6%** | 2% | **6%** |
+
+Both ecosystems land on the same number from different directions, which is worth more
+than either figure alone. The in-scope denominators rose too, so the improvement is not
+an artefact of measuring less.
+
+`.sudo(` remains the largest cluster on OpenSPP but a different shape: **67 missed, 9
+caught, 52 spoke, 15 silent**, against 70/6/47/23 before. The silent column is what the
+new clauses ate. `noupdate` — 22 missed, 0 caught, 9 spoke, 13 silent — is now the
+cluster with the most silence against the least coverage, and is next.
+
+**Four rules earned a grade.** `recall --aim` placed every finding a checker made in a
+file a fix touched against the method the fix edited, and the placements decide:
+
+| rule | on-target | same-symbol | other | caught | grade |
+|---|---|---|---|---|---|
+| `sql-needs-query-parameters` | 3 | 5 | 12 | 1 | **defect** |
+| `naive-and-aware-datetimes-do-not-compare` | 2 | 5 | 16 | 2 | **defect** |
+| `check-company-on-relations` | 1 | 3 | 10 | 1 | **construct** |
+| `constrains-must-list-every-field-read` | 1 | 2 | 22 | 0 | **construct** |
+
+The two `construct` grades are the same reading `ondelete` and `stored-compute` already
+have: the rule recognises the declaration and is about the method rather than the line
+anybody fixes.
+
+### 3.50 A third ecosystem, and the two things it changed
+
+**Measured 2026-09-21.** Every recall number this project had came from two trees, and
+the README's own caveat was that two repositories in one ecosystem is a narrow sample.
+So the pass was run again against **odoo core 18.0** — 559,663 lines, 190,217 commits,
+4,368 `.sudo(` call sites — with the recall half capped at 400 fix commits.
+
+| | OpenSPP | OCA | odoo core | all three |
+|---|---|---|---|---|
+| Fix commits examined | 409 | 386 | 369 | **1,164** |
+| …touching a covered construct | 173 | 64 | 97 | **334** |
+| Caught | 11 | 4 | 5 | **20** |
+| Recall | 6% | 6% | 5% | **6%** |
+| Live findings per 1000 lines | 0.8 | 3.5 | **5.0** | — |
+
+Three ecosystems landing on the same recall figure from different directions is the
+first evidence this project has that ~6% is a property of the corpus rather than of a
+sample. The precision rate on core is the highest of the three and is **not classified**;
+core is the reference implementation, so a rate there is a statement about the rules
+rather than about somebody's house style, and reading those 2,784 findings is the
+largest single piece of work this repository now has outstanding.
+
+**It caught a checker defect that two trees could not.** `self = self.sudo(False)`
+turns record rules back **on**. It is how a method that must run under the caller's own
+rights says so, and odoo core does it 60 times — including mail's
+`_check_attachments_access`, whose docstring reads *"This method relies on access
+rules/rights and therefore it should not be called from a sudo env."* Every sudo clause
+read `.sudo` and ignored its argument, so the checker reported the safeguard as the
+defect. Neither OpenSPP nor OCA contains a single `sudo(False)`, so no amount of work on
+those two trees would have found it. `_escalates()` now reads the argument, and a
+non-literal argument still counts as an escalation because `sudo(flag)` can be either.
+
+**It stopped a grading mistake.** Measured on OpenSPP and OCA alone, eleven rules had
+fired nowhere at all, and `unproven` — "a real defect nothing measured here has met yet"
+— is literally accurate for a rule like that. Four of the eleven fire on odoo core:
+`bare-except-catches-the-exit` 28 times, `mutable-default-argument` 15,
+`eval-and-pickle-execute-their-input` 4 and `subprocess-shell-true-is-injection` 4.
+Grading off two trees would have quietly downgraded four working rules on the strength
+of not having looked far enough.
+
+The seven that fire nowhere across all three — 820,000 lines and 1,164 fix commits —
+are graded `unproven` on that evidence, which is more than the one rule already carrying
+the grade had. Two of the seven, `decimal-for-money-not-float` and `path-join-does-not-
+contain-a-path`, are silent because §3.47 narrowed them rather than because nothing was
+there; both readings are in the README and the grade records the second.
+
+Sixteen rules are now graded and eleven are `unmeasured`, which remains the accurate
+word for them rather than a placeholder.
+
+**One thing found, measured, and then not acted on.** Odoo core documents intentional
+elevation with its own comment convention — `# sudo: discuss.channel - guests don't
+have access for creating mail.message` — and uses it 136 times. The first reading was
+that this is the same artefact as a `# nosemgrep` and that recognising it would
+materially improve the rate on core.
+
+The second half of that is simply false, and counting says so: of the **538** sudo
+findings on core, **6** carry a `# sudo:` note within three lines. One percent. The 136
+notes sit overwhelmingly on elevations no clause here fires on — the record-rule trigger
+has already dropped those, which is the trigger working. So the practical case for
+reading the convention evaporates, and what is left is only the argument of principle.
+
+That argument is worth writing down anyway, because it is the one that decides whether
+any future marker gets added. A `# nosemgrep` records that *an analyser made a specific
+claim and a human rejected that claim*. A `# sudo:` records that *the author, while
+writing the line, noted why they wanted it*. Those are different kinds of evidence: the
+first is a response to a challenge, the second is the intention of the person who chose
+the code. This corpus exists for defects that **look correct in review** — the headline
+measurement is that 17% of OpenSPP's fixes were silent until the data was visibly wrong
+— so an author's stated intention is close to the thing the tool is meant to second-guess,
+not evidence against the finding. Treating it as a suppression would also be the
+nexa-specific mute button §3.42 refuses to build, reached through a third party's
+comment style.
+
+The convention stays unread, and the reason is the principle rather than the number.
+
+There is a general rule in that, and it is worth stating because this file is otherwise
+an argument for measuring everything. A question that turns on **interpretation** does
+not become settled by being measured. The 1% above is a fact about two checkouts on one
+day; the thing actually in dispute is what a comment is evidence *of*, and no rerun
+answers that. Pinning a number to it would produce a reference that drifts on every tree
+and every rerun while the disagreement underneath it stays exactly where it was. Measure
+to check a claim already made — that is how the 1% corrected an overclaim in this very
+section — but do not manufacture a measurement in place of a decision.
+
+### 3.51 Reading odoo core, and the first classification that is a sample
+
+**Measured 2026-09-21.** §3.50 left core's findings unclassified and called reading them
+the largest outstanding piece of work. Reading all 2,784 is not a session's work, and
+pretending otherwise would have produced a worse artifact than admitting it.
+
+So this is the first classification here that is a **sample rather than a census**: 15
+findings of the largest rule — `stored-compute-needs-complete-depends`, 1,051 of the
+2,784 — drawn with a fixed seed and read by hand. The draw is reproducible from the
+artifact's own description, without the script that made it. **11 true, 4 false**, which
+is 73% with a 95% Wilson interval of roughly 48% to 89%. The interval is wide and it is
+the honest number for n=15: it says the rule is not mostly noise on core and it does not
+say much more.
+
+**All four false verdicts have one cause.** `odoo/models.py` adds `display_name` to
+every model as `fields.Char(automatic=True, compute='_compute_display_name',
+search=...)` with **no store**. An override that omits a dependency therefore cannot
+leave a stale row, because there is no row. The checker read "no declaration in this
+file" as unknown storedness and kept the finding, which is the right reading for an
+ordinary field declared in another module and the wrong one here: the framework's own
+declaration is knowable and says not stored. 121 of the rule's 1,051 findings on core
+were this shape.
+
+The narrowing is free, and that was checked rather than assumed. Ten hand-verified true
+positives compute `display_name` — every one of them in OpenSPP — and every one declares
+`store=True` on it **in its own file**, so in-file storedness reads True and they are
+untouched. Re-run: 244 of 244 hand-classified true positives across all five artifacts
+still found, none lost.
+
+**The bigger thing the sample found, and did not act on.** 837 of odoo core's 1,360
+stored computes are `readonly=False`: the "compute a smart default, then let the user own
+it" pattern, where a deliberately narrow `@api.depends` protects a user's edit from being
+clobbered. That is a plausible reading of most of this rule's volume on core, and it is
+not a safe narrowing. Three of the 47 resolvable hand-verified true positives on OCA and
+OpenSPP are themselves `readonly=False`, and nine of the eleven true verdicts in this
+very sample are too. The pattern is a consideration inside each verdict, not a rule, and
+the number that would have justified treating it as one is the number that refutes it.
+
+**What is still unread.** 1,612 live findings on core. The next three by volume are read
+in §3.52.
+
+### 3.52 The other three rules on core, and what precision turned out to depend on
+
+**Measured 2026-09-21.** Same method as §3.51 and the same seed: 15 findings each of
+`sudo-bypasses-record-rules`, `assert-is-not-validation` and `ondelete-is-a-decision`,
+drawn and read by hand. With §3.51 that is 60 of core's findings across the four rules
+making 70% of them, in `classification-odoo-core-2026-09.json`.
+
+| rule | core | previously | 95% Wilson |
+|---|---|---|---|
+| `ondelete-is-a-decision` | **13/15** | 12/12 OCA, 14/14 OpenSPP | 60–95% |
+| `stored-compute-needs-complete-depends` | **11/15** | 49/57 OCA | 48–89% |
+| `assert-is-not-validation` | **3/15** | 6/10 OCA | 7–45% |
+| `sudo-bypasses-record-rules` | **0/15** | 6 true on OpenSPP | 0–20% |
+
+**The finding is that precision depends on what kind of code is under review, and this
+is the first tree here that made that legible.** Two rules hold up on core. Two collapse,
+and both collapse for the same reason rather than because the checkers are broken.
+
+`assert-is-not-validation`'s own true class, set when it was classified on OCA, is *the
+asserted value came from outside the module*. A framework's asserts are overwhelmingly
+invariants between its own components — the registry asserting its cache-name
+convention, a field descriptor asserting its own configuration, the query builder
+asserting an alias it generated itself. There is no outside. Twelve of the fifteen are
+that shape.
+
+`sudo-bypasses-record-rules` is 0 of 15 and every one is a deliberate framework
+elevation: a public route resolving an access token before any identity exists, an
+`@api.ondelete` guard that has to see records the caller cannot or the guard is
+bypassable, a cross-company sync whose entire purpose is to cross companies. The rule
+describes an application leaking between tenants. Core is the thing that implements
+tenancy.
+
+Neither is a reason to change a grade. A precision number is about a subject, and the
+subject here is one this corpus was never aimed at — nobody reviews odoo core with it.
+It is a reason to say so in the README, which is done, and it is the strongest argument
+yet that a single precision figure for "the corpus" means less than the same figure per
+kind of codebase.
+
+**Three checker defects, all found by reading rather than by testing.**
+
+`_auto = False` marks a model odoo builds no table for: a SQL view. There is no foreign
+key, so `ondelete` is not a decision anybody can make about it. Two of the fifteen
+ondelete findings were report models of exactly that kind, and the exemption joins
+TransientModel in `_transient_spans`. None of the 26 hand-verified true positives for
+this rule sits on such a model, so it is free.
+
+The other two are both `sudo` de-escalation the checker read as escalation, the same
+class as the `sudo(False)` defect in §3.50 and missed by the same reading. Odoo's
+signature is `sudo(self, flag=True)`, so **`sudo(flag=False)`** is de-escalation by
+keyword and `_escalates` was only reading positional arguments. And **`x.sudo(self.env.su)`**
+sets su to whatever the environment already has, so it cannot raise privilege above
+ambient; core writes it beside the comment *"Unsudo the invoice after creation if not
+already sudoed"*. `sudo(self.env.su or field.compute_sudo)` is deliberately not exempt,
+because the `or` can turn it on.
+
+Rates after all three: **4.7 per 1000 lines** on core, 0.8 on OpenSPP, 3.3 on OCA, with
+244 of 244 hand-classified true positives still found.
+
+**One finding worth acting on outside this project.** Core's
+`ir.model.access.group_names_with_access` interpolates its `access_mode` argument
+straight into SQL as `perm_{access_mode}`, and the only thing constraining it to four
+literals is an `assert`. The method is public and RPC-callable. Odoo does not run under
+`python -O`, so this is latent rather than live, and the assert also turns a bad
+argument into a 500 rather than a clean error — but it is exactly the harm the rule
+describes, found in the reference implementation.
+
+**Still unread on core:** roughly 1,590 findings, led by `naive-and-aware-datetimes`
+(167), `constrains-must-list-every-field-read` (151) and
+`depends-must-not-name-unread-fields` (134).
+
 ## 4. Performance traps, all found by measurement
 
 Within four instrumented runs the report showed the 7B at ~10 tok/s against a
@@ -2265,11 +2672,17 @@ in a corpus; it does not close the reasoning gap.
 
 - 1 of 27 rules has no automated check at all. It returns **no verdict**, never a
   false pass, and `nexa coverage` prints the reason.
-- 16 of the 26 checked rules are decided by a **regex over generated code**. That
+- 12 of the 26 checked rules are decided by a **regex over generated code**. That
   catches textual signatures, not meaning. Code wrong in a way no pattern describes
-  passes silently. The other 10 are decided by an AST pass (§3.12). The regexes also
-  match inside **docstrings**, because `scan_source` strips `#` comments and not
-  string literals — two of the fifty findings in §3.46 were that.
+  passes silently. The other 14 are decided by an AST pass (§3.12, §3.47). The regexes
+  no longer see docstrings, which are emptied before matching; they still see every
+  other string literal, so a violation quoted inside a triple-quoted SQL string or a
+  help text would still be reported.
+- The value trace behind four of those AST checkers (§3.47) reads **one file and one
+  function**. It follows no import and infers no type. A float that arrives as a
+  parameter is still reported as a float comparison; an integer returned by a helper
+  in another module is too. A traversal or a money string that reaches `os.path.join`
+  or `float()` through a helper in another file is not reported at all.
 - Semantic analysis is **Python only**, which is the whole subject now. An answer may
   still contain a JavaScript block, Odoo's web client being OWL; that block gets
   delimiter balance and nothing deeper, and the layer reports UNKNOWN rather than

README.md

@@ -130,10 +130,13 @@ publishing a classification.
 **Not a general linter.** 27 rules. It will not replace `pylint-odoo`, and after the
 wrapper above it does not have to.
 
-**Not a bug finder.** Against real Odoo bugfixes the ORM rules catch 7 of 162 — about
-4%. Most bugs are domain logic ("finished plans should not be the current plan") and no rule
-corpus finds those. Measured and published here because a precision number without a
-recall number beside it is the more flattering half of the picture.
+**Not a bug finder.** Against real Odoo bugfixes the corpus catches 20 of 334 — about
+**6%**, measured across **three** ecosystems and 1,164 fix commits: OpenSPP 6%, the two
+OCA repositories 6%, and odoo core itself 5%. Most bugs are domain logic ("finished
+plans should not be the current plan") and no rule corpus finds those. Measured and
+published here because a precision number without a recall number beside it is the more
+flattering half of the picture. It was 2–4% on two trees before the pass in §3.47; the
+way it moved was reading the missed list, not writing more rules.
 
 **Odoo only, and that is the whole of it.** There was a TypeScript corpus and a
 JavaScript one. They got their first field evidence in September 2026 and it was not
@@ -219,33 +222,45 @@ which a regex cannot.
 
 ### What is wrong with the other half, named
 
-**Three rules fired and were never right.** `decimal-for-money-not-float` is 0 of 3, and
+**Three rules fired and were never right.** `decimal-for-money-not-float` was 0 of 3, and
 this one has a *reason* behind it rather than a sample size: Odoo's `Monetary` field **is
 a float** — the ORM defines it that way — and the framework's answer to the precision
 problem is `float_round` and `float_compare` against the currency's rounding, not
-`Decimal`. Inside an Odoo module the rule fires on the idiom and names a fix that cannot
-be taken. That is an argument and not a measurement, and three findings settle nothing,
-so it is written down here rather than acted on.
-
-`path-join-does-not-contain-a-path` is 0 of 4 — all four join a configured directory to
-a name this module generated, and the pattern matches the *word* `filename` rather than
-anything about where the value came from. `eval-and-pickle-execute-their-input` is 0 of
-1. Four findings between them is not enough to conclude a checker is wrong.
+`Decimal`. Inside an Odoo module the rule fired on the idiom and named a fix that cannot
+be taken. Three findings settle nothing, so it was narrowed rather than culled, on the
+line the argument itself draws: it now fires only where the value is still a string
+when it arrives, which is the one place `Decimal(value)` is available. `float(self.amount)`
+is the ORM's own type and is not reported. Re-run on both trees: **0 findings**, from 3.
+
+`path-join-does-not-contain-a-path` was 0 of 4 — all four join a configured directory to
+a name this module generated, and the pattern matched the *word* `filename` rather than
+anything about where the value came from. It now asks where the value came from instead,
+and reports only a component that arrived from outside the file. Re-run: **0 findings**,
+from 4. That is less than the regex reported, on purpose; everything the regex reported
+was false. `eval-and-pickle-execute-their-input` is 0 of 1, and that one is below.
 
 **Three more never fired at all**, and silence is not a pass: it says 260,000 lines
 contain none of what they look for, which is also what a broken checker says. Two of the
 three are the two ruff already covers, which is the more likely explanation.
 
-**A checker defect, found by classifying rather than by testing.** Two of the 50 are the
-same fault: `scan_source` strips `#` comments before matching and does **not** strip
+**A checker defect, found by classifying rather than by testing.** Two of the 50 were the
+same fault: `scan_source` stripped `#` comments before matching and did **not** strip
 string literals, so `eval()` named in a docstring arguing *against* using it, and a
-`datetime.now()` inside a doctest example, both read as code.
+`datetime.now()` inside a doctest example, both read as code. Docstrings are now emptied
+before any pattern sees the file — docstrings only, since a triple-quoted SQL query is
+data the checkers have a legitimate interest in — with the quotes, the newlines and the
+length left in place so no line or column moves. Both findings are gone on the re-run.
 
 **A suppression that should not have fired.** One finding — a consent-receipt timestamp
-— sits inside a `return` statement that carries a `# nosemgrep: odoo-sudo-without-context`
-marker four lines below it. Suppression reads any marker within the statement without
-asking which rule it names. That is the mute button this project says it will not build,
-reached from the other direction, and it is counted apart here rather than dropped.
+— sat inside a `return` statement carrying a `# nosemgrep: odoo-sudo-without-context`
+marker four lines below it. Suppression read any marker within the statement without
+asking which rule it named. That is the mute button this project says it will not build,
+reached from the other direction. A marker that *says* what it is about — a code with
+words in it — now covers only rules that share one of those words, so a marker about
+sudo no longer speaks for a finding about datetimes, while the 141 OpenSPP sudo sites
+carrying that same marker still read as decided. A code with no words in it, `B608` or
+`E501`, cannot be compared with anything and covers its line as before; that gap is
+named in `layers._marker_is_about` rather than papered over.
 
 ---
 
@@ -528,8 +543,8 @@ The axes are separate because they answer different questions. `severity` is how
 bad it is if this happens; `likelihood` is how likely a finding is the bug, graded
 from what `nexa recall --aim` measured against real fix commits rather than from
 judgement. A rule can be severe and rarely the point — a Python uniqueness check
-really does race, and across 160 fixes not one of them was about that — and one
-field could not say so.
+really does race, and across 237 in-scope fixes in two ecosystems not one of them
+was about that — and one field could not say so.
 
 Everything else is **derived** and must never be hand-edited:
 
@@ -547,13 +562,13 @@ Same principle as `z.infer<typeof Schema>`: one definition, derived artifacts, n
 |---|---|
 | Rules | 27 — 19 Odoo ORM, 8 plain-Python, one stack |
 | Critical | 12 |
-| Machine-checkable | 26 (96%) — 16 by pattern, 10 by AST |
+| Machine-checkable | 26 (96%) — 12 by pattern, 14 by AST |
 | Traceable to upstream docs | 25 (93%), each audited for topic fit |
 | Pattern false positives | 0 cross-hits across the corpus |
 | Recall under meaning-preserving rewrite | 79/79 |
-| Satisfied patterns bypassable by a comment | 0 of 7 |
+| Satisfied patterns bypassable by a comment | 0 of 3 |
 | Retrievable by their own probe | 27 of 27 at top 6, 25 of them at top 3 |
-| Hit rate on 33,960 lines of reviewed OCA code | 3.5 per 1000 lines |
+| Hit rate on 33,960 lines of reviewed OCA code | 3.3 per 1000 lines |
 | Those 120 hits, classified by hand | **86 true positives**, 21 false, 13 undecidable from one file |
 | Hit rate on 226,937 lines of OpenSPP (Odoo 19) | 0.9 per 1000 lines, +69 another tool had already flagged, +71 advisory |
 | Every one of those findings, classified by hand | **157 true positives**, 137 false, 6 undecidable |
@@ -675,6 +690,18 @@ again the only thing that makes the rest of it safe.
 `classification-python-2026-09.json`. The rate went up and the precision went down, and
 that is the trade the section above prices.
 
+**Re-measured again on 2026-09-21, after the six false-positive causes named above were
+closed: 112 hits, 3.3 per 1000 lines.** Four known false positives are gone — three
+`path-join` and one `decimal-for-money` — and three new `float-comparison` findings
+arrived, each read by hand, from a `satisfied_pattern` that had been clearing whole
+files on a `float_compare` written somewhere else in them.
+
+The check that makes all of this safe is the same one every time, and it is worth
+stating as a number rather than a promise: across all five classification artifacts,
+**244 hand-classified true positives, 244 still found, none lost.** That is asserted by
+re-running the checkers against the same two checkouts and matching every `true` verdict
+back to a live finding, not by reading the diff and hoping.
+
 ### The same treatment on a second ecosystem
 
 A precision number from one ecosystem is a precision number for that ecosystem. The two
@@ -747,21 +774,51 @@ are the subject of
 
 ### What is still wrong, named
 
-`float-comparison-needs-float-utils` is next at **2 true, 5 false**. All five compare an
-*integer* to zero — `search_count`, a `read_group` `_count`, `SELECT COUNT(*)` — and the
-regex cannot see it because it matches on the variable's name, not its value. Fixing that
-means tracing the assignment, so it is written down here rather than quietly left out.
-
-`onchange-is-not-validation` is **4 true, 3 false**, and all three false ones are an
-onchange that sets a field rather than enforcing anything — which the rule's existing
-narrowing was supposed to exclude and does not catch when the write is to a Many2one.
-
-The composed-in Python half has four more, each with a number on it:
-`decimal-for-money-not-float` firing on Odoo's own `Monetary` idiom, `path-join`
-matching a variable's name rather than its origin, patterns matching inside docstrings,
-and a suppression marker silencing a rule it was not written about. All four are in
+`float-comparison-needs-float-utils` was **2 true, 5 false**. All five compared an
+*integer* to zero — `search_count`, a `read_group` `_count`, `SELECT COUNT(*)`, a
+`fields.Integer` — and the regex could not see it because it matched the variable's
+name, not its value. Three of the five and both true positives were spelled `total == 0`.
+The checker now follows the assignment, and the five are gone. It also stopped clearing
+the whole file on a `float_compare` anywhere in it, which the old `satisfied_pattern`
+did: on OCA that surfaces three `Monetary` and `Float` fields compared with `!= 0` in
+files that use `float_compare` elsewhere, each read by hand. **OpenSPP 7 → 2, OCA 1 → 3.**
+
+`onchange-is-not-validation` was **4 true, 3 false**, and the three were not what they
+looked like. Each is a four-line onchange that assigns a field, followed by an action
+method that raises — and the regex read 400 characters past the decorator with no way to
+know where the method ended. `_onchange_variable_id` sets a target model; the
+`UserError` 200 characters below it belongs to `action_remap`. Scoped to the decorated
+function, the three are gone. Three new ones arrived in their place and were read: a
+phone-number validation living only in an onchange with no constraint in the file, a
+`_check_date_collected` onchange raising `exceptions.ValidationError` — a spelling the
+regex's `\w*` never matched — and one that clears a field and returns the warning dict.
+Count unchanged at 7; set changed entirely.
+
+The composed-in Python half's four are fixed and measured in
 [the section above](#what-is-wrong-with-the-other-half-named).
 
+`sudo-bypasses-record-rules` now checks four clauses rather than one: a **query** under
+sudo (search, search_count, search_read, read_group), a **touch** (create, write,
+unlink, copy, read), a sudo recordset bound to a name and **passed on**, and a name
+**rebound** to its own sudo form. The query clause is the one that was always checked
+and it keeps its 6 hand-classified true positives.
+
+Every live finding the new clauses made across both trees was read by hand — **0 true,
+24 false**, in `classification-sudo-2026-09.json`. Each is code where the caller is an
+administrator by construction, a demo-data seeder or a wizard behind
+`group_account_manager`, or a framework model with no tenant boundary at all. So the
+touch and escape clauses report at likelihood `unproven`, which makes their findings
+advisory: shown, counted apart, gating nothing. The grade is carried by the finding and
+not by the rule, so the query clause keeps `defect`. A clause the rule's own sentence
+asks for is worth having under measurement; a clause measured at zero is not worth
+failing a build on.
+
+The rebind clause is the exception and keeps `defect`, because it has the one thing the
+others lack: an incident. It turns the miss this README names by hand —
+*"remove sudo() when importing record"* — into an on-target catch, which is the same
+evidence every other `defect` grade in the corpus rests on. It also produces one false
+positive at HEAD, and both facts are in the artifact.
+
 What the first run found:
 
 - **`onchange-is-not-validation`** fired on all 16 `@api.onchange` declarations that
@@ -801,16 +858,22 @@ and again after. A finding that was there before, is gone after, **and sat on a
 line the fix actually changed** is the corpus noticing the bug that was really
 fixed.
 
-Across 385 fix commits in those two repositories, 56 of which touched a construct
+Across 386 fix commits in those two repositories, 64 of which touched a construct
 the corpus covers:
 
-| | |
-|---|---|
-| Caught | **1** |
-| Missed | 55 |
-| Rules that caught anything | 1 of 14 |
+| | 2026-09-16 | 2026-09-21 |
+|---|---|---|
+| Caught | 1 | **4** |
+| Missed | 55 | 60 |
+| Recall against in-scope fixes | 2% | **6%** |
+| Rules that caught anything | 1 of 14 | **3 of 27** |
 
-That last condition, *on a line the fix changed*, is the entire measurement.
+The right-hand column is after the pass in §3.47 of ARCHITECTURE. Three of the
+four catches are `sudo-bypasses-record-rules`, which grew the two clauses its own
+sentence always asked for; the in-scope denominator went up as well, from 56 to
+64, because the corpus now covers more constructs than it did.
+
+That condition, *on a line the fix changed*, is the entire measurement.
 Without it, any refactor that moves code counts as a catch. The first version of
 this tool did not have it and reported **12**. Reading the commit subjects killed
 the result: *"fix image url in locales with thousand separator"*, *"poor
@@ -820,18 +883,25 @@ because a dereference moved.
 
 **What this means, stated plainly.** Nexa is precise and narrow. It is right
 about what it describes, and it describes very little of what actually goes
-wrong. The 55 misses include bugs squarely inside its own stated territory:
-
-- *"remove sudo() when importing record"* — `sudo-bypasses-record-rules` exists
-- *"prevent removal of x2many values from inaccessible companies"* — a
-  multi-company leak, which `check-company-on-relations` is about
-- *"log computed fields stored in db as expected"* — a stored compute
-
-**What this does not mean.** The denominator is generous. Many of those 56
-commits touched a covered construct while fixing something else entirely, so 2%
+wrong. Three bugs squarely inside its own stated territory were named here as
+misses, and one of them is now a catch:
+
+- *"remove sudo() when importing record"* — **caught, 2026-09-21.** The line the
+  fix deletes is `self = self.sudo()`, which rebinds the method's own receiver so
+  that everything below it runs elevated without naming sudo again. Every clause
+  looking for `.sudo().method()` was blind to it. The commit says what it cost:
+  *"finding multiple records across all companies during import when they have
+  same record name."*
+- *"prevent removal of x2many values from inaccessible companies"* — still
+  missed. A multi-company leak, which `check-company-on-relations` is about.
+- *"log computed fields stored in db as expected"* — still missed. A stored
+  compute.
+
+**What this does not mean.** The denominator is generous. Many of those 64
+commits touched a covered construct while fixing something else entirely, so 6%
 understates recall against validation bugs specifically. Two repositories in one
-ecosystem is also a narrow sample. The number is a floor, and it is the first
-floor this project has had.
+ecosystem is also a narrow sample. The number is still a floor; it is a higher
+one than it was.
 
 The missed list is the more useful output. Every entry is a bug somebody
 actually fixed that the corpus had nothing to say about, which makes it a
@@ -869,32 +939,126 @@ clusters the fixes the corpus did not flag on the line of the fix by the constru
 each diff touched, so the reading order is the writing order. Against **OpenSPP 2
 (Odoo 19)** — a second ecosystem on a newer series than the OCA repositories:
 
-| | |
-|---|---|
-| Fix commits examined | 406 |
-| …touching a construct the corpus covers | 160 |
-| Caught | 6 |
-| Recall against in-scope fixes | 4% |
-
-Two repositories, two ecosystems, 2–4% both times. The floor is a floor — and the
-clustering says where to dig:
+| | 2026-09-16 | 2026-09-21 |
+|---|---|---|
+| Fix commits examined | 406 | 409 |
+| …touching a construct the corpus covers | 160 | 173 |
+| Caught | 6 | **11** |
+| Recall against in-scope fixes | 4% | **6%** |
+
+**A third ecosystem, and it agrees.** The criticism this section used to carry was that
+two repositories in one ecosystem is a narrow sample. So the same pass was run against
+**odoo core 18.0** — 559,663 lines, 190,000 commits — capped at 400 fix commits:
+
+| | OpenSPP | OCA | odoo core | all three |
+|---|---|---|---|---|
+| Fix commits examined | 409 | 386 | 369 | **1,164** |
+| …touching a covered construct | 173 | 64 | 97 | **334** |
+| Caught | 11 | 4 | 5 | **20** |
+| Recall against in-scope fixes | 6% | 6% | 5% | **6%** |
+
+Three ecosystems arriving at the same number from different directions is worth more
+than any one of them. It was 2% and 4% on two trees before this pass. The floor is
+still a floor; it is a better-founded one.
+
+Precision on core is higher than on either other tree: **2,663 findings at 4.8 per 1000
+lines** after the narrowing below. Odoo core is the reference implementation, so a rate
+there is a statement about the rules and not about somebody's house style.
+
+**The first classification here that is a sample rather than a census.** Reading all
+2,784 findings is not a session's work, and 2,784 is twenty-five times any set read here
+before. So 15 findings of the largest rule — `stored-compute-needs-complete-depends`,
+1,051 of the total — were drawn with a fixed seed and read by hand:
+**11 true, 4 false**, in `classification-odoo-core-2026-09.json`. That is 73%, with a
+95% Wilson interval of roughly 48% to 89%. The interval is wide, and it is the honest
+number for fifteen: it says the rule is not mostly noise on core and not much more. The
+draw reproduces from the artifact's own description, without the script that made it.
+
+All four false verdicts have one cause. `odoo/models.py` gives every model
+`display_name = fields.Char(automatic=True, compute='_compute_display_name', ...)` with
+**no store**, so an override that omits a dependency cannot leave a stale row: there is
+no row. The checker read "not declared in this file" as unknown and kept the finding,
+which is right for a field declared in another module and wrong for one the framework
+declares itself. **121 of that rule's 1,051 findings on core were this shape.** The
+narrowing is free and that was checked, not assumed: all ten hand-verified true
+positives that compute `display_name` declare `store=True` on it in their own file, so
+they are untouched.
+
+The larger thing the sample turned up was deliberately **not** acted on. 837 of core's
+1,360 stored computes are `readonly=False` — the "compute a smart default, then let the
+user own it" pattern, where a narrow `@api.depends` is often protecting a user's edit
+rather than forgetting a dependency. That would explain most of this rule's volume on
+core, and it is not a safe narrowing: three of the 47 resolvable hand-verified true
+positives are themselves `readonly=False`, and so are nine of the eleven true verdicts
+in this sample. The number big enough to justify the rule is the number that refutes it.
+
+The next three rules by volume were read the same way, 15 each, so 60 of core's findings
+are now classified across the four rules that make 70% of them:
+
+| rule | core | previously measured |
+|---|---|---|
+| `ondelete-is-a-decision` | **13/15** | 12/12 OCA, 14/14 OpenSPP |
+| `stored-compute-needs-complete-depends` | **11/15** | 49/57 OCA |
+| `assert-is-not-validation` | **3/15** | 6/10 OCA |
+| `sudo-bypasses-record-rules` | **0/15** | 6 true on OpenSPP |
+
+**Precision turns out to depend on what kind of code is under review**, and this is the
+first tree here that made that legible. Two rules hold up. Two collapse, and not because
+the checkers broke. `assert-is-not-validation`'s own true class is *the asserted value
+came from outside the module*, and a framework's asserts are invariants between its own
+components — the registry, the field descriptors, the query builder — where there is no
+outside. `sudo-bypasses-record-rules` describes an application leaking between tenants,
+and core is the thing that implements tenancy: every finding is a public route resolving
+a token before identity exists, a delete guard that must see what the caller cannot, or
+a cross-company sync whose whole purpose is to cross companies.
+
+Neither moves a grade. A precision number is about a subject, and nobody reviews odoo
+core with this. It is the strongest argument so far that one precision figure for "the
+corpus" says less than the same figure per kind of codebase.
+
+Reading them turned up three more checker defects, all of the same family as the
+`sudo(False)` one above: a model with `_auto = False` is a SQL view with no foreign key,
+so `ondelete` is not a decision about it; `sudo(flag=False)` is de-escalation by
+keyword; and `x.sudo(self.env.su)` restores the ambient level and cannot raise
+privilege. Core is now **2,650 findings at 4.7 per 1000 lines**.
+
+One finding is worth acting on outside this project. Core's
+`ir.model.access.group_names_with_access` interpolates its `access_mode` argument
+straight into SQL as `perm_{access_mode}`, and the only thing constraining it to four
+literals is an `assert`. The method is public and RPC-callable. Odoo does not run under
+`python -O`, so it is latent rather than live — but it is exactly the harm the rule
+describes, in the reference implementation.
+
+Still unread: roughly 1,590 findings on core, led by `naive-and-aware-datetimes` (167),
+`constrains-must-list-every-field-read` (151) and `depends-must-not-name-unread-fields`
+(134).
+
+Where the OpenSPP clustering stands now:
 
 ```
-        missed  caught  spoke  silent
-.sudo(      70       6     47      23
-api.depends 23       0     16       7
-api.constrains 16    0     12       4
-ondelete    13       0     10       3
+             missed  caught  spoke  silent
+.sudo(           67       9     52      15
+ValidationError  40       2     27      13
+Many2one         26       1     14      12
+api.depends      23       0     14       9
+noupdate         22       0      9      13
+api.constrains   16       0     10       6
 ```
 
 **`spoke` is the column that changed the reading.** A miss is not automatically a
 blind spot: a checker firing somewhere else in the same file means the rule exists
-and is aimed wrong, which wants a sharper rule rather than a new one. Ninety-two of
-the 154 misses are that. The first version of this table reported `21x api.depends
-(nothing caught here)`, which reads as a missing rule — and the checker was in fact
-firing on sixteen of those files while the fixes went elsewhere.
-
-Reading the diffs behind the seven that really were silent produced one rule,
+and is aimed wrong, which wants a sharper rule rather than a new one. Ninety-seven
+of the 162 misses are that. The first version of this table reported `21x
+api.depends (nothing caught here)`, which reads as a missing rule — and the checker
+was in fact firing on sixteen of those files while the fixes went elsewhere.
+
+`.sudo(` stayed the largest cluster and was worked twice. Its silent column fell
+from 23 to 15 and its caught column rose from 6 to 9, because the rule grew the two
+clauses its own sentence asked for and then a third, `self = self.sudo()`, taken
+from a miss in the OCA list. `noupdate` is now the cluster with the most silence
+against the least coverage, and it is next.
+
+Reading the diffs behind the seven that were silent produced one rule,
 `odoo.depends-must-not-name-unread-fields`. Two of the remaining rules in this corpus
 came from the crosswalk below.
 

bin/context.py

@@ -49,6 +49,13 @@ _RULE_DOMAIN_RE = re.compile(
 # real filter, because deciding that a domain is vacuous in general means
 # evaluating it.
 _VACUOUS_DOMAIN = re.compile(r"^\[\s*\(\s*1\s*,\s*[\"']=[\"']\s*,\s*1\s*\)\s*\]$")
+
+# The left operand of every leaf in a domain: the fields the rule filters ON.
+# A domain is a flat list of triples once the operators are ignored, and the
+# first element of each is a field path. Read for one purpose only -- deciding
+# whether a call under sudo names the field the rule it bypasses is about --
+# and a field this fails to read simply is not offered as an exemption.
+_RULE_FIELD_RE = re.compile(r"[\(\[]\s*[\"']([a-z_][a-z0-9_.]*)[\"']\s*,")
 _NAME_RE = re.compile(r"[\"']name[\"']\s*:\s*[\"']([^\"']+)[\"']")
 _MODEL_RE = re.compile(r"^\s*_(?:name|inherit)\s*=\s*[\"']([a-z0-9_.]+)[\"']", re.M)
 _ODOO_IMPORT_RE = re.compile(r"^\s*from\s+odoo[\w.]*\s+import\s+(.+)$", re.M)
@@ -263,7 +270,7 @@ def tree_facts(paths, complete=True):
 
     declared, deleted = set(), set()
     unlink_tokens = set()
-    ruled = set()
+    ruled = {}
     multi_company = False
     seen = 0
     # Every series the manifests in this walk name. Kept as a set because
@@ -297,7 +304,8 @@ def tree_facts(paths, complete=True):
                                          semantics.MULTI_COMPANY_MARKERS):
                 multi_company = True
             if "ir.rule" in body:
-                ruled |= _models_with_a_filtering_rule(body)
+                for model, fields in _models_with_a_filtering_rule(body).items():
+                    ruled.setdefault(model, set()).update(fields)
 
     # Access tokens are matched FORWARDS, from each declared model to the token
     # it would have. Parsing `model_sale_order_line` back into a dotted name is
@@ -312,6 +320,7 @@ def tree_facts(paths, complete=True):
     return {"walked": True, "complete": complete, "files": seen,
             "models_declared": declared, "models_deleted": deleted,
             "models_record_ruled": ruled,
+            "models_rule_fields": {m: tuple(sorted(f)) for m, f in ruled.items()},
             "multi_company": multi_company,
             "odoo_series": pinned.pop() if len(pinned) == 1 else None}
 
@@ -342,7 +351,7 @@ def _models_with_a_filtering_rule(body):
     pattern silently lost them; and a model whose rules are all unreadable is a
     model nobody can show is protected, which is a finding worth making anyway.
     """
-    found = set()
+    found = {}
     for block in _IR_RULE_RE.findall(body):
         ref = _RULE_MODEL_RE.search(block)
         if not ref:
@@ -354,7 +363,15 @@ def _models_with_a_filtering_rule(body):
         text = " ".join(domain.group(1).split()) if domain else ""
         if text and _VACUOUS_DOMAIN.match(text):
             continue
-        found.add(token[len("model_"):].replace("_", "."))
+        model = token[len("model_"):].replace("_", ".")
+        fields = found.setdefault(model, set())
+        for path in _RULE_FIELD_RE.findall(text):
+            # Both the path and the relation it starts from. A rule reading
+            # `case_id.case_worker_id` is satisfied by a create that names
+            # `case_id`, because the case it points at is one the caller
+            # can already see and the rule follows the link to find out.
+            fields.add(path)
+            fields.add(path.split(".", 1)[0])
     return found
 
 
@@ -390,6 +407,28 @@ def model_is_record_ruled(facts, model):
     return ABSENT if model in facts.get("models_declared", ()) else UNKNOWN
 
 
+def model_rule_fields(facts, model):
+    """The fields this model's own filtering rules are written about.
+
+    `[('case_worker_id', '=', user.id)]` yields `case_worker_id`, and
+    `[('case_id.case_worker_id', '=', user.id)]` yields both the path and
+    `case_id`, the relation it is reached through.
+
+    This exists so a call under sudo can be compared against the rule it
+    would actually bypass, instead of against the word `company_id`. A
+    per-user rule is as real as a multi-company one -- OpenSPP's case models
+    are governed entirely by `case_worker_id` and `case_id.case_worker_id`,
+    and not one of them has a company rule at all -- so a checker that knows
+    only the multi-company spelling cannot see when the advice was followed.
+
+    Empty for a model nobody declared a readable rule for, which offers no
+    exemption and leaves the finding standing.
+    """
+    if not facts or not facts.get("walked") or not model:
+        return ()
+    return tuple(facts.get("models_rule_fields", {}).get(model, ()))
+
+
 def _models_granted_unlink(body):
     """The `model_id:id` tokens an ir.model.access.csv grants perm_unlink on."""
     rows = list(csv.reader(io.StringIO(body)))

bin/layers.py

@@ -246,6 +246,14 @@ def check_compliance(text, rules):
     is exactly what the 7B did. This checks the generated code for each rule's
     violation signature instead.
 
+    Semantic checkers count here too. They did not, and the omission was
+    invisible because it looked like coverage: a rule whose checker moved from
+    a regex to an AST pass silently stopped being checked against generated
+    code, and this function's own motivating example -- a model citing
+    'onchange is not validation' and then writing an onchange -- is one of
+    the rules that moved. A checker that cannot see the answer is not a
+    stricter checker.
+
     Kept as a module-level function with the original signature because pipeline
     and corpus both call it directly; the domain layer wraps it.
     """
@@ -255,13 +263,25 @@ def check_compliance(text, rules):
     views = {}
     violations, checked = [], []
     for r in rules:
-        if not r.get("violation_pattern"):
+        pattern, check = r.get("violation_pattern"), r.get("semantic_check")
+        if not pattern and not check:
             continue
         checked.append(r["id"])
         kind = comment_kind(r.get("stack"))
         if kind not in views:
             views[kind] = semantics.strip_comments(code, kind)
-        if fires(r, views[kind], stripped=True):
+        hit = False
+        if check:
+            # An answer whose code does not parse is a syntactic finding and
+            # is reported as one; here it simply produces no semantic hit,
+            # exactly as a pattern that does not match produces none.
+            try:
+                hit = bool(semantics.run_check(check, code))
+            except (SyntaxError, ValueError, RecursionError):
+                hit = False
+        if not hit and pattern:
+            hit = fires(r, views[kind], stripped=True)
+        if hit:
             violations.append((r["id"], r["severity"], r["title"]))
     return violations, checked
 
@@ -276,6 +296,98 @@ SUPPRESSION_MARKERS = ("noqa", "nosemgrep", "nosec", "pylint: disable",
                        "pylint:disable", "type: ignore", "eslint-disable",
                        "@ts-ignore", "@ts-expect-error")
 
+# What a marker names, if it names anything: `# noqa: E501`,
+# `# nosemgrep: odoo-sudo-without-context`, `# pylint: disable=no-member`,
+# `# type: ignore[arg-type]`, `# nosec B608`. A marker with nothing after it
+# is bare and is about whatever was on that line.
+_MARKER_CODES = re.compile(
+    r"(?:" + "|".join(re.escape(m) for m in SUPPRESSION_MARKERS) + r")"
+    r"\s*[:=\[]?\s*([A-Za-z][A-Za-z0-9_.\-]*(?:\s*[,\s]\s*[A-Za-z][A-Za-z0-9_.\-]*)*)?")
+
+# A code that SAYS what it is about: two or more parts joined by -, _ or .,
+# with a real word among them. `odoo-sudo-without-context` and `no-member`
+# qualify; `B608`, `E501` and `W0212` do not, and neither does the prose
+# people write after a colon -- `# noqa: decided, TICKET-9`. Only a code in
+# the first group can be compared with a rule id at all, so only that group
+# is narrowed; everything else keeps the behaviour it had.
+_SPEAKING_CODE = re.compile(r"^(?=[^A-Za-z]*[A-Za-z]{3})"
+                            r"[A-Za-z0-9]+(?:[-_.][A-Za-z0-9]+)+$")
+
+# Words that identify a vendor or a language rather than a defect. A code and
+# a rule id sharing only these has not said they are about the same thing.
+_UNDISTINGUISHING = frozenset([
+    "odoo", "python", "py", "js", "ts", "oca", "openspp", "rule", "rules",
+    "the", "a", "an", "and", "or", "of", "in", "on", "to", "for", "is", "are",
+    "be", "not", "no", "it", "its", "this", "that", "with", "without", "do",
+    "does", "must", "should", "needs", "need", "use", "used", "using", "by",
+    "from", "at", "as", "all", "any", "every", "one", "two", "disable",
+    "ignore", "expect", "error", "warning", "check", "checks", "bad",
+])
+
+
+def _tokens(text):
+    return {t for t in re.split(r"[^A-Za-z0-9]+", text.lower())
+            if t and t not in _UNDISTINGUISHING}
+
+
+def _marker_scope(text):
+    """(carries a marker, codes it names). An empty code set means bare.
+
+    The first thing after a marker decides. `# nosec B608` names an opaque
+    analyser code, `# noqa: decided, TICKET-9` is somebody talking -- neither
+    can be compared with a rule id, so both read as bare and cover the line
+    the way they always did. A marker whose first code is legible narrows to
+    what it names.
+    """
+    if not any(marker in text for marker in SUPPRESSION_MARKERS):
+        return False, set()
+    codes = set()
+    for match in _MARKER_CODES.finditer(text):
+        named = match.group(1)
+        if not named:
+            return True, set()          # bare: about whatever is on the line
+        parts = [p for p in re.split(r"[,\s]+", named.strip()) if p]
+        if not parts or not _SPEAKING_CODE.match(parts[0]):
+            return True, set()
+        codes.update(p for p in parts if _SPEAKING_CODE.match(p))
+    return True, codes
+
+
+def _marker_is_about(rule, codes):
+    """Does a marker naming these codes speak about this rule?
+
+    A marker that names nothing is about the line and covers anything on it,
+    which is how 105 of OpenSPP's 106 `.sudo().search(` findings were read.
+    A marker that DOES name something has said what it is about, and reading
+    it as covering everything is the mute button this project will not build
+    -- reached from the other direction. Classifying 50 findings by hand found
+    one: a consent-receipt timestamp silenced by a
+    `# nosemgrep: odoo-sudo-without-context` four lines below it, which is a
+    marker about sudo suppressing a finding about datetimes.
+
+    Matched on shared words rather than a mapping table, because no table
+    exists between somebody else's rule ids and ours, and `crosswalk` builds
+    one only for the analyser it was pointed at. Vendor and language words do
+    not count, so `odoo-sudo-without-context` and
+    `odoo.sudo-bypasses-record-rules` meet on `sudo` and not on `odoo`.
+
+    The direction of error is stated: a code this cannot relate to a rule
+    leaves the finding REPORTED, which is the side that shows too much rather
+    than the side that hides.
+
+    What is left open, and named rather than quietly accepted: an opaque code
+    still covers the line. `# noqa: E501` is a decision about line length and
+    reads here as a decision about whatever else is on that line, because
+    E501 carries no words to compare. Closing it means a table of another
+    analyser's codes, which is what `crosswalk` builds for one analyser at a
+    time and is not something this function can assume it has.
+    """
+    if not codes:
+        return True
+    subject = _tokens(rule.get("id", "").split(".", 1)[-1])
+    subject.update(_tokens(" ".join(rule.get("tags", []) or [])))
+    return any(_tokens(code) & subject for code in codes)
+
 # Statement kinds a marker is allowed to reach across. Every one of these is a
 # SIMPLE statement: it has no body of its own, so its line span is the span of
 # one expression and nothing else can hide inside it. Compound statements are
@@ -285,8 +397,28 @@ _SIMPLE_STMTS = (ast.Assign, ast.AnnAssign, ast.AugAssign, ast.Expr,
                  ast.Return, ast.Raise, ast.Assert, ast.Delete)
 
 
+def _advisory_grades():
+    """The likelihoods that make a finding advisory, from the one list.
+
+    Imported lazily because corpus imports this module, and the grades a
+    finding can carry must be one list rather than one here and another in
+    the validator -- the same reason evidence hashing lives in one place.
+    """
+    import corpus       # local: corpus imports layers, so not at module level
+    return corpus.ADVISORY_LIKELIHOODS
+
+
 def _simple_statement_spans(body):
-    """(start, end) for every simple statement in a Python source, widest last.
+    """(start, end, own_start) for every simple statement, widest last.
+
+    `start` reaches one line above the statement to take in a marker written
+    there; `own_start` is where the statement itself begins. Both are needed
+    because the borrowed line makes two statements overlap, and a finding on
+    the first line of one is inside the borrowed line of the one below it. On
+    OpenSPP that mattered exactly once and read as a missing suppression:
+    `self.client_id.sudo().write(...)` on line 37 carries its nosemgrep on 36
+    and is followed by a `return` on 38, whose own span borrows 37. Two spans
+    of equal width contained the line and the wrong one was picked.
 
     A finding anchors on one line, and a suppression marker written about that
     finding may sit on another line of the SAME expression. Measured on
@@ -319,7 +451,7 @@ def _simple_statement_spans(body):
                 # 36 of OpenSPP's 105 sit there, above a statement that fits on
                 # one line and has no room for anything else. Reading the same
                 # convention the marker was written under is not obeying it.
-                spans.append((max(1, start - 1), end))
+                spans.append((max(1, start - 1), end, start))
     return spans
 
 
@@ -405,24 +537,33 @@ def scan_source(body, rules, stack, errors=None, facts=None, gaps=None):
     # call will read as unsuppressed when a person had in fact marked it.
     spans = _simple_statement_spans(body) if comment_kind(stack) == "python" else []
 
-    def _has_marker(text):
-        return any(marker in text for marker in SUPPRESSION_MARKERS)
+    def _speaks_to(text, rule):
+        carries, codes = _marker_scope(text)
+        return carries and _marker_is_about(rule, codes)
 
-    def marked(line):
+    def marked(line, rule):
         text = rows[line - 1] if 0 < line <= len(rows) else ""
-        if _has_marker(text):
+        if _speaks_to(text, rule):
             return True
         # The smallest simple statement containing this line, if any: a marker
         # written inside one expression covers that expression and stops there.
+        #
+        # A statement that really covers the line beats one that only reaches
+        # it through the comment line it borrowed from above. Without that,
+        # two spans of equal width tie and the loser is whichever ast.walk
+        # happened to reach first.
         best = None
-        for start, end in spans:
-            if start <= line <= end and (best is None or
-                                         (end - start) < (best[1] - best[0])):
-                best = (start, end)
+        for start, end, own in spans:
+            if not start <= line <= end:
+                continue
+            rank = (0 if own <= line else 1, end - start)
+            if best is None or rank < best[0]:
+                best = (rank, start, end)
         if best is None:
             return False
-        return any(_has_marker(rows[n - 1]) for n in range(best[0], best[1] + 1)
-                   if 0 < n <= len(rows))
+        _, start, end = best
+        return any(_speaks_to(rows[n - 1], rule)
+                   for n in range(start, end + 1) if 0 < n <= len(rows))
 
     # One parse for the whole file, before any semantic checker runs, so that
     # "nothing to say" and "could not read it" stop being the same output. Only
@@ -463,7 +604,7 @@ def scan_source(body, rules, stack, errors=None, facts=None, gaps=None):
                     continue
                 seen.add(line)
                 out.append(SourceHit(rule["id"], rule["severity"], line,
-                                     line_at(body, line), marked(line),
+                                     line_at(body, line), marked(line, rule),
                                      bool(rule.get("advisory")),
                                      rule.get("likelihood", "unmeasured")))
         elif rule.get("semantic_check"):
@@ -479,8 +620,19 @@ def scan_source(body, rules, stack, errors=None, facts=None, gaps=None):
             for line, message, grade in found:
                 # A grade means a trigger fired on THIS finding and earned it a
                 # likelihood of its own. Absent, the rule's grade stands.
+                #
+                # Advisory follows the grade, per hit as well as per rule. The
+                # corpus already derives a rule's `advisory` flag from its
+                # likelihood, and a finding that earned `unproven` on its own
+                # evidence has earned the same treatment: reported, out of the
+                # rate, gating nothing. Without this a clause measured at zero
+                # true positives would gate a build on the strength of the
+                # clause beside it, which is the rule's grade answering for a
+                # finding it was not measured on.
                 out.append(SourceHit(rule["id"], rule["severity"], line, message,
-                                     marked(line), bool(rule.get("advisory")),
+                                     marked(line, rule),
+                                     bool(rule.get("advisory"))
+                                     or grade in _advisory_grades(),
                                      grade or rule.get("likelihood",
                                                        "unmeasured")))
     if unparsed is not None and gaps is not None:

bin/semantics.py

@@ -398,6 +398,15 @@ def _declared_covers(read, declared):
     return any(d == read or d.startswith(read + ".") for d in declared)
 
 
+# Fields the ORM adds to every model itself, with a declaration this corpus
+# can read and a default of NOT stored. A model that wants one of these in the
+# database says so in its own file, and then the ordinary storedness test sees
+# it. Only display_name is here: the other automatic fields -- id, create_uid,
+# create_date, write_uid, write_date -- are never computed by module code, so
+# listing them would be describing a shape nobody writes.
+FRAMEWORK_UNSTORED = frozenset(["display_name"])
+
+
 def depends_covers_compute_reads(code, gaps=None):
     """odoo.stored-compute-needs-complete-depends
 
@@ -467,6 +476,24 @@ def depends_covers_compute_reads(code, gaps=None):
             continue
         registered = set(declared)
         produced = _assigned_attrs(fn)
+        if produced and produced <= FRAMEWORK_UNSTORED and \
+                storedness.get(fn.name) is None:
+            # A field the framework adds to every model, which this file does
+            # not redeclare. "Unknown storedness" is the right reading for an
+            # ordinary field declared in another module; it is the wrong one
+            # here, because the framework's own declaration is visible and
+            # says not stored. odoo/models.py adds display_name as
+            # `fields.Char(automatic=True, compute='_compute_display_name',
+            # search=...)` with no store, so an override that omits a
+            # dependency cannot leave a stale row: there is no row.
+            #
+            # 121 of the 1051 findings this rule made on odoo core were
+            # _compute_display_name overrides of exactly that shape. The
+            # narrowing costs nothing measurable: all 10 hand-verified true
+            # positives that compute display_name -- every one of them in
+            # OpenSPP -- declare `store=True` on it in their own file, so
+            # storedness reads True for them and they are untouched.
+            continue
         missing = {}
         for path, lineno in _field_reads(fn, _aliases(fn)):
             while len(path) > 1 and path[-1] in ORM_ATTRS:
@@ -885,21 +912,40 @@ def _is_true(node):
     return isinstance(node, ast.Constant) and node.value is True
 
 
+def _is_sql_view(cls):
+    """True for a model declaring `_auto = False`: a SQL view, not a table.
+
+    Odoo builds no table for one and therefore no foreign key, so `ondelete`
+    is not a decision anybody can make about it -- there is no constraint for
+    a value to be chosen for. Two of the 15 sampled ondelete findings on odoo
+    core were report models of exactly this kind, hr.contract.history and
+    purchase.bill.line.match.
+    """
+    for node in cls.body:
+        if not isinstance(node, ast.Assign):
+            continue
+        if any(isinstance(t, ast.Name) and t.id == "_auto" for t in node.targets):
+            return isinstance(node.value, ast.Constant) and node.value.value is False
+    return False
+
+
 def _transient_spans(tree):
-    """Line ranges of every TransientModel class in this tree.
+    """Line ranges of every class this rule family does not apply to.
 
     A wizard's record is vacuumed, so the failure both ondelete-is-a-decision
     and stored-compute-needs-complete-depends describe -- a value written once
-    and read wrong much later -- has no time in which to happen. Returned as
-    spans because the declarations and methods they gate are found by walking
-    the whole tree, which loses the class on the way down.
+    and read wrong much later -- has no time in which to happen. A `_auto =
+    False` model has no table at all, which rules out the same failure for a
+    different reason: see _is_sql_view. Returned as spans because the
+    declarations and methods they gate are found by walking the whole tree,
+    which loses the class on the way down.
 
     check_company_missing_on_company_owned_relation already had this exemption
     and iterates classes directly; these two do not, hence the spans.
     """
     return [(n.lineno, getattr(n, "end_lineno", n.lineno))
             for n in ast.walk(tree)
-            if isinstance(n, ast.ClassDef) and _is_transient(n)]
+            if isinstance(n, ast.ClassDef) and (_is_transient(n) or _is_sql_view(n))]
 
 
 def _within(spans, lineno):
@@ -1837,78 +1883,822 @@ def declares_multi_company(code):
     return any(marker in view for marker in MULTI_COMPANY_MARKERS)
 
 
-def sudo_search_drops_a_real_rule(code, facts=None):
-    """odoo.sudo-bypasses-record-rules
+# ------------------------------------------- where a value came from
+#
+# Four rules were classified false for the same reason: each matched a
+# variable's NAME and called that evidence about its value. `total == 0` is a
+# float comparison in one function and an exact integer test in the next;
+# `filename` says nothing about whether a caller chose it. Telling those apart
+# needs the assignment, which is what this section reads.
+#
+# It is a local trace and nothing more. One file, one function, no imports
+# followed and no types inferred -- which is enough for the shapes that were
+# actually misread, and the limit is stated here rather than discovered later.
 
-    Fires on `<model>.sudo().search(...)` where the model actually carries an
-    ir.rule that filters something, and the domain does not re-apply company
-    scoping by hand.
-
-    The regex this replaces asked only the first half of the question -- is
-    there a `.sudo().search(` -- and on OpenSPP that was 106 findings of which
-    6 were the thing the rule describes. The rule's own sentence is that sudo
-    "drops ir.rule filtering". Where the tree declares no filtering rule for
-    that model, there is nothing to drop and the finding is about a mechanism
-    that does not exist here. Classified by hand, that was 83 of the 106:
-    73 on models with no rule at all, and 10 on spp.vocabulary.code, whose
-    single rule is `[(1, '=', 1)]` and filters nothing.
-
-    The trigger only ever SUPPRESSES. A model the walk could not name, a tree
-    that was not walked, a partial walk -- each reads UNKNOWN and the finding
-    stands, because "no rule was found" and "nobody looked" must not be the
-    same answer on a critical rule. `nexa check` on one file therefore behaves
-    exactly as it did before this trigger existed.
+def _function_of(tree):
+    """Maps every node to the function that encloses it, innermost winning.
+
+    Lambdas count. `filtered(lambda x: x.qty == 0)` is where one of the
+    misreadings lived, and a lambda binds its arguments exactly as a def does.
+    """
+    owner = {}
+    scopes = [n for n in ast.walk(tree)
+              if isinstance(n, (ast.FunctionDef, ast.AsyncFunctionDef, ast.Lambda))]
+    # Outermost first, so an inner scope overwrites the outer one's claim.
+    scopes.sort(key=lambda n: (getattr(n, "lineno", 0),
+                               getattr(n, "col_offset", 0)))
+    for fn in scopes:
+        for node in ast.walk(fn):
+            owner[id(node)] = fn
+    return owner
+
+
+def _final_name(node):
+    """The last identifier in a Name or Attribute, or None for anything else."""
+    if isinstance(node, ast.Name):
+        return node.id
+    if isinstance(node, ast.Attribute):
+        return node.attr
+    return None
+
+
+def _chain_root(node):
+    """The leftmost Name in a chain of attributes, calls and subscripts."""
+    while True:
+        if isinstance(node, ast.Attribute):
+            node = node.value
+        elif isinstance(node, ast.Subscript):
+            node = node.value
+        elif isinstance(node, ast.Call):
+            node = node.func
+        else:
+            break
+    return node.id if isinstance(node, ast.Name) else None
 
-    What it still over-reports, measured and not yet fixed: 14 of the remaining
-    20 constrain the search to records the caller had already identified -- a
-    group id, a partner id, an area -- which is the rule's advice followed in a
-    spelling the rule does not recognise, since it names only company_id. That
-    is a worklist entry rather than a narrowing, because deciding in general
-    that a domain is already scoped means evaluating it, and a narrowing that
-    guesses would cost the 6 true positives this keeps.
+
+def _targets(node):
+    """Every Name a statement binds, whatever the binding form."""
+    found = []
+    for sub in ast.walk(node):
+        if isinstance(sub, ast.Name) and isinstance(sub.ctx, (ast.Store, ast.Del)):
+            found.append(sub.id)
+    return found
+
+
+def _bound_in(fn):
+    """Names this scope binds: parameters, assignments, loops, withs, imports."""
+    if fn is None:
+        return set()
+    names = set()
+    args = getattr(fn, "args", None)
+    if args is not None:
+        for group in (args.args, args.posonlyargs, args.kwonlyargs):
+            names.update(a.arg for a in group or [])
+        for extra in (args.vararg, args.kwarg):
+            if extra is not None:
+                names.add(extra.arg)
+    for node in ast.walk(fn):
+        if isinstance(node, (ast.Assign, ast.AnnAssign, ast.AugAssign, ast.For,
+                             ast.AsyncFor, ast.comprehension, ast.NamedExpr)):
+            names.update(_targets(node))
+        elif isinstance(node, (ast.With, ast.AsyncWith)):
+            for item in node.items:
+                if item.optional_vars is not None:
+                    names.update(_targets(item.optional_vars))
+        elif isinstance(node, ast.ExceptHandler) and node.name:
+            names.add(node.name)
+        elif isinstance(node, (ast.Import, ast.ImportFrom)):
+            names.update((a.asname or a.name).split(".")[0] for a in node.names)
+        elif isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef)):
+            if node is not fn:
+                names.add(node.name)
+    return names
+
+
+def _bound_at_module(tree):
+    """Names the file itself binds at any level outside a function body."""
+    names = set()
+    for node in ast.walk(tree):
+        if isinstance(node, (ast.Assign, ast.AnnAssign, ast.AugAssign)):
+            names.update(_targets(node))
+        elif isinstance(node, (ast.Import, ast.ImportFrom)):
+            names.update((a.asname or a.name).split(".")[0] for a in node.names)
+        elif isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef)):
+            names.add(node.name)
+    return names
+
+
+# Reads that are external by their own name, whatever the surrounding file
+# does with them. `request` is werkzeug's, reached through odoo.http; the
+# context is whatever the caller put there; both parsers turn somebody else's
+# bytes into objects.
+EXTERNAL_ROOTS = frozenset(["request"])
+EXTERNAL_CALLS = frozenset(["loads", "literal_eval", "parse_qs", "parse_qsl"])
+CONTEXT_READS = ("_context", "context")
+
+
+def _is_external(node, fn, tree):
+    """True when this expression's value came from outside the file.
+
+    Two ways to qualify. Either the expression names a source that is external
+    by construction -- `request`, a parsed payload, the context a caller
+    handed in -- or its root name is one this file never binds, which is the
+    same answer arrived at by elimination: a name that is not a parameter, not
+    assigned, not a loop or with target, not imported and not a builtin is a
+    value from somewhere this file cannot see.
+
+    The elimination half is what makes the rules' own 'wrong' samples fire,
+    because a sample is a fragment and its inputs are free names by
+    definition. It is also what keeps them quiet on the four findings that
+    were classified false: `file_config`, `filename`, `full_path` and
+    `raw_value` are all bound a few lines above the join.
+    """
+    for sub in ast.walk(node):
+        if isinstance(sub, ast.Attribute) and sub.attr in CONTEXT_READS:
+            return True
+        if isinstance(sub, ast.Call):
+            attr = _final_name(sub.func)
+            if attr in EXTERNAL_CALLS:
+                return True
+    root = _chain_root(node)
+    if root is None:
+        return False
+    if root in EXTERNAL_ROOTS:
+        return True
+    if root in ("self", "cls"):
+        return False
+    if root in dir(builtins):
+        return False
+    return root not in _bound_in(fn) and root not in _bound_at_module(tree)
+
+
+# Calls whose result is a whole number, so `== 0` on it is exact and the
+# float rule has nothing to say. search_count and len are counts by
+# definition; `.count()` is one on a recordset, a string and a list alike.
+INT_VALUED_CALLS = frozenset(["search_count", "count", "len", "bit_length",
+                              "index", "ord"])
+_COUNT_KEY = re.compile(r"(?:^__count$|_count$)")
+
+
+def _integer_fields(tree):
+    """Field names the file declares as fields.Integer."""
+    names = set()
+    for node in ast.walk(tree):
+        if not isinstance(node, ast.Assign) or not isinstance(node.value, ast.Call):
+            continue
+        func = node.value.func
+        if isinstance(func, ast.Attribute) and func.attr == "Integer":
+            names.update(_targets(node))
+    return names
+
+
+def _counts_rows(fn):
+    """True when this scope runs a COUNT query, so a fetched cell is an int."""
+    if fn is None:
+        return False
+    for node in ast.walk(fn):
+        if not (isinstance(node, ast.Call) and _final_name(node.func) == "execute"):
+            continue
+        for arg in node.args[:1]:
+            try:
+                text = ast.unparse(arg)
+            except Exception:                               # pragma: no cover
+                continue
+            if "count(" in text.lower():
+                return True
+    return False
+
+
+def _assigned_values(fn, name):
+    """Values assigned to `name` in this scope, or None if it is bound some
+    way the trace cannot read -- a loop target, a with, an unpacking."""
+    if fn is None:
+        return None
+    values = []
+    for node in ast.walk(fn):
+        if isinstance(node, ast.Assign):
+            for target in node.targets:
+                if isinstance(target, ast.Name) and target.id == name:
+                    values.append(node.value)
+                elif name in _targets(target):
+                    return None                 # unpacked: no single value
+        elif isinstance(node, ast.AnnAssign):
+            if isinstance(node.target, ast.Name) and node.target.id == name \
+                    and node.value is not None:
+                values.append(node.value)
+        elif isinstance(node, (ast.For, ast.AsyncFor, ast.comprehension)):
+            if name in _targets(node.target):
+                return None
+        elif isinstance(node, (ast.With, ast.AsyncWith)):
+            for item in node.items:
+                if item.optional_vars is not None \
+                        and name in _targets(item.optional_vars):
+                    return None
+        elif isinstance(node, ast.AugAssign):
+            if isinstance(node.target, ast.Name) and node.target.id == name:
+                values.append(node.value)
+    return values or None
+
+
+def _int_valued(node, fn, tree, depth=0):
+    """True when this expression is certainly a whole number.
+
+    Certainly, not probably: every answer here SUPPRESSES a finding, so the
+    unreadable cases must come back False and leave the finding standing. A
+    name assigned twice is only an integer if both assignments are.
+    """
+    if depth > 4:                                           # pragma: no cover
+        return False
+    if isinstance(node, ast.Constant):
+        return isinstance(node.value, int) and not isinstance(node.value, bool)
+    if isinstance(node, ast.Call):
+        if _final_name(node.func) in INT_VALUED_CALLS:
+            return True
+        return False
+    if isinstance(node, ast.Subscript):
+        # read_group hands back rows keyed '<field>_count', and the key is
+        # written as an f-string as often as a literal.
+        key = node.slice
+        if isinstance(key, ast.Constant) and isinstance(key.value, str):
+            if _COUNT_KEY.search(key.value):
+                return True
+        if isinstance(key, ast.JoinedStr) and key.values:
+            tail = key.values[-1]
+            if isinstance(tail, ast.Constant) and isinstance(tail.value, str) \
+                    and _COUNT_KEY.search(tail.value):
+                return True
+        # cr.fetchone()[0] of a SELECT COUNT(*) is the third spelling of a
+        # count, and the query is the only place that says so.
+        inner = node.value
+        if isinstance(inner, ast.Call) and _final_name(inner.func) in (
+                "fetchone", "fetchall") and _counts_rows(fn):
+            return True
+        return False
+    if isinstance(node, ast.BinOp) and isinstance(node.op, (ast.Add, ast.Sub,
+                                                            ast.Mult, ast.Mod,
+                                                            ast.FloorDiv)):
+        return (_int_valued(node.left, fn, tree, depth + 1)
+                and _int_valued(node.right, fn, tree, depth + 1))
+    if isinstance(node, ast.Attribute):
+        return node.attr in _integer_fields(tree)
+    if isinstance(node, ast.Name):
+        if node.id in _integer_fields(tree):
+            return True
+        values = _assigned_values(fn, node.id)
+        if not values:
+            return False
+        return all(_int_valued(v, fn, tree, depth + 1) for v in values)
+    return False
+
+
+# ------------------------------------------------ the rewritten checkers
+
+_MONEY_NAME = re.compile(r"price|amount|qty|quantity|total|balance", re.I)
+_RESOLVES_THE_PATH = frozenset(["commonpath", "commonprefix", "relpath",
+                                "is_relative_to", "realpath", "abspath"])
+
+
+def float_equality_against_zero(code):
+    """odoo.float-comparison-needs-float-utils
+
+    `== 0` or `!= 0` on a value whose name says it is money or a quantity,
+    where the assignment does not say it is a whole number.
+
+    The regex this replaces asked only the first half. Classified by hand it
+    was 2 true and 5 false, and every one of the five compared an INTEGER to
+    zero, where `==` is exact and the rule has nothing to say:
+    `search_count(...)`, a read_group `<field>_count`, `cr.fetchone()[0]` of a
+    SELECT COUNT(*), and `x.qty` where the same file declares qty as
+    fields.Integer. All five were named `total`, `group_total` or
+    `total_population`, and so were both true positives -- `total =
+    sum(sorted_amounts)` is the same spelling with a float behind it. The name
+    could never have separated them.
+
+    What it cannot see, and so still reports: a float that arrives as a
+    parameter, and an integer from a helper in another file. Both leave the
+    finding standing, which is the direction a suppressing trace has to err in.
     """
     tree, _ = parse_python(code)
     if tree is None:
         return []
 
-    findings = []
+    owner = _function_of(tree)
+    findings, seen = [], set()
     for node in ast.walk(tree):
-        if not isinstance(node, ast.Call):
-            continue
-        if not isinstance(node.func, ast.Attribute):
+        if not isinstance(node, ast.Compare) or len(node.ops) != 1:
             continue
-        if node.func.attr not in ("search", "search_count", "search_read"):
-            continue
-        inner = node.func.value
-        if not (isinstance(inner, ast.Call) and isinstance(inner.func, ast.Attribute)
-                and inner.func.attr == "sudo"):
+        if not isinstance(node.ops[0], (ast.Eq, ast.NotEq)):
             continue
+        left, right = node.left, node.comparators[0]
+        for value, other in ((left, right), (right, left)):
+            if not (isinstance(other, ast.Constant)
+                    and isinstance(other.value, (int, float))
+                    and not isinstance(other.value, bool)
+                    and other.value == 0):
+                continue
+            name = _final_name(value)
+            if not name or not _MONEY_NAME.search(name):
+                continue
+            if _int_valued(value, owner.get(id(value)), tree):
+                break
+            if node.lineno in seen:
+                break
+            seen.add(node.lineno)
+            findings.append((
+                node.lineno,
+                "'{0}' is compared with == against zero -- binary floats do "
+                "not land on it exactly, so use float_is_zero with the "
+                "field's precision".format(name),
+                None))
+            break
+    return findings
 
-        # The rule's own correct sample re-applies company filtering inside the
-        # domain, so a domain naming company_id is the rule satisfied. Read off
-        # the call's own arguments rather than the file, because a company_id
-        # anywhere else in a module said nothing about THIS search.
-        try:
-            call_src = ast.unparse(node)
-        except Exception:                                   # pragma: no cover
-            call_src = ""
-        if "company_id" in call_src:
-            continue
 
-        model = _env_model_of(inner.func.value)
-        if context.model_is_record_ruled(facts, model) == context.ABSENT:
-            continue
+def path_join_takes_an_external_name(code):
+    """python.path-join-does-not-contain-a-path
 
-        where = " on {0}".format(model) if model else ""
+    os.path.join where one component came from outside the file, and the
+    result is not resolved and compared before it is used.
+
+    The regex this replaces matched component NAMES -- `filename`, `form`,
+    `params` -- and was 0 true, 4 false. All four join a configured directory
+    to a name the module itself produced: a timestamped backup filename, a
+    literal from a list declared in the same function, a module path out of
+    get_module_path. Not one was a fragment a caller could point out of the
+    directory, which is the only thing the rule is about.
+
+    So the question moved from what the component is called to where its value
+    came from, and 'outside the file' is the answer _is_external gives. The
+    rule's own wrong sample joins `request.args['name']` and still fires.
+
+    This reports less than the regex did, on purpose: the regex's entire
+    output on 294,000 lines was false, and a checker that cries wolf gets
+    switched off. A traversal reached through a helper in another module is
+    outside what a local trace can see and is not reported.
+    """
+    tree, _ = parse_python(code)
+    if tree is None:
+        return []
+
+    owner = _function_of(tree)
+    findings = []
+    for node in ast.walk(tree):
+        if not (isinstance(node, ast.Call) and _final_name(node.func) == "join"):
+            continue
+        # os.path.join, not str.join and not pathlib's.
+        parent = node.func.value if isinstance(node.func, ast.Attribute) else None
+        if not (isinstance(parent, ast.Attribute) and parent.attr == "path"):
+            continue
+        fn = owner.get(id(node))
+        # The fix is to resolve and compare, and it is written beside the
+        # join. Scoped to the enclosing function rather than the file: a
+        # realpath somewhere else in a 900-line model says nothing about this
+        # call. A join at module scope -- which is what a rule's own sample
+        # is -- is scoped to the module for the same reason.
+        scope = fn if fn is not None else tree
+        if any(_final_name(c.func) in _RESOLVES_THE_PATH
+               for c in ast.walk(scope) if isinstance(c, ast.Call)):
+            continue
+        for arg in node.args[1:]:
+            if _is_external(arg, fn, tree):
+                try:
+                    shown = ast.unparse(arg)
+                except Exception:                           # pragma: no cover
+                    shown = "the component"
+                findings.append((
+                    node.lineno,
+                    "os.path.join is handed {0}, which came from outside this "
+                    "file -- an absolute component discards the base directory "
+                    "entirely and '..' walks out of it, so resolve both and "
+                    "compare before opening anything".format(shown),
+                    None))
+                break
+    return findings
+
+
+def float_coercion_of_external_money(code):
+    """python.decimal-for-money-not-float
+
+    float() applied to a money value that arrived from outside the file.
+
+    The regex this replaces matched the NAME either side of the coercion and
+    was 0 true, 3 false, with a reason behind it rather than a sample size:
+    Odoo's Monetary field IS a float -- the ORM defines it that way -- and the
+    framework's answer to the precision problem is float_round and
+    float_compare against the currency's rounding, not Decimal. Inside an Odoo
+    module the rule fired on the idiom and named a fix that cannot be taken.
+
+    Three findings do not settle a rule either way, so it is narrowed rather
+    than culled, and the narrowing is the line the argument actually draws.
+    `float(self.amount or 0.0)` is the ORM's own type and is not reported.
+    `float(result)`, where result came back from a service in this file, is
+    not reported. `float(payload['price'])`, where the string came from a
+    caller and Decimal(payload['price']) IS available, still is -- which is
+    the rule's own wrong sample and the one shape its remedy fits.
+    """
+    tree, _ = parse_python(code)
+    if tree is None:
+        return []
+
+    owner = _function_of(tree)
+    findings = []
+    for node in ast.walk(tree):
+        if not (isinstance(node, ast.Call) and isinstance(node.func, ast.Name)
+                and node.func.id == "float" and node.args):
+            continue
+        value = node.args[0]
+        name = _final_name(value) or _chain_root(value) or ""
+        target = _MONEY_NAME.search(name)
+        if not target:
+            # The coerced expression may say nothing, while what it is
+            # assigned to does: `price = float(payload['p'])`.
+            holder = owner.get(id(node))
+            for stmt in ast.walk(holder if holder is not None else tree):
+                if isinstance(stmt, ast.Assign) and stmt.value is node:
+                    target = any(_MONEY_NAME.search(t)
+                                 for t in _targets(stmt) if t)
+                    break
+        if not target:
+            continue
+        if not _is_external(value, owner.get(id(node)), tree):
+            continue
         findings.append((
             node.lineno,
-            "sudo().{0}(){1} runs with record rules off -- ir.rule filtering, "
-            "including multi-company isolation, does not apply and the result "
-            "looks correct in single-company testing".format(node.func.attr, where),
+            "a money value from outside this file is routed through float() "
+            "-- the binary float is already wrong before Decimal can be given "
+            "it, so build Decimal from the original string",
             None))
     return findings
 
 
+def onchange_tries_to_enforce(code):
+    """odoo.onchange-is-not-validation
+
+    An @api.onchange method that RAISES or returns a warning -- it is trying
+    to enforce an invariant the web client is the only thing that will apply.
+
+    The regex this replaces read 400 characters after the decorator and could
+    not see where the method ended. All three of its false positives are the
+    same failure: a four-line onchange that assigns one field, followed by an
+    action method that raises. `_onchange_variable_id` sets a target model and
+    the UserError 200 characters below it belongs to `action_remap`. The
+    window crossed the function boundary, and a regex has no way not to.
+
+    Scoped to the decorated function, that shape is silent, and the four true
+    positives -- an onchange that really does raise ValidationError, and ones
+    that return the warning dict -- all stand.
+
+    A constraint anywhere in the file clears it, exactly as the
+    satisfied_pattern did: an onchange sitting beside a real @api.constrains
+    is the faster feedback the rule explicitly allows. _sql_constraints counts
+    here, because it IS a constraint on 16 through 18; the 19 hole is closed
+    where the series is legible, in prefer_sql_constraint_applies.
+    """
+    tree, _ = parse_python(code)
+    if tree is None:
+        return []
+
+    backed = False
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Name) and node.id == "_sql_constraints":
+            backed = True
+        elif isinstance(node, ast.Attribute) and node.attr in ("constrains",
+                                                               "Constraint"):
+            backed = True
+    if backed:
+        return []
+
+    findings = []
+    for fn in _functions(tree):
+        if _decorator_args(fn, "api", "onchange") is None:
+            continue
+        # Anchored on the decorator, not on the def below it. That is where
+        # the rule is, where a reader looking the finding up will look, and
+        # where the marker goes when somebody has already decided about it --
+        # a FunctionDef's own lineno is the `def`, one line past all three.
+        at = fn.lineno
+        for dec in fn.decorator_list:
+            func = dec.func if isinstance(dec, ast.Call) else dec
+            if isinstance(func, ast.Attribute) and func.attr == "onchange":
+                at = dec.lineno
+                break
+        for node in ast.walk(fn):
+            spot = None
+            if isinstance(node, ast.Raise):
+                exc = node.exc
+                name = _final_name(exc.func) if isinstance(exc, ast.Call) \
+                    else _final_name(exc)
+                if name and ("Error" in name or "Warning" in name):
+                    spot = node.lineno
+            elif isinstance(node, ast.Dict):
+                for key in node.keys:
+                    if isinstance(key, ast.Constant) and key.value == "warning":
+                        spot = node.lineno
+            if spot is None:
+                continue
+            findings.append((
+                at,
+                "@api.onchange '{0}' refuses a value, and onchange runs in "
+                "the web client form only -- an import, an RPC call, a cron "
+                "or a direct create() never triggers it, so the record enters "
+                "the database unchallenged".format(fn.name),
+                None))
+            break
+    return findings
+
+
+# A query decides WHICH records you get to see, and dropping ir.rule widens
+# that set. Every one of the 6 hand-classified true positives is one of these.
+SUDO_QUERIES = ("search", "search_count", "search_read", "read_group")
+# These act on a recordset the caller already holds. Dropping ir.rule still
+# matters -- it governs write and read permission as well as visibility -- but
+# it widens what you may DO with a record rather than which records exist for
+# you, and nothing measured here has yet found a real one.
+SUDO_TOUCHES = ("create", "write", "unlink", "copy", "read")
+
+# The grade the write and escape clauses carry, per finding rather than per
+# rule. `unproven` is the corpus's word for a real defect nothing measured
+# here has met yet, and that is exactly their position: the read clause has
+# 6 hand-classified true positives across two trees, and these two have 0 in
+# 261,000 lines. Every one of the 23 they found was read, and every one was
+# an administrator by construction -- a demo-data seeder, an ACL-gated
+# accounting wizard -- or a framework model with no tenant boundary at all.
+#
+# Grading them rather than deleting them is the same call §3.46 made about
+# decimal-for-money: a clause the rule's own sentence asks for, measured at
+# zero, is reported and not trusted to stop a build. It costs the read
+# clause nothing, because a grade travels with the finding and not the rule.
+UNPROVEN = "unproven"
+
+
+def _escalates(call):
+    """True when this `.sudo(...)` call turns record rules OFF.
+
+    `sudo(False)` turns them back ON. It is how a method that must run under
+    the caller's own rights says so, and odoo core does it 60 times --
+    `self = self.sudo(False)` in mail's `_check_attachments_access`, whose
+    own docstring reads "This method relies on access rules/rights and
+    therefore it should not be called from a sudo env."
+
+    Reading it as an escalation reports the fix as the defect, which is worse
+    than missing the defect: it is the one kind of finding that teaches a
+    reader the checker cannot be trusted. An argument that is not a literal
+    is unreadable here and counts as escalation, because `sudo(flag)` with a
+    computed flag can be either and the finding should stand.
+    """
+    if not (isinstance(call, ast.Call) and isinstance(call.func, ast.Attribute)
+            and call.func.attr == "sudo"):
+        return False
+    given = list(call.args) + [k.value for k in call.keywords if k.arg == "flag"]
+    for arg in given:
+        if isinstance(arg, ast.Constant) and not arg.value:
+            return False
+        # `x.sudo(self.env.su)` sets su to whatever the environment already
+        # has, so it cannot raise privilege above ambient -- it is how a
+        # method hands a record back at the caller's own level. odoo core
+        # writes it four times and once with the comment "Unsudo the invoice
+        # after creation if not already sudoed". `sudo(self.env.su or
+        # field.compute_sudo)` is NOT this: the `or` can turn it on, so only
+        # the bare attribute is read as ambient.
+        if isinstance(arg, ast.Attribute) and arg.attr == "su":
+            return False
+    return True
+
+
+def _under_sudo(node):
+    """The receiver of `<x>.sudo().<method>(...)`, or None."""
+    if not (isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute)):
+        return None
+    inner = node.func.value
+    if isinstance(inner, ast.Call) and _escalates(inner):
+        return inner.func.value
+    return None
+
+
+def sudo_drops_record_rules(code, facts=None):
+    """odoo.sudo-bypasses-record-rules
+
+    Three clauses, because the rule has three: scope sudo to the narrowest
+    operation, re-apply company filtering by hand, and never pass a sudo
+    recordset onward.
+
+      1. a read under sudo    -- search, search_read, read_group, read
+      2. a write under sudo   -- create, write, unlink, copy
+      3. a sudo recordset bound to a name and then handed to something else
+
+    Only the first was checked. The `--harvest` clustering says what that
+    cost: `.sudo(` is the largest miss cluster in the corpus's recall
+    measurement at 70 missed against 6 caught, and 47 of those 70 are files
+    where a checker fired somewhere else -- a rule aimed wrong rather than a
+    rule that is missing. Counted on the OpenSPP tree, the clause that was
+    checked has 116 call sites and the clause that was not has 136, so the
+    unchecked half was the larger one. One of the misses the README names,
+    *"remove sudo() when importing record"*, is a create the search-only
+    checker could not see at all.
+
+    ir.rule governs read, write, create and unlink alike, so the same
+    record-rule trigger gates every clause: where the tree declares no rule
+    that filters this model, sudo drops nothing and there is no finding. The
+    trigger only ever SUPPRESSES. A model the walk could not name, a tree that
+    was not walked, a partial walk -- each reads UNKNOWN and the finding
+    stands, because "no rule was found" and "nobody looked" must not be the
+    same answer on a critical rule. `nexa check` on one file therefore behaves
+    exactly as it did before triggers existed.
+
+    Clause 3 fires at the binding, not at the use. `partners =
+    self.env['res.partner'].sudo()` is a recordset carrying an environment
+    with su=True, and every call made on it downstream inherits that -- which
+    is the whole reason the rule's sentence says not to pass one on. Reported
+    where the escape happens, once, rather than at each later read.
+
+    What it still over-reports, measured and not yet fixed: 14 of the 20
+    surviving read findings constrain the search to records the caller had
+    already identified -- a group id, a partner id, an area -- which is the
+    rule's advice followed in a spelling the rule does not recognise, since it
+    names only company_id. Deciding in general that a domain is already scoped
+    means evaluating it, and a narrowing that guesses would cost the 6 true
+    positives this keeps.
+    """
+    tree, _ = parse_python(code)
+    if tree is None:
+        return []
+
+    def rescoped(node, model):
+        # Did this call re-apply the scoping the rule it bypasses is about?
+        #
+        # The old test was the literal word `company_id`, from the rule's own
+        # correct sample. That is one spelling of one kind of rule, and the
+        # docstring recorded what it cost: 14 of 20 surviving read findings
+        # were scoped by a group, a partner or an area instead, and read as
+        # unscoped. Every OpenSPP case model is governed by `case_worker_id`
+        # or `case_id.case_worker_id` and carries no company rule at all.
+        #
+        # So the call is now compared against the fields the model's OWN
+        # ir.rule filters on, which is not a guess about the domain -- it is
+        # the domain, read off the tree that declares it. A create naming
+        # `case_id` lands inside the caller's visibility because that is the
+        # link the rule follows. company_id stays as the fallback for a model
+        # whose rules this could not read, so nothing that was exempt before
+        # stops being exempt now.
+        # The ARGUMENTS only. Unparsing the whole call includes the receiver,
+        # and the model name is part of it: `spp.group.membership` contains
+        # the word `group`, which is one of that model's own rule fields, so
+        # reading the whole chain exempted an unscoped sweep of every
+        # membership in the database -- a finding classified true by hand.
+        #
+        # An argument that is a bare name is followed to what it was assigned,
+        # because `create(vals)` otherwise hides every field it sets behind
+        # four letters. The trace is the same local one the other checkers
+        # use, and a name it cannot resolve contributes nothing.
+        pieces = []
+        for arg in list(node.args) + [k.value for k in node.keywords]:
+            try:
+                pieces.append(ast.unparse(arg))
+            except Exception:                               # pragma: no cover
+                continue
+            if isinstance(arg, ast.Name):
+                for value in _assigned_values(owner.get(id(node)), arg.id) or ():
+                    try:
+                        pieces.append(ast.unparse(value))
+                    except Exception:                       # pragma: no cover
+                        pass
+        call_src = " ".join(pieces)
+        fields = context.model_rule_fields(facts, model) if model else ()
+        for name in fields or ("company_id",):
+            if re.search(r"\b" + re.escape(name.split(".", 1)[0]) + r"\b", call_src):
+                return True
+        return "company_id" in call_src
+
+    owner = _function_of(tree)
+
+    def model_of(receiver):
+        # `self.env['x'].sudo()` names its model in the chain. `Plan.sudo()`
+        # does not, and every one of the write clause's first findings on
+        # OpenSPP's demo generators was that shape -- `Plan =
+        # self.env['spp.case.plan']` a few lines up, then fifteen writes on
+        # the name. Unresolved, the trigger reads UNKNOWN and cannot suppress;
+        # followed through the assignment, it can answer. Every assignment to
+        # the name must agree, or the answer is still None.
+        model = _env_model_of(receiver)
+        if model is not None or not isinstance(receiver, ast.Name):
+            return model
+        values = _assigned_values(owner.get(id(receiver)), receiver.id)
+        if not values:
+            values = [v for n in ast.walk(tree) if isinstance(n, ast.Assign)
+                      for t in n.targets if isinstance(t, ast.Name)
+                      and t.id == receiver.id for v in (n.value,)]
+        found = {_env_model_of(v) for v in values}
+        return found.pop() if len(found) == 1 and None not in found else None
+
+    def ruled_out(receiver):
+        model = model_of(receiver)
+        return context.model_is_record_ruled(facts, model) == context.ABSENT, model
+
+    findings, seen = [], set()
+
+    def report(line, text, grade=None):
+        if line not in seen:
+            seen.add(line)
+            findings.append((line, text, grade))
+
+    for node in ast.walk(tree):
+        receiver = _under_sudo(node)
+        if receiver is None:
+            continue
+        method = node.func.attr
+        if method not in SUDO_QUERIES and method not in SUDO_TOUCHES:
+            continue
+        absent, model = ruled_out(receiver)
+        if absent:
+            continue
+        if rescoped(node, model):
+            continue
+        where = " on {0}".format(model) if model else ""
+        if method in SUDO_QUERIES:
+            report(node.lineno,
+                   "sudo().{0}(){1} runs with record rules off -- ir.rule "
+                   "filtering, including multi-company isolation, does not "
+                   "apply and the result looks correct in single-company "
+                   "testing".format(method, where))
+        else:
+            report(node.lineno,
+                   "sudo().{0}(){1} acts with record rules off -- ir.rule "
+                   "governs write, create, unlink and read as well as "
+                   "visibility, so this reaches a record the caller's own "
+                   "rules would not let it touch".format(method, where),
+                   UNPROVEN)
+
+    # Clause 3: a sudo recordset given a name, then handed on.
+    #
+    # The bare name only, as an argument or as the whole returned value.
+    # `return partners.mapped('name')` hands back a list of strings and the
+    # elevated environment does not travel with it, while
+    # `return partners.filtered(...)` does -- telling those apart means
+    # knowing which recordset methods return recordsets, so neither is
+    # reported. Clause 3 under-reports by construction, which is the right
+    # direction for a new clause on a critical rule: the search clause's
+    # first version fired 106 times for 6 real ones, and a flood is how a
+    # checker gets switched off.
+    for fn in _functions(tree):
+        escapes = set()
+        for node in ast.walk(fn):
+            if isinstance(node, ast.Call):
+                if _under_sudo(node) is None:
+                    escapes.update(a.id for a in node.args
+                                   if isinstance(a, ast.Name))
+                    escapes.update(k.value.id for k in node.keywords
+                                   if isinstance(k.value, ast.Name))
+            elif isinstance(node, ast.Return) and isinstance(node.value, ast.Name):
+                escapes.add(node.value.id)
+        for node in ast.walk(fn):
+            if not isinstance(node, ast.Assign) or not isinstance(node.value, ast.Call):
+                continue
+            call = node.value
+            if not _escalates(call):
+                continue
+            bound = [t for t in _targets(node)]
+
+            # `self = self.sudo()` rebinds the method's own receiver, and
+            # every ORM call below it in the method inherits the elevated
+            # environment without naming sudo anywhere. It is the escape
+            # clause at its widest -- the recordset is not passed on, it
+            # replaces the thing the whole method is written against.
+            #
+            # This is the miss the README names by hand. OCA server-tools
+            # cbefaa511485, "[FIX] excel_import_export: remove sudo() when
+            # importing record", deletes exactly this line and says what it
+            # cost: "finding multiple records across all companies during
+            # import when they have same record name. Previously, importing
+            # with sudo could bypass multi-company record rules."
+            #
+            # Three sites in 260,000 lines, so it is narrow as well as real.
+            # The same commit ADDS `self.sudo().env["ir.model.data"]`, a
+            # deliberate and narrow elevation, which is the evidence for not
+            # also flagging that shape.
+            rebind = isinstance(call.func.value, ast.Name) \
+                and call.func.value.id in bound
+            if rebind:
+                report(node.lineno,
+                       "'{0}' is rebound to its own sudo form, so every ORM "
+                       "call below this line in the method runs with record "
+                       "rules off -- including ones that name no sudo at all"
+                       .format(call.func.value.id))
+                continue
+
+            if not any(name in escapes for name in bound):
+                continue
+            absent, model = ruled_out(call.func.value)
+            if absent:
+                continue
+            where = " of {0}".format(model) if model else ""
+            report(node.lineno,
+                   "this sudo recordset{0} is passed on -- the elevated "
+                   "environment travels with it, so every read and write made "
+                   "on it downstream also runs with record rules off"
+                   .format(where), UNPROVEN)
+    return sorted(findings)
+
+
 def _env_model_of(node):
     """The model name at the head of a chained call, or None.
 
@@ -1932,7 +2722,11 @@ def _env_model_of(node):
 
 CHECKS = {
     "handler_order_shadows_a_subclass": handler_order_shadows_a_subclass,
-    "sudo_search_drops_a_real_rule": sudo_search_drops_a_real_rule,
+    "sudo_drops_record_rules": sudo_drops_record_rules,
+    "float_equality_against_zero": float_equality_against_zero,
+    "path_join_takes_an_external_name": path_join_takes_an_external_name,
+    "float_coercion_of_external_money": float_coercion_of_external_money,
+    "onchange_tries_to_enforce": onchange_tries_to_enforce,
     "check_company_missing_on_company_owned_relation":
         check_company_missing_on_company_owned_relation,
     "commit_inside_a_loop": commit_inside_a_loop,
@@ -1954,7 +2748,7 @@ CONTEXT_CHECKS = frozenset([
     "check_company_missing_on_company_owned_relation",
     # Reads models_record_ruled: whether sudo drops anything depends on whether
     # the tree declares a rule that filters.
-    "sudo_search_drops_a_real_rule",
+    "sudo_drops_record_rules",
     # Reads odoo_series: whether a _sql_constraints block is a constraint at
     # all depends on which Odoo is going to load it.
     "prefer_sql_constraint_applies",
@@ -2167,8 +2961,81 @@ def unresolvable_imports(tree):
 
 # ------------------------------------------------------- comment stripping
 
+def _docstring_starts(code):
+    """Character offsets where a docstring literal opens.
+
+    A docstring is prose, and a regex cannot tell prose from code -- which is
+    the whole reason comments are stripped before matching. String literals
+    were left standing, and classifying 50 findings by hand found the cost:
+    two of them were `eval()` named in a docstring in a sentence arguing
+    AGAINST using it, and a `datetime.now()` inside a doctest example. Both
+    read as live code.
+
+    Only docstrings, not every string. A triple-quoted SQL query is data the
+    checkers have a legitimate interest in, and `_SQL_COLUMNS` reads one. The
+    statement-level bare string an AST calls a docstring is the one place the
+    file is guaranteed to be talking ABOUT code rather than in it.
+
+    Offsets, not spans: the scanner already knows how to find a literal's end,
+    and asking it to do that is one way of measuring the string rather than
+    two. `col_offset` is a byte offset, which parts company with a character
+    offset on a line holding non-ASCII -- so the result is checked against the
+    quote it claims to point at and dropped when it does not, leaving that
+    docstring intact rather than blanking the wrong run of characters.
+    """
+    tree, _ = parse_python(code)
+    if tree is None:
+        return frozenset()
+
+    line_start, offset = [], 0
+    for row in code.splitlines(True):
+        line_start.append(offset)
+        offset += len(row)
+
+    starts = set()
+    holders = (ast.Module, ast.ClassDef, ast.FunctionDef, ast.AsyncFunctionDef)
+    for node in ast.walk(tree):
+        if not isinstance(node, holders):
+            continue
+        body = getattr(node, "body", None)
+        if not body:
+            continue
+        first = body[0]
+        if not (isinstance(first, ast.Expr) and isinstance(first.value, ast.Constant)
+                and isinstance(first.value.value, str)):
+            continue
+        lineno = getattr(first.value, "lineno", 0)
+        if not 0 < lineno <= len(line_start):
+            continue
+        at = line_start[lineno - 1] + first.value.col_offset
+        # The guard the docstring above describes. A prefix of anything but
+        # indentation is possible -- `def f(): "doc"` -- but it is ASCII in
+        # every spelling that reaches here, so a miss means the offset is
+        # wrong and the safe answer is to leave the literal alone.
+        if at < len(code) and code[at] in ("'", '"'):
+            starts.add(at)
+    return frozenset(starts)
+
+
+def _blanked(text):
+    """A string literal with its contents emptied, quotes and shape intact.
+
+    Same length and the same newlines, so the line AND column a finding
+    reports are the ones a person reading the file will see, and so a
+    docstring that is the whole body of a function still leaves that function
+    syntactically intact for anything that parses the stripped view.
+    """
+    if len(text) < 2:
+        return text
+    quote = 3 if text[:3] in ("'''", '"""') else 1
+    head, body, tail = text[:quote], text[quote:-quote or None], text[-quote:]
+    if len(text) < quote * 2:
+        return text
+    return head + "".join("\n" if c == "\n" else " " for c in body) + tail
+
+
 def strip_comments(code, kind="python"):
-    """Code with its comments removed, quotes and strings left intact.
+    """Code with its comments and docstrings removed, strings left intact.
 
     WHY: a violation_pattern and a satisfied_pattern are regexes, and a regex
     cannot tell code from prose. The adversarial counterexample probe put a
@@ -2182,12 +3049,18 @@ def strip_comments(code, kind="python"):
     as a live violation, which is the false positive that teaches people to
     ignore a checker.
 
+    A docstring is the same argument wearing a different quote. It was left
+    standing here until classifying 50 findings by hand turned up two that were
+    prose read as code, so docstrings are now emptied and left in place -- see
+    _docstring_starts for why only docstrings and not every literal.
+
     Newlines inside removed comments are preserved so that multi-line patterns
     still see the line structure they were written against.
     """
     out = []
     i, n = 0, len(code)
     triple = ("'''", '"""')
+    docstrings = _docstring_starts(code) if kind == "python" else frozenset()
 
     while i < n:
         ch = code[i]
@@ -2196,7 +3069,7 @@ def strip_comments(code, kind="python"):
             marker = code[i:i + 3]
             end = code.find(marker, i + 3)
             end = n if end < 0 else end + 3
-            out.append(code[i:end])
+            out.append(_blanked(code[i:end]) if i in docstrings else code[i:end])
             i = end
             continue
 
@@ -2212,7 +3085,7 @@ def strip_comments(code, kind="python"):
                 if code[j] == "\n" and kind == "python":
                     break          # unterminated single-quoted string
                 j += 1
-            out.append(code[i:j])
+            out.append(_blanked(code[i:j]) if i in docstrings else code[i:j])
             i = j
             continue
 

classification-odoo-core-2026-09.json

@@ -0,0 +1,598 @@
+{
+  "generated_utc": "2026-09-21T22:37:59+00:00",
+  "stack": "odoo",
+  "checkouts": {
+    "odoo": "3c3e3b3d17cbd98584c7685e607d9085712adfe0"
+  },
+  "subject": "odoo/odoo 18.0, the framework itself",
+  "files": 5899,
+  "lines": 559663,
+  "scope": "A SAMPLE, not a census, and the first classification here that is one. odoo core produced 2,784 live findings, twenty-five times the size of any set read here before. 15 findings of each of the four largest rules were drawn with a fixed seed and read by hand against the file each sits in: 60 of the 2,784, covering the rules that make 70% of them. The draw reproduces from this description alone: take the live findings for the rule, drop the advisory and suppressed ones, sort by (path, line), and call random.Random('20260921:' + rule_id).sample(rows, 15).",
+  "totals": {
+    "true": 27,
+    "false": 33
+  },
+  "by_rule": {
+    "odoo.stored-compute-needs-complete-depends": {
+      "true": 11,
+      "false": 4,
+      "precision": "11/15"
+    },
+    "python.assert-is-not-validation": {
+      "true": 3,
+      "false": 12,
+      "precision": "3/15"
+    },
+    "odoo.ondelete-is-a-decision": {
+      "true": 13,
+      "false": 2,
+      "precision": "13/15"
+    },
+    "odoo.sudo-bypasses-record-rules": {
+      "true": 0,
+      "false": 15,
+      "precision": "0/15"
+    }
+  },
+  "false_classes": {
+    "framework-internal-invariant": 8,
+    "domain-scopes-it-already": 5,
+    "framework-unstored-magic-field": 4,
+    "private-helper-contract": 3,
+    "sql-view-has-no-foreign-key": 2,
+    "authentication-by-token": 2,
+    "cross-company-by-design": 2,
+    "self-check-on-module-constants": 1,
+    "global-uniqueness-by-design": 1,
+    "de-escalation": 1,
+    "public-website-read": 1,
+    "system-configuration-read": 1,
+    "cross-user-by-design": 1,
+    "guard-must-see-everything": 1
+  },
+  "intervals": "n=15 per rule, so every rate here carries a wide band. 95% Wilson intervals: stored-compute 11/15 is 48-89%, ondelete 13/15 is 60-95%, assert 3/15 is 7-45%, sudo 0/15 is 0-20%. They separate the rules into three groups and do not support finer claims than that.",
+  "hits": [
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "path": "addons/account/models/account_move.py",
+      "line": 198,
+      "verdict": "true",
+      "class": null,
+      "why": "the construct and the harm the rule names are both present",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "path": "addons/account/models/account_move.py",
+      "line": 290,
+      "verdict": "true",
+      "class": null,
+      "why": "the construct and the harm the rule names are both present",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "path": "addons/account/models/account_report.py",
+      "line": 877,
+      "verdict": "true",
+      "class": null,
+      "why": "the construct and the harm the rule names are both present",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "path": "addons/hr_contract/report/hr_contract_history.py",
+      "line": 25,
+      "verdict": "false",
+      "class": "sql-view-has-no-foreign-key",
+      "why": "hr.contract.history sets _auto = False, so there is no table, no foreign key and no ondelete to decide",
+      "still_reported_after_this_pass": false
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "path": "addons/hr_expense/models/hr_expense_sheet.py",
+      "line": 192,
+      "verdict": "true",
+      "class": null,
+      "why": "the construct and the harm the rule names are both present",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "path": "addons/hr_holidays/models/hr_leave.py",
+      "line": 163,
+      "verdict": "true",
+      "class": null,
+      "why": "the construct and the harm the rule names are both present",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "path": "addons/l10n_it_edi_ndd/models/account_move.py",
+      "line": 17,
+      "verdict": "true",
+      "class": null,
+      "why": "the construct and the harm the rule names are both present",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "path": "addons/mrp/models/stock_move.py",
+      "line": 230,
+      "verdict": "true",
+      "class": null,
+      "why": "the construct and the harm the rule names are both present",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "path": "addons/purchase/models/purchase_bill_line_match.py",
+      "line": 16,
+      "verdict": "false",
+      "class": "sql-view-has-no-foreign-key",
+      "why": "purchase.bill.line.match sets _auto = False, same reason",
+      "still_reported_after_this_pass": false
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "path": "addons/resource/models/resource_calendar.py",
+      "line": 85,
+      "verdict": "true",
+      "class": null,
+      "why": "the construct and the harm the rule names are both present",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "path": "addons/sale_crm/models/sale_order.py",
+      "line": 10,
+      "verdict": "true",
+      "class": null,
+      "why": "the construct and the harm the rule names are both present",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "path": "addons/stock/models/stock_warehouse.py",
+      "line": 75,
+      "verdict": "true",
+      "class": null,
+      "why": "the construct and the harm the rule names are both present",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "path": "addons/stock_account/models/account_move.py",
+      "line": 10,
+      "verdict": "true",
+      "class": null,
+      "why": "the construct and the harm the rule names are both present",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "path": "addons/stock_landed_costs/models/stock_landed_cost.py",
+      "line": 389,
+      "verdict": "true",
+      "class": null,
+      "why": "the construct and the harm the rule names are both present",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.ondelete-is-a-decision",
+      "path": "odoo/addons/test_access_rights/models.py",
+      "line": 13,
+      "verdict": "true",
+      "class": null,
+      "why": "the construct and the harm the rule names are both present",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "path": "addons/account/models/account_move_line.py",
+      "line": 886,
+      "verdict": "true",
+      "class": null,
+      "why": "tax_ids is store=True and reads display_type, itself a store=True readonly=False field that can be edited without product_id changing",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "path": "addons/account/models/account_tax.py",
+      "line": 4686,
+      "verdict": "true",
+      "class": null,
+      "why": "declares account_id and reads account_id.internal_group, so editing an account's type leaves use_in_tax_closing on its old answer",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "path": "addons/hr_attendance/models/hr_attendance.py",
+      "line": 200,
+      "verdict": "false",
+      "class": "framework-unstored-magic-field",
+      "why": "display_name is added by odoo/models.py with no store and this file does not redeclare it",
+      "still_reported_after_this_pass": false
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "path": "addons/hr_recruitment/models/calendar.py",
+      "line": 85,
+      "verdict": "true",
+      "class": null,
+      "why": "declares applicant_id and reads applicant_id.candidate_id",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "path": "addons/l10n_in/models/account_move_line.py",
+      "line": 12,
+      "verdict": "true",
+      "class": null,
+      "why": "reads move_id.country_code and parent_state, declares neither, on a store=True HSN code a tax report is built from",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "path": "addons/l10n_jo_edi_extended/models/account_move.py",
+      "line": 28,
+      "verdict": "true",
+      "class": null,
+      "why": "reads commercial_partner_id, declares only partner_id.country_code",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "path": "addons/l10n_tw_edi_ecpay/models/account_move.py",
+      "line": 229,
+      "verdict": "true",
+      "class": null,
+      "why": "declares partner_id and reads partner_id.vat",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "path": "addons/lunch/models/lunch_supplier.py",
+      "line": 127,
+      "verdict": "false",
+      "class": "framework-unstored-magic-field",
+      "why": "display_name again, not redeclared here",
+      "still_reported_after_this_pass": false
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "path": "addons/mrp/models/mrp_production.py",
+      "line": 436,
+      "verdict": "true",
+      "class": null,
+      "why": "declares bom_id and reads bom_id.product_qty",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "path": "addons/mrp_subcontracting/models/stock_picking.py",
+      "line": 44,
+      "verdict": "true",
+      "class": null,
+      "why": "reads picking_type_id.warehouse_id, declares only picking_type_id",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "path": "addons/sale/models/sale_order_line.py",
+      "line": 503,
+      "verdict": "true",
+      "class": null,
+      "why": "reads product_packaging_id.qty, declares product_packaging_qty",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "path": "addons/sale_stock/models/sale_order_line.py",
+      "line": 39,
+      "verdict": "true",
+      "class": null,
+      "why": "reads order_id.partner_shipping_id, declared nowhere",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "path": "addons/stock/models/stock_picking.py",
+      "line": 720,
+      "verdict": "true",
+      "class": null,
+      "why": "reads group_id, declared nowhere, on a store=True move_type",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "path": "addons/stock/models/stock_quant.py",
+      "line": 595,
+      "verdict": "false",
+      "class": "framework-unstored-magic-field",
+      "why": "display_name again, not redeclared here",
+      "still_reported_after_this_pass": false
+    },
+    {
+      "rule": "odoo.stored-compute-needs-complete-depends",
+      "path": "odoo/addons/base/models/res_bank.py",
+      "line": 121,
+      "verdict": "false",
+      "class": "framework-unstored-magic-field",
+      "why": "display_name again, not redeclared here",
+      "still_reported_after_this_pass": false
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "addons/account/models/account_move.py",
+      "line": 3730,
+      "verdict": "false",
+      "class": "domain-scopes-it-already",
+      "why": "the domain pins journal_id and id, and journals are company-scoped, so the search cannot reach another company's moves",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "addons/calendar/controllers/main.py",
+      "line": 107,
+      "verdict": "false",
+      "class": "authentication-by-token",
+      "why": "a public route resolving an access_token before any identity exists; record rules cannot apply to a visitor",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "addons/event_sale/models/sale_order.py",
+      "line": 21,
+      "verdict": "false",
+      "class": "domain-scopes-it-already",
+      "why": "registrations of the caller's own sale orders, by id",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "addons/l10n_my_edi_pos/models/myinvois_document.py",
+      "line": 213,
+      "verdict": "false",
+      "class": "domain-scopes-it-already",
+      "why": "the same sequence-reference lookup as 1, pinned by id and name",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "addons/payment/models/payment_transaction.py",
+      "line": 361,
+      "verdict": "false",
+      "class": "global-uniqueness-by-design",
+      "why": "payment references must be unique across the database, so the prefix scan has to see rows the caller cannot",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "addons/point_of_sale/models/account_journal.py",
+      "line": 16,
+      "verdict": "false",
+      "class": "domain-scopes-it-already",
+      "why": "payment methods of the caller's own journals, by id",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "addons/point_of_sale/models/account_tax.py",
+      "line": 22,
+      "verdict": "false",
+      "class": "domain-scopes-it-already",
+      "why": "pinned to ids the caller already filtered out of self",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "addons/sale/wizard/sale_make_invoice_advance.py",
+      "line": 208,
+      "verdict": "false",
+      "class": "de-escalation",
+      "why": "invoice.sudo(self.env.su) restores the ambient level; the comment reads 'Unsudo the invoice after creation if not already sudoed'. A checker defect, fixed",
+      "still_reported_after_this_pass": false
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "addons/sale_management/models/sale_order_template.py",
+      "line": 146,
+      "verdict": "false",
+      "class": "cross-company-by-design",
+      "why": "archiving a shared template must clear it from every company that points at it, or the references dangle",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "addons/survey/controllers/survey_session_manage.py",
+      "line": 26,
+      "verdict": "false",
+      "class": "authentication-by-token",
+      "why": "a public survey session code resolved before identity",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "addons/website_event_track/controllers/event_track.py",
+      "line": 368,
+      "verdict": "false",
+      "class": "public-website-read",
+      "why": "a website controller rendering a published track to anonymous visitors",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "odoo/addons/base/models/ir_mail_server.py",
+      "line": 792,
+      "verdict": "false",
+      "class": "system-configuration-read",
+      "why": "listing outgoing mail servers to pick one; sending mail does not require read access to ir.mail_server",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "odoo/addons/base/models/ir_ui_view.py",
+      "line": 549,
+      "verdict": "false",
+      "class": "cross-user-by-design",
+      "why": "drops other users' view customisations when the view changes, which the comment beside it states as the intent",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "odoo/addons/base/models/res_partner.py",
+      "line": 667,
+      "verdict": "false",
+      "class": "cross-company-by-design",
+      "why": "iterating every company is what _company_dependent_commercial_sync is for",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "odoo/addons/base/models/res_partner.py",
+      "line": 827,
+      "verdict": "false",
+      "class": "guard-must-see-everything",
+      "why": "an @api.ondelete guard checking whether any user links to the partner; a scoped search would let the guard be bypassed",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "path": "addons/base_import_module/models/ir_module.py",
+      "line": 111,
+      "verdict": "true",
+      "class": null,
+      "why": "guards 'installable' read out of the manifest of a module being imported from an uploaded zip; under -O the gate disappears and a module marked not installable installs",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "path": "addons/delivery/models/sale_order.py",
+      "line": 100,
+      "verdict": "false",
+      "class": "private-helper-contract",
+      "why": "_get_pickup_locations is private and the docstring states the contract its own module's callers keep",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "path": "addons/mail/tools/discuss.py",
+      "line": 147,
+      "verdict": "false",
+      "class": "private-helper-contract",
+      "why": "_add_values is a private Store helper; the key comes from callers inside the module",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "path": "odoo/_monkeypatches/num2words.py",
+      "line": 391,
+      "verdict": "false",
+      "class": "self-check-on-module-constants",
+      "why": "asserts two hardcoded lists are the same length; no caller can make it false",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "path": "odoo/addons/base/models/ir_mail_server.py",
+      "line": 666,
+      "verdict": "true",
+      "class": null,
+      "why": "the recipient list is derived from addresses handed to a public send_email, and the assert is what stops a send with no valid recipient",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "path": "odoo/addons/base/models/ir_model.py",
+      "line": 2098,
+      "verdict": "true",
+      "class": null,
+      "why": "access_mode is interpolated into SQL as perm_{access_mode} on a public, RPC-callable method, and this assert is the only thing constraining it to four literals",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "path": "odoo/fields.py",
+      "line": 2653,
+      "verdict": "false",
+      "class": "framework-internal-invariant",
+      "why": "a field descriptor asserting its own configuration",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "path": "odoo/fields.py",
+      "line": 2899,
+      "verdict": "false",
+      "class": "framework-internal-invariant",
+      "why": "registry setup asserting a Selection has a selection; developer error at boot",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "path": "odoo/models.py",
+      "line": 241,
+      "verdict": "false",
+      "class": "framework-internal-invariant",
+      "why": "asserts a model class is imported from odoo.addons; developer error at class definition",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "path": "odoo/modules/registry.py",
+      "line": 783,
+      "verdict": "false",
+      "class": "framework-internal-invariant",
+      "why": "Registry.clear_cache asserting its own cache-name convention",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "path": "odoo/modules/registry.py",
+      "line": 875,
+      "verdict": "false",
+      "class": "framework-internal-invariant",
+      "why": "asserts the cursor is not the read-only replica",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "path": "odoo/tools/pycompat.py",
+      "line": 15,
+      "verdict": "false",
+      "class": "private-helper-contract",
+      "why": "a deprecated compatibility shim asserting the stream type its callers pass",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "path": "odoo/tools/query.py",
+      "line": 124,
+      "verdict": "false",
+      "class": "framework-internal-invariant",
+      "why": "the Query builder asserting an alias it generated itself is known",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "path": "odoo/tools/sql.py",
+      "line": 668,
+      "verdict": "false",
+      "class": "framework-internal-invariant",
+      "why": "asserts the named fields are integers; the names reach SQL only through SQL.identifier, which escapes them",
+      "still_reported_after_this_pass": true
+    },
+    {
+      "rule": "python.assert-is-not-validation",
+      "path": "odoo/tools/translate.py",
+      "line": 633,
+      "verdict": "false",
+      "class": "framework-internal-invariant",
+      "why": "a translation helper asserting its own argument convention",
+      "still_reported_after_this_pass": true
+    }
+  ],
+  "note": "The headline is that precision depends on what KIND of code is under review, and this is the first tree here that made the difference legible. assert-is-not-validation measured 6 true / 4 false on OCA addons and 3 true / 12 false here. The rule's own true class is 'the asserted value came from outside the module', and a framework's asserts are overwhelmingly invariants between its own components -- the registry, the field descriptors, the query builder -- where there is no outside. Same rule, same code, different subject.\n\nsudo-bypasses-record-rules measured 0 of 15 on core against 6 true on OpenSPP. Every core finding is a deliberate framework elevation: a public route resolving a token before any identity exists, a delete guard that has to see records the caller cannot, a cross-company sync whose entire purpose is to cross companies. The rule is about an application leaking between tenants, and core is the thing that implements tenancy.",
+  "worklist": "One finding in the assert sample is worth acting on outside this project: odoo core's ir.model.access.group_names_with_access interpolates its access_mode argument straight into SQL as perm_{access_mode}, and the only thing constraining it to four literals is an assert. The method is public and RPC-callable. Odoo does not run under python -O, so this is latent rather than live, and the assert also turns a bad argument into a 500 rather than a clean error.\n\nStill unread on core: roughly 1,590 findings, led by naive-and-aware-datetimes (167), constrains-must-list-every-field-read (151) and depends-must-not-name-unread-fields (134)."
+}

classification-sudo-2026-09.json

@@ -0,0 +1,287 @@
+{
+  "generated_utc": "2026-09-21T12:02:21+00:00",
+  "stack": "odoo",
+  "checkouts": {
+    "OpenSPP2-19.0": "cfa0dc8ee3432ab2dd095a4882a861cc9dfba039",
+    "server-tools": "60cd54e5ee8f6538a14266af8a7b3d1da0af08ec",
+    "account-financial-tools": "e4c1b86aa0a61d9f484c1a7e9830a63f5e6a2233"
+  },
+  "scope": "every live finding odoo.sudo-bypasses-record-rules makes on both trees after the rule grew the two clauses its own sentence asks for -- a write or read on a record under sudo, and a sudo recordset passed onward -- read by hand against the file it sits in. Findings on a line already carrying another analyser's suppression marker are excluded, as they are from every rate in this project. The six query-clause findings on OCA were classified in classification-oca-2026-09.json and are not re-litigated here.",
+  "lines": 260897,
+  "totals": {
+    "false": 24
+  },
+  "by_clause": {
+    "query": {
+      "true": 0,
+      "false": 3
+    },
+    "touch": {
+      "true": 0,
+      "false": 21
+    },
+    "rebind": {
+      "true_in_history": 1,
+      "false_at_head": 1,
+      "note": "server-tools cbefaa511485 is an on-target recall catch; the one live finding at HEAD is false"
+    }
+  },
+  "false_classes": {
+    "touches-a-record-already-held": 7,
+    "demo-seeder": 4,
+    "framework-metadata-read": 2,
+    "writes-the-callers-own-company": 2,
+    "configuration-model-create": 2,
+    "global-uniqueness-by-design": 1,
+    "authentication-before-identity": 1,
+    "framework-metadata-create": 1,
+    "dba-configuration-model": 1,
+    "rebind-over-metadata-only": 1,
+    "company-refiltered-outside-the-call": 1,
+    "scoped-to-a-record-already-held": 1
+  },
+  "hits": [
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "account-financial-tools/account_asset_management/models/account_asset.py",
+      "line": 1233,
+      "clause": "touch",
+      "likelihood": "unproven",
+      "verdict": "false",
+      "class": "company-refiltered-outside-the-call",
+      "why": "triggers is recomputes filtered on company_id.id in companies.ids one line above, which is the rule's own advice followed where the checker reads only the call"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "account-financial-tools/account_asset_management/models/account_move.py",
+      "line": 157,
+      "clause": "touch",
+      "likelihood": "unproven",
+      "verdict": "false",
+      "class": "framework-metadata-read",
+      "why": "reads an ir.actions.act_window fetched by env.ref; no tenant boundary"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "account-financial-tools/account_journal_general_sequence/wizards/account_move_renumber_wizard.py",
+      "line": 85,
+      "clause": "touch",
+      "likelihood": "unproven",
+      "verdict": "false",
+      "class": "scoped-to-a-record-already-held",
+      "why": "the date ranges belong to the one sequence the wizard holds, and the wizard is ACL-gated to accounting managers by its own comment and its access rules"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "account-financial-tools/account_lock_date_update/wizards/account_update_lock_date.py",
+      "line": 82,
+      "clause": "touch",
+      "likelihood": "unproven",
+      "verdict": "false",
+      "class": "writes-the-callers-own-company",
+      "why": "writes lock dates onto self.company_id after _check_execute_allowed has required group_account_manager"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "account-financial-tools/account_lock_to_date/wizards/account_update_lock_to_date.py",
+      "line": 61,
+      "clause": "touch",
+      "likelihood": "unproven",
+      "verdict": "false",
+      "class": "writes-the-callers-own-company",
+      "why": "the same wizard for the to-date variant, behind the same group check"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "account-financial-tools/account_move_line_purchase_info/models/purchase_order.py",
+      "line": 30,
+      "clause": "touch",
+      "likelihood": "unproven",
+      "verdict": "false",
+      "class": "touches-a-record-already-held",
+      "why": "self.sudo().read() prefetches one field on the records the caller already has, and the result is discarded"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "account-financial-tools/account_move_name_sequence/models/account_journal.py",
+      "line": 111,
+      "clause": "touch",
+      "likelihood": "unproven",
+      "verdict": "false",
+      "class": "configuration-model-create",
+      "why": "creates the ir.sequence a journal needs, from vals prepared off that journal, after a non-sudo search found none"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "account-financial-tools/account_move_name_sequence/models/ir_sequence.py",
+      "line": 51,
+      "clause": "touch",
+      "likelihood": "unproven",
+      "verdict": "false",
+      "class": "configuration-model-create",
+      "why": "a date range for the sequence the caller holds, keyed by self.id"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "endpoint_route_handler/models/endpoint_route_handler.py",
+      "line": 65,
+      "clause": "query",
+      "likelihood": "defect",
+      "verdict": "false",
+      "class": "global-uniqueness-by-design",
+      "why": "a route is registered once for the whole database, so the clash check has to see every company's rows; scoping it would break the thing it exists to do"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "fastapi/models/fastapi_endpoint_demo.py",
+      "line": 89,
+      "clause": "query",
+      "likelihood": "defect",
+      "verdict": "false",
+      "class": "authentication-before-identity",
+      "why": "an api key is resolved to a user before any identity exists, so there is no caller whose record rules could have applied"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "server-tools/auditlog/models/rule.py",
+      "line": 827,
+      "clause": "touch",
+      "likelihood": "unproven",
+      "verdict": "false",
+      "class": "framework-metadata-create",
+      "why": "creates the ir.actions.act_window that surfaces an audit log; a window action has no tenant boundary"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "server-tools/database_autovacuum_tuning/models/database_autovacuum_tuning.py",
+      "line": 34,
+      "clause": "touch",
+      "likelihood": "unproven",
+      "verdict": "false",
+      "class": "dba-configuration-model",
+      "why": "a postgres tuning row keyed by schema and table name, on a model with no tenant boundary at all"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "server-tools/tracking_manager/models/ir_model.py",
+      "line": 58,
+      "clause": "query",
+      "likelihood": "defect",
+      "verdict": "false",
+      "class": "rebind-over-metadata-only",
+      "why": "`self = self.sudo()` is the construct exactly, and what the method then reads is ir.model.fields and ir.model -- framework metadata with no tenant boundary. The latent half of the rule is real here (anything added below that line is silently elevated too) but nothing below it today crosses a boundary"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "spp_case_demo/models/generate_cases.py",
+      "line": 233,
+      "clause": "touch",
+      "likelihood": "unproven",
+      "verdict": "false",
+      "class": "demo-seeder",
+      "why": "a demo wizard creating an intervention under the plan it created a few lines earlier; the run is an administrator seeding a database and has no caller to isolate from"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "spp_case_demo/models/generate_cases.py",
+      "line": 252,
+      "clause": "touch",
+      "likelihood": "unproven",
+      "verdict": "false",
+      "class": "touches-a-record-already-held",
+      "why": "intervention came from a non-sudo search two lines above, so the caller could already see it and sudo only elevates the write"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "spp_case_demo/models/generate_cases.py",
+      "line": 308,
+      "clause": "touch",
+      "likelihood": "unproven",
+      "verdict": "false",
+      "class": "touches-a-record-already-held",
+      "why": "case was created by this same wizard in this same call"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "spp_case_demo/models/generate_cases.py",
+      "line": 411,
+      "clause": "touch",
+      "likelihood": "unproven",
+      "verdict": "false",
+      "class": "demo-seeder",
+      "why": "interventions attached to the plan the wizard just created"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "spp_case_demo/models/generate_cases.py",
+      "line": 466,
+      "clause": "touch",
+      "likelihood": "unproven",
+      "verdict": "false",
+      "class": "touches-a-record-already-held",
+      "why": "case was created by this same wizard in this same call"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "spp_case_demo/models/generate_cases.py",
+      "line": 556,
+      "clause": "touch",
+      "likelihood": "unproven",
+      "verdict": "false",
+      "class": "demo-seeder",
+      "why": "creates a referral service after a non-sudo search failed to find one; spp.service carries no rule the create could land outside of"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "spp_grm_demo/models/generate_tickets.py",
+      "line": 558,
+      "clause": "touch",
+      "likelihood": "unproven",
+      "verdict": "false",
+      "class": "touches-a-record-already-held",
+      "why": "ticket was created by this same wizard in this same call"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "spp_grm_demo/models/generate_tickets.py",
+      "line": 781,
+      "clause": "touch",
+      "likelihood": "unproven",
+      "verdict": "false",
+      "class": "touches-a-record-already-held",
+      "why": "ticket was created by this same wizard in this same call"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "spp_grm_demo/models/generate_tickets.py",
+      "line": 799,
+      "clause": "touch",
+      "likelihood": "unproven",
+      "verdict": "false",
+      "class": "touches-a-record-already-held",
+      "why": "assigns the ticket it created to a user drawn from a non-sudo search"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "spp_mis_demo_v2/models/mis_demo_generator.py",
+      "line": 3147,
+      "clause": "touch",
+      "likelihood": "unproven",
+      "verdict": "false",
+      "class": "demo-seeder",
+      "why": "an exception fallback in a demo wizard stamping the approval flags that action_apply failed to set on the record it is iterating"
+    },
+    {
+      "rule": "odoo.sudo-bypasses-record-rules",
+      "path": "spp_mis_demo_v2/models/mis_demo_generator.py",
+      "line": 3890,
+      "clause": "touch",
+      "likelihood": "unproven",
+      "verdict": "false",
+      "class": "framework-metadata-read",
+      "why": "reads an ir.actions.act_window fetched by env.ref to return it as the wizard's next action; a window action has no tenant boundary and is routinely unreadable to an ordinary user"
+    }
+  ],
+  "note": "0 true of 24. The query clause -- search, search_count, search_read, read_group -- keeps the 6 true positives classified in classification-openspp-rest-2026-09.json and is unchanged by this pass. The touch clause (create, write, unlink, copy, read) and the escape clause (a sudo recordset bound to a name and passed on) are new, and in 260,897 lines neither has met a real one at HEAD. Every finding they made is code where the caller is an administrator by construction -- a demo-data seeder, an ACL-gated accounting wizard -- or a framework model with no tenant boundary. So those two clauses emit likelihood 'unproven' per finding, which makes them advisory: reported, out of the rate, gating nothing. The grade travels with the finding, so the query clause keeps the rule's 'defect'.",
+  "worklist": "touches-a-record-already-held is 7 of the 23, and scoped-to-a-record-already-held is an eighth of the same shape. One predicate: a recordset the caller obtained under its own rules, then written under sudo. It is not nothing -- ir.rule governs write permission as well as visibility -- but it is a different claim from the one the rule's why paragraph makes, which is about a search returning another company's rows. Deciding whether that is a second rule or a narrowing wants a tree where it fires on production code, and neither of these two is that tree."
+}

corpus/build_corpus.py

@@ -59,9 +59,10 @@ def _onchange_qty(self):
 # Odoo 16 only. From 19 this attribute is ignored and creates nothing:
 # _sql_constraints = [('qty_positive', 'CHECK(qty > 0)', 'Quantity must be positive.')]""",
  "tags": ["onchange", "constraints", "bypass"],
- # onchange is allowed as UX garnish, but only alongside a real enforcement layer.
- "violation_pattern": r"@api\.onchange",
- "satisfied_pattern": r"@api\.constrains|_sql_constraints|models\.Constraint",
+ # onchange is allowed as UX garnish, but only alongside a real enforcement
+ # layer. Both halves of that -- what counts as trying to enforce, and what
+ # counts as a real layer -- are in onchange_tries_to_enforce, which is where
+ # they can be scoped to the decorated function.
 },
 {
  "id": "odoo.constrains-must-list-every-field-read",
@@ -638,19 +639,23 @@ ENRICH = {
         # field from a provider and narrowing a domain are what onchange is for,
         # and flagging those fired on all 16 onchange declarations in two OCA
         # repositories, none of which was validating anything.
-        "violation_pattern": (r"@api\.onchange[\s\S]{0,400}?"
-                              r"(?:raise\s+\w*(?:Validation|User)Error"
-                              r"|['\"]warning['\"]\s*:)"),
-        # All three spellings, including the legacy one. Dropping
-        # _sql_constraints here was tried and reverted: it IS a real
-        # constraint on 16 through 18, a satisfied_pattern is a plain regex
-        # with no way to read the module's series, and the first field test
-        # after the change produced a false positive on OCA's account_loan --
-        # branch 18.0, a genuine _sql_constraints block, an onchange properly
-        # backed by it. The 19 hole is left open here on purpose and closed
-        # where the series IS legible: prefer_sql_constraint_applies reads
-        # odoo_series off the tree facts and only tightens when it says 19+.
-        "satisfied_pattern": r"@api\.constrains|_sql_constraints|models\.Constraint",
+        #
+        # Was a regex reading 400 characters after the decorator, which is not
+        # a function and could not see where one ended. All three of its false
+        # positives were the same failure: a short onchange that assigns a
+        # field, followed by an action method that raises, with the window
+        # crossing the boundary between them. The AST pass scopes the question
+        # to the decorated function.
+        #
+        # The satisfied_pattern moved inside the checker with the same three
+        # spellings, including the legacy one. Dropping _sql_constraints was
+        # tried and reverted: it IS a real constraint on 16 through 18, and the
+        # first field test after the change produced a false positive on OCA's
+        # account_loan -- branch 18.0, a genuine _sql_constraints block, an
+        # onchange properly backed by it. The 19 hole is left open on purpose
+        # and closed where the series IS legible: prefer_sql_constraint_applies
+        # reads odoo_series off the tree facts and only tightens when it says 19+.
+        "semantic_check": "onchange_tries_to_enforce",
         "source": ODOO_ONCHANGE,
     },
     "odoo.constrains-ignores-dotted-names": {
@@ -671,10 +676,16 @@ ENRICH = {
     },
     "odoo.float-comparison-needs-float-utils": {
         # Equality only. Ordering comparisons against zero (qty > 0) have bounded
-        # error and are usually fine; '== 0' is the trap, and this also stops the
-        # pattern firing on CHECK(qty > 0), where float_compare does not apply.
-        "violation_pattern": r"(?:price|amount|qty|quantity|total|balance)\w*\s*(?:==|!=)\s*0(?:\.0+)?\b",
-        "satisfied_pattern": r"float_is_zero|float_compare",
+        # error and are usually fine; '== 0' is the trap, and this also keeps the
+        # checker off CHECK(qty > 0), where float_compare does not apply.
+        #
+        # Was a regex on the variable's NAME, at 2 true and 5 false. Every one
+        # of the five compared an integer to zero -- a search_count, a
+        # read_group `<field>_count`, a SELECT COUNT(*), an fields.Integer --
+        # where == is exact and the rule has nothing to say. Three of the five
+        # and both true positives were spelled `total == 0`, so the name could
+        # never have told them apart; the assignment can, and does.
+        "semantic_check": "float_equality_against_zero",
         "source": ODOO_CONSTRAINTS,
     },
     "odoo.prefer-sql-constraint": {
@@ -728,7 +739,7 @@ ENRICH = {
         # were the defect: the other 100 were on models the tree gives no
         # filtering rule, where sudo drops nothing. The AST pass asks the tree
         # the second half of the question.
-        "semantic_check": "sudo_search_drops_a_real_rule",
+        "semantic_check": "sudo_drops_record_rules",
         # Record rules are a security concept, not an ORM one. The ORM reference
         # does not mention sudo at all.
         "source": ODOO_SECURITY,
@@ -825,12 +836,13 @@ ENRICH = {
         "source": PY_ERRORS,
     },
     "python.eval-and-pickle-execute-their-input": {
-        # 0 true, 1 false. The one finding is the word eval() written in a
-        # method's DOCSTRING, in a sentence arguing against using it. That is
-        # not this rule's fault: scan_source strips # comments before matching
-        # and does not strip string literals, so prose in a docstring is
-        # matched as code. One sample decides nothing about the rule, and the
-        # checker defect it exposes is named in the README.
+        # 0 true, 1 false. The one finding was the word eval() written in a
+        # method's DOCSTRING, in a sentence arguing against using it -- not
+        # this rule's fault but a defect in what patterns were matched
+        # against, since strip_comments removed # comments and left string
+        # literals standing. Docstrings are now emptied before matching, so
+        # that finding does not recur. One sample decides nothing about the
+        # rule itself, which stands as written.
         "violation_pattern": r"\beval\(|\bexec\(|pickle\.loads?\(",
         "source": PY_PICKLE,
     },
@@ -842,43 +854,37 @@ ENRICH = {
         "source": PY_SUBPROCESS,
     },
     "python.path-join-does-not-contain-a-path": {
-        # 0 true, 4 false. All four join a configured directory to a name this
-        # module generated -- a timestamped backup filename, a literal from a
-        # list declared in the same function, a module path from
-        # get_module_path. The name-matching is what fires: `filename` is in
-        # the alternation and says nothing about where the value came from.
-        # Four findings is not enough to conclude a checker is wrong, so it is
-        # reported here rather than acted on.
+        # Was a regex on component NAMES, at 0 true and 4 false. All four join
+        # a configured directory to a name this module generated -- a
+        # timestamped backup filename, a literal from a list declared in the
+        # same function, a module path from get_module_path. `filename` was in
+        # the alternation and says nothing about where the value came from,
+        # which is the only thing the rule is about.
         #
-        # Word-anchored. Unanchored, `form` matched inside `.format(`, so
-        # every os.path.join(..., "x {0}".format(y)) in a codebase was a hit.
-        "violation_pattern": (r"os\.path\.join\([^)]*"
-                              r"\b(?:request|args|params|payload|form|"
-                              r"user_input|uploaded|filename)\b"),
-        # Cleared by resolving and comparing, which is the fix. Without this the
-        # rule's own correct sample matches its own violation pattern: the fix
-        # still joins, it just checks the result afterwards.
-        "satisfied_pattern": r"commonpath|commonprefix|relpath|is_relative_to",
+        # The AST pass asks the origin instead: it fires where a component came
+        # from outside the file and the result is not resolved and compared
+        # first. That reports less, deliberately -- the regex's entire output
+        # on 294,000 lines was false.
+        "semantic_check": "path_join_takes_an_external_name",
         "source": PY_OSPATH,
     },
     "python.decimal-for-money-not-float": {
-        # 0 true, 3 false, and this one has a reason behind it rather than a
+        # 0 true, 3 false, and this one had a reason behind it rather than a
         # sample size. Odoo's Monetary field IS a float -- the ORM defines it
         # that way -- and the framework's answer to the precision problem is
         # float_round and float_compare against the currency's rounding, not
-        # Decimal. So inside an Odoo module the rule fires on the idiom and its
-        # remedy cannot be taken. That is an argument, not a measurement, and
-        # three findings do not settle it either way; it is written down in the
-        # README as the composition's open question rather than acted on here.
+        # Decimal. So inside an Odoo module the old pattern fired on the idiom
+        # and named a remedy that cannot be taken.
         #
-        # Money, not arithmetic. A bare \bfloat\( caught `float(successes) /
-        # total` inside a Wilson score interval, which is exactly what binary
-        # floating point is for. The name has to say it is an amount.
-        "violation_pattern": (r"(?:price|amount|total|cost|balance|fee|tax|"
-                              r"subtotal|payment|salary)\w*\s*=\s*float\(|"
-                              r"float\(\s*[^)]*\b(?:price|amount|cost|balance|"
-                              r"fee|tax|subtotal|payment|salary)\b"),
-        "satisfied_pattern": r"Decimal",
+        # Three findings do not settle a rule either way, so it is narrowed
+        # rather than culled, on the line the argument actually draws: the
+        # remedy exists only where the value is still a string when it
+        # arrives. float(self.amount) is the ORM's own type and is not
+        # reported; float(payload['price']), where Decimal(payload['price'])
+        # is available, is. Money, not arithmetic, as before -- a bare float(
+        # caught `float(successes) / total` inside a Wilson score interval,
+        # which is exactly what binary floating point is for.
+        "semantic_check": "float_coercion_of_external_money",
         "source": PY_DECIMAL,
     },
     "python.naive-and-aware-datetimes-do-not-compare": {
@@ -969,6 +975,75 @@ LIKELIHOOD = {
     # construct is a real defect; nothing measured here has met one. See the
     # checker's docstring for how the rule came about and which half was wrong.
     "odoo.except-order-follows-the-hierarchy": "unproven",
+
+    # ---- graded 2026-09-21, from `recall --aim` over both ecosystems -------
+    #
+    # 795 fix commits read across OpenSPP and the two OCA trees, 237 of them
+    # touching a covered construct, and every finding a checker made in a file
+    # one of those fixes touched placed against the method the fix edited.
+    # The four below are the ones the placements decide; the rest stay
+    # `unmeasured`, which is what they are.
+
+    # 3 on-target of 20 placements, and one commit caught outright. The same
+    # ratio that graded sudo a defect, on a smaller sample: when this rule
+    # fires on a line somebody was fixing, the formatted SQL was the bug.
+    "odoo.sql-needs-query-parameters": "defect",
+
+    # 2 on-target of 23 placements and two commits caught, on top of the 20
+    # hand-classified true positives in classification-python-2026-09.json.
+    # An Odoo Datetime is naive UTC by contract, so a naive LOCAL datetime
+    # reaching one is wrong by the server's offset -- and OpenSPP's history
+    # carries two fixes of exactly that, which is what a defect grade means.
+    "python.naive-and-aware-datetimes-do-not-compare": "defect",
+
+    # 1 on-target of 14, 3 in the right method describing something else, and
+    # one commit caught. The same shape as ondelete's grade and a touch better
+    # aimed: the rule recognises a company-crossing relation and is about the
+    # declaration rather than the line anybody fixes.
+    "odoo.check-company-on-relations": "construct",
+
+    # 1 on-target of 25, 2 in the right method. Its twin
+    # stored-compute-needs-complete-depends measured 1 of 29 and is graded the
+    # same way for the same reason: critical if it happens -- a constraint that
+    # never fires is the silent-bad-data case -- and measured to be about the
+    # method rather than the line.
+    "odoo.constrains-must-list-every-field-read": "construct",
+
+    # ---- the ones that fire nowhere, graded 2026-09-21 --------------------
+    #
+    # Same standard except-order-follows-the-hierarchy was held to, on more
+    # evidence than it had: zero findings across THREE ecosystems -- OpenSPP,
+    # two OCA trees and odoo core itself, 820,000 lines -- and no incident
+    # behind any of them in 1,164 fix commits. `unproven` is the corpus's word
+    # for a real defect nothing measured here has met, and these are it.
+    #
+    # The third tree is what made this safe to do. Measured on OpenSPP and OCA
+    # alone, eleven rules looked like this. Four of them --
+    # bare-except-catches-the-exit, mutable-default-argument,
+    # eval-and-pickle-execute-their-input and subprocess-shell-true-is-injection
+    # -- fire on odoo core, at 28, 15, 4 and 4. Grading them off two trees
+    # would have downgraded four working rules on the strength of not looking
+    # far enough, which is the mistake this grade exists to avoid making
+    # quietly.
+    #
+    # Advisory means reported, out of the rate, gating nothing. For a rule that
+    # has never fired that changes no output today; it changes what happens the
+    # first time one does, and says plainly that nobody has seen it work yet.
+    "odoo.check-constraint-cannot-cross-tables": "unproven",
+    "odoo.constrains-ignores-dotted-names": "unproven",
+    "odoo.no-monkey-patching": "unproven",
+    "odoo.noupdate-on-user-editable-data": "unproven",
+    "odoo.schema-change-needs-migration": "unproven",
+
+    # These two are silent because they were narrowed in 3.47, not because
+    # nothing was there: as regexes they fired 4 and 3 times across the OCA and
+    # OpenSPP trees and every one of those was classified false. Origin-based,
+    # they find nothing in 820,000 lines. Both readings are in the README; the
+    # grade records the second one without deleting the rules, because the
+    # defects they describe are real and a third of this corpus was written
+    # from constructs nobody had met yet either.
+    "python.decimal-for-money-not-float": "unproven",
+    "python.path-join-does-not-contain-a-path": "unproven",
 }
 
 # --------------------------------------------------------------------- PROBES

corpus/corpus_meta.json

@@ -1,12 +1,12 @@
 {
-  "built_utc": "2026-09-16T08:00:31.662425+00:00",
+  "built_utc": "2026-09-22T08:16:07.718107+00:00",
   "rules": 27,
   "machine_checkable": 26,
-  "by_pattern": 16,
-  "by_semantic_check": 10,
+  "by_pattern": 12,
+  "by_semantic_check": 14,
   "checked_against": {
     "odoo": "18.0",
     "python": "3.12"
   },
-  "corpus_sha256": "68dd1fc12d9d546627767f840e3acffb1d0c78fd2ff5571d259261f5312ece03"
+  "corpus_sha256": "8d3d07faba2e1a3f0192b95f67972f9543a8d22325da110e518adb3da0d9d997"
 }

corpus/rules/odoo.json

@@ -23,9 +23,8 @@
       "constraints",
       "bypass"
     ],
-    "violation_pattern": "@api\\.onchange[\\s\\S]{0,400}?(?:raise\\s+\\w*(?:Validation|User)Error|['\\\"]warning['\\\"]\\s*:)",
-    "satisfied_pattern": "@api\\.constrains|_sql_constraints|models\\.Constraint",
     "stack": "odoo",
+    "semantic_check": "onchange_tries_to_enforce",
     "source": "https://www.odoo.com/documentation/18.0/developer/tutorials/server_framework_101/08_compute_onchange.html",
     "likelihood": "unmeasured",
     "advisory": false,
@@ -50,7 +49,7 @@
     ],
     "stack": "odoo",
     "source": "https://www.odoo.com/documentation/18.0/developer/reference/backend/orm.html",
-    "likelihood": "unmeasured",
+    "likelihood": "construct",
     "advisory": false,
     "probe": "my constraint does not run when only one of the two dates is written",
     "semantic_check": "constrains_lists_every_field_read"
@@ -76,8 +75,8 @@
     "stack": "odoo",
     "violation_pattern": "@api\\.constrains\\([^)]*['\\\"][a-z_]+\\.[a-z_]+['\\\"]",
     "source": "https://www.odoo.com/documentation/18.0/developer/reference/backend/orm.html",
-    "likelihood": "unmeasured",
-    "advisory": false,
+    "likelihood": "unproven",
+    "advisory": true,
     "probe": "constrains on partner_id.country_id never fires and raises no error"
   },
   {
@@ -99,8 +98,7 @@
       "intermittent"
     ],
     "stack": "odoo",
-    "violation_pattern": "(?:price|amount|qty|quantity|total|balance)\\w*\\s*(?:==|!=)\\s*0(?:\\.0+)?\\b",
-    "satisfied_pattern": "float_is_zero|float_compare",
+    "semantic_check": "float_equality_against_zero",
     "source": "https://www.odoo.com/documentation/18.0/developer/tutorials/server_framework_101/10_constraints.html",
     "likelihood": "unmeasured",
     "advisory": false,
@@ -182,8 +180,8 @@
     "violation_pattern": "CHECK\\s*\\([^)]*(?:SELECT|[a-z_]+_id\\.[a-z_]+)",
     "stack": "odoo",
     "source": "https://www.postgresql.org/docs/current/ddl-constraints.html",
-    "likelihood": "unmeasured",
-    "advisory": false,
+    "likelihood": "unproven",
+    "advisory": true,
     "probe": "my CHECK constraint will not install because it reads the product stock"
   },
   {
@@ -207,7 +205,7 @@
     "stack": "odoo",
     "semantic_check": "check_company_missing_on_company_owned_relation",
     "source": "https://www.odoo.com/documentation/18.0/developer/reference/backend/orm.html",
-    "likelihood": "unmeasured",
+    "likelihood": "construct",
     "advisory": false,
     "probe": "a user in one company can select another company's journal on a document"
   },
@@ -298,8 +296,8 @@
       "data-loss"
     ],
     "stack": "odoo",
-    "likelihood": "unmeasured",
-    "advisory": false,
+    "likelihood": "unproven",
+    "advisory": true,
     "probe": "I made an existing field required and the module upgrade fails on live data",
     "no_check_reason": "The violation lives in the diff between two module versions plus the presence of a migrations/ directory. Nothing in a single generated snippet reveals it."
   },
@@ -321,7 +319,7 @@
       "record-rules"
     ],
     "stack": "odoo",
-    "semantic_check": "sudo_search_drops_a_real_rule",
+    "semantic_check": "sudo_drops_record_rules",
     "source": "https://www.odoo.com/documentation/18.0/developer/reference/backend/security.html",
     "likelihood": "defect",
     "advisory": false,
@@ -352,8 +350,8 @@
     ],
     "stack": "odoo",
     "violation_pattern": "from\\s+odoo\\.addons[\\s\\S]{0,300}?\\n[A-Z]\\w+\\.\\w+\\s*=\\s*\\w+",
-    "likelihood": "unmeasured",
-    "advisory": false,
+    "likelihood": "unproven",
+    "advisory": true,
     "probe": "change what a core sale.order method does without editing the sale module"
   },
   {
@@ -376,8 +374,8 @@
     "violation_pattern": "<odoo>\\s*<record",
     "satisfied_pattern": "noupdate",
     "source": "https://www.odoo.com/documentation/18.0/developer/reference/backend/data.html",
-    "likelihood": "unmeasured",
-    "advisory": false,
+    "likelihood": "unproven",
+    "advisory": true,
     "probe": "the customer's configuration resets itself every time we upgrade the module"
   },
   {
@@ -425,7 +423,7 @@
     ],
     "stack": "odoo",
     "source": "https://www.odoo.com/documentation/18.0/developer/reference/backend/orm.html",
-    "likelihood": "unmeasured",
+    "likelihood": "defect",
     "advisory": false,
     "probe": "a raw query breaks when a partner name contains an apostrophe",
     "semantic_check": "sql_built_by_string_formatting"
@@ -620,11 +618,10 @@
       "input"
     ],
     "stack": "odoo",
-    "violation_pattern": "os\\.path\\.join\\([^)]*\\b(?:request|args|params|payload|form|user_input|uploaded|filename)\\b",
-    "satisfied_pattern": "commonpath|commonprefix|relpath|is_relative_to",
+    "semantic_check": "path_join_takes_an_external_name",
     "source": "https://docs.python.org/3/library/os.path.html#os.path.join",
-    "likelihood": "unmeasured",
-    "advisory": false,
+    "likelihood": "unproven",
+    "advisory": true,
     "probe": "open a file the user named inside my uploads directory"
   },
   {
@@ -646,11 +643,10 @@
       "decimal"
     ],
     "stack": "odoo",
-    "violation_pattern": "(?:price|amount|total|cost|balance|fee|tax|subtotal|payment|salary)\\w*\\s*=\\s*float\\(|float\\(\\s*[^)]*\\b(?:price|amount|cost|balance|fee|tax|subtotal|payment|salary)\\b",
-    "satisfied_pattern": "Decimal",
+    "semantic_check": "float_coercion_of_external_money",
     "source": "https://docs.python.org/3/library/decimal.html",
-    "likelihood": "unmeasured",
-    "advisory": false,
+    "likelihood": "unproven",
+    "advisory": true,
     "probe": "totals are off by a fraction of a penny after adding prices up"
   },
   {
@@ -671,7 +667,7 @@
     "stack": "odoo",
     "violation_pattern": "datetime\\.now\\(\\s*\\)|utcnow\\(\\s*\\)",
     "source": "https://docs.python.org/3/library/datetime.html",
-    "likelihood": "unmeasured",
+    "likelihood": "defect",
     "advisory": false,
     "probe": "TypeError comparing offset-naive and offset-aware datetimes"
   }

tests/test_layers.py

@@ -379,3 +379,94 @@ def test_version_bounds_narrow_each_other_and_alternatives_do_not():
     assert not layers._version_applies(">=16.0", "15.0")
     # A series nothing can parse still applies the rule, rather than dropping it.
     assert layers._version_applies(">=16.0", "saas~16.3")
+
+
+# ------------------------------------------- what a marker is about
+
+def test_a_marker_naming_another_rule_does_not_silence_this_one():
+    """Classifying 50 findings by hand turned up one suppression that should
+    not have fired: a consent-receipt timestamp inside a return statement
+    carrying `# nosemgrep: odoo-sudo-without-context` four lines below it. A
+    marker about sudo was silencing a finding about datetimes, which is the
+    mute button this project says it will not build, reached from the other
+    direction."""
+    import corpus
+    rules = [r for r in corpus.load_rules()
+             if r["id"] == "python.naive-and-aware-datetimes-do-not-compare"]
+    body = (
+        "def receipt(self):\n"
+        "    return self._build(\n"
+        "        issued=datetime.now(),\n"
+        "        who=self.env.user.id,\n"
+        "    )  # nosemgrep: odoo-sudo-without-context\n"
+    )
+    hits = layers.scan_source(body, rules, "odoo", errors=[])
+    assert len(hits) == 1
+    assert not hits[0].suppressed, "a marker about sudo does not speak for datetimes"
+
+
+def test_a_marker_naming_this_rule_still_silences_it():
+    """The other side of the same line, and the measured one: 105 of OpenSPP's
+    106 `.sudo().search(` findings carry a nosemgrep marker about that exact
+    construct. `odoo-sudo-without-context` and `odoo.sudo-bypasses-record-rules`
+    meet on `sudo` -- and not on `odoo`, which names a vendor rather than a
+    defect."""
+    import corpus
+    rules = [r for r in corpus.load_rules()
+             if r["id"] == "odoo.sudo-bypasses-record-rules"]
+    body = (
+        "def f(self):\n"
+        "    return self.env['res.partner'].sudo().search(\n"
+        "        [('active', '=', True)],\n"
+        "    )  # nosemgrep: odoo-sudo-without-context\n"
+    )
+    hits = layers.scan_source(body, rules, "odoo", errors=[])
+    assert len(hits) == 1
+    assert hits[0].suppressed
+
+
+def test_an_opaque_code_covers_the_line_as_it_always_did():
+    """`B608` carries no words, so it cannot be compared with a rule id at
+    all. Narrowing on a comparison that cannot be made would drop a decision
+    somebody really did record -- two of the six sql-needs-query-parameters
+    findings on OpenSPP sit on lines carrying nothing but `# nosec B608`. The
+    gap this leaves is named in _marker_is_about."""
+    carries, codes = layers._marker_scope("    x = 1  # nosec B608")
+    assert carries and codes == set()
+
+
+def test_prose_after_a_marker_is_not_read_as_a_rule_name():
+    """People write sentences there. `# noqa: decided, TICKET-9` is a person
+    talking, not an analyser code, and reading `decided` as a rule id would
+    silently unsuppress a line somebody had settled."""
+    for text in ("    x = 1  # noqa: decided, TICKET-9",
+                 "    x = 1  # noqa: this guard is advisory, see TICKET-41"):
+        carries, codes = layers._marker_scope(text)
+        assert carries and codes == set(), text
+
+
+def test_a_statement_that_covers_the_line_beats_one_that_borrows_it():
+    """Every span reaches one line above its statement to take in a marker
+    written there, so two statements on consecutive lines overlap. A finding
+    on the first line of one is also inside the borrowed line of the one
+    below, both spans are one line wide, and the tie used to go to whichever
+    ast.walk reached first.
+
+    Found on OpenSPP the first time the write clause of the sudo rule fired:
+    spp_api_v2/wizards/show_secret_wizard.py carries its nosemgrep on line 36
+    about the write on 37, and the `return` on 38 borrows 37 for itself. The
+    marker read as absent and a decision somebody had recorded was re-raised.
+    """
+    import corpus
+    rule = [r for r in corpus.load_rules()
+            if r["id"] == "odoo.sudo-bypasses-record-rules"][0]
+    body = (
+        "def action_close(self):\n"
+        "    if self.client_id:\n"
+        "        # nosemgrep: odoo-sudo-without-context -- wizard ACL controls access\n"
+        "        self.client_id.sudo().write({'client_secret': False})\n"
+        "    return {'type': 'ir.actions.act_window_close'}\n"
+    )
+    hits = layers.scan_source(body, [rule], "odoo", errors=[])
+    assert len(hits) == 1 and hits[0].line == 4
+    assert hits[0].suppressed, "the marker one line above its own statement was lost"

tests/test_semantics.py

@@ -941,15 +941,424 @@ def test_the_corpus_does_not_advise_a_declaration_odoo_19_ignores():
 
 
 def test_the_onchange_guard_knows_every_spelling_of_a_constraint():
-    """A satisfied_pattern is a plain regex and cannot read the module's series,
-    so it has to accept the legacy attribute: that IS a constraint on 16 through
-    18. Narrowing it to models.Constraint alone was tried and reverted -- the
-    next field test reported OCA's account_loan, branch 18.0, with a real
+    """The guard has to accept the legacy attribute: that IS a constraint on 16
+    through 18. Narrowing it to models.Constraint alone was tried and reverted --
+    the next field test reported OCA's account_loan, branch 18.0, with a real
     _sql_constraints block and an onchange properly backed by it.
 
     The 19 case is closed where the series is legible instead, in
-    prefer_sql_constraint_applies."""
-    rule = [r for r in corpus.load_rules()
-            if r["id"] == "odoo.onchange-is-not-validation"][0]
-    for spelling in ("@api", "_sql_constraints", "models"):
-        assert spelling in rule["satisfied_pattern"], spelling
+    prefer_sql_constraint_applies.
+
+    Asserted against the checker rather than against a satisfied_pattern,
+    which is where the guard moved when the rule became an AST pass. The
+    three spellings are the same three."""
+    body = ('class M(models.Model):\n'
+            '    @api.onchange("qty")\n'
+            '    def _onchange_qty(self):\n'
+            '        if self.qty <= 0:\n'
+            '            raise ValidationError("no")\n')
+    assert semantics.run_check("onchange_tries_to_enforce", body), \
+        "an unbacked onchange that raises is the violation"
+
+    for spelling in ('    @api.constrains("qty")\n    def _check(self):\n        pass\n',
+                     '    _sql_constraints = [("q", "CHECK(qty > 0)", "no")]\n',
+                     '    _qty = models.Constraint("CHECK(qty > 0)", "no")\n'):
+        backed = body + spelling
+        assert not semantics.run_check("onchange_tries_to_enforce", backed), spelling
+
+
+# ------------------------------------------------ the value-origin trace
+#
+# Four rules were classified false for one reason: each read a variable's NAME
+# and treated that as evidence about its value. Every case below is a finding
+# somebody read by hand and recorded a verdict for, in
+# classification-{oca,openspp,python}-2026-09.json.
+
+INT_ZERO_CASES = [
+    ("search_count", """
+def f(self):
+    total_population = self.env["res.partner"].search_count([])
+    if total_population == 0:
+        return 0
+"""),
+    ("read_group _count, keyed by an f-string", """
+def f(self, field_name, rows):
+    for row in rows:
+        group_total = row[f"{field_name}_count"]
+        if group_total == 0:
+            continue
+"""),
+    ("SELECT COUNT(*) through a cursor", """
+def f(cr, table, where):
+    cr.execute(f"SELECT COUNT(*) FROM {table} WHERE {where}")
+    total = cr.fetchone()[0]
+    if total == 0:
+        return []
+"""),
+    ("a field the same file declares as fields.Integer", """
+class L(models.Model):
+    qty = fields.Integer(string="Quantity")
+
+    def f(self):
+        self.line_ids.filtered(lambda x: x.qty == 0).unlink()
+"""),
+]
+
+
+@pytest.mark.parametrize("label,body", INT_ZERO_CASES,
+                         ids=[c[0] for c in INT_ZERO_CASES])
+def test_an_integer_compared_to_zero_is_not_a_float_comparison(label, body):
+    """All five false positives on this rule compared an INTEGER to zero, where
+    == is exact and the rule has nothing to say. Three of them and both true
+    positives were spelled `total == 0`, so the name could never have separated
+    them."""
+    assert semantics.run_check("float_equality_against_zero", body) == [], label
+
+
+def test_a_float_compared_to_zero_still_fires():
+    """The guard suppresses; it must not suppress everything. `sum()` over
+    amounts is the true positive that shares its spelling with three of the
+    false ones."""
+    body = """
+def f(sorted_amounts):
+    total = sum(sorted_amounts)
+    if total == 0:
+        return 0.0
+"""
+    assert semantics.run_check("float_equality_against_zero", body)
+
+
+def test_a_locally_built_filename_is_not_a_traversal():
+    """0 true, 4 false. All four join a configured directory to a name the
+    module itself produced, and the pattern matched the word `filename`."""
+    body = """
+def f(self, data_path):
+    for file_config in [{"filename": "a.csv"}]:
+        file_path = os.path.join(data_path, file_config["filename"])
+"""
+    assert semantics.run_check("path_join_takes_an_external_name", body) == []
+
+
+def test_a_component_from_outside_the_file_still_fires():
+    body = "full = os.path.join(UPLOAD_DIR, request.args['name'])\n"
+    assert semantics.run_check("path_join_takes_an_external_name", body)
+
+
+def test_resolving_the_path_clears_the_join_in_that_function_only():
+    """The fix is to resolve and compare, and it is written beside the join. A
+    realpath in a DIFFERENT function says nothing about this one."""
+    fixed = """
+def f(base):
+    full = os.path.realpath(os.path.join(base, request.args['name']))
+    if os.path.commonpath([base, full]) != base:
+        raise ValueError("escapes")
+"""
+    assert semantics.run_check("path_join_takes_an_external_name", fixed) == []
+    elsewhere = fixed + """
+
+def g(base):
+    return open(os.path.join(base, request.args['other']), 'rb')
+"""
+    assert semantics.run_check("path_join_takes_an_external_name", elsewhere)
+
+
+def test_the_orm_monetary_idiom_is_not_a_decimal_violation():
+    """Odoo's Monetary field IS a float -- the ORM defines it that way -- so
+    inside a module the rule fired on the idiom and named a remedy that cannot
+    be taken. Both shapes below were classified false."""
+    for body in ("""
+class E(models.Model):
+    def f(self):
+        ctx = {"base_amount": float(self.amount or 0.0)}
+""", """
+def f(self):
+    result = self.env["spp.cel.service"].evaluate_expression(self.e, {})
+    amount = float(result)
+"""):
+        assert semantics.run_check("float_coercion_of_external_money", body) == [], body
+
+
+def test_a_money_string_from_outside_still_fires():
+    """Where the value arrives as a string, Decimal(value) IS available and the
+    rule's remedy can be taken. This is the rule's own wrong sample."""
+    body = "price = float(payload['price'])\n"
+    assert semantics.run_check("float_coercion_of_external_money", body)
+
+
+def test_an_onchange_does_not_answer_for_the_method_below_it():
+    """All three false positives on this rule were the same failure: a short
+    onchange that assigns a field, followed by an action method that raises,
+    with the regex's 400-character window crossing between them.
+    spp_studio/wizard/variable_remap_wizard.py is the shape, verbatim."""
+    body = """
+class W(models.TransientModel):
+    @api.onchange("variable_id")
+    def _onchange_variable_id(self):
+        if self.variable_id and self.variable_id.source_model:
+            self.target_model = self.variable_id.source_model
+
+    def action_remap(self):
+        self.ensure_one()
+        if not self.new_field_id:
+            raise UserError(_("Please select a field to map to."))
+"""
+    assert semantics.run_check("onchange_tries_to_enforce", body) == []
+
+
+def test_the_onchange_finding_anchors_on_the_decorator():
+    """Where the rule is, and where a marker about it gets written. A
+    FunctionDef's own lineno is the `def`, one line further down."""
+    body = ('class M(models.Model):\n'
+            '    @api.onchange("qty")\n'
+            '    def _onchange_qty(self):\n'
+            '        raise ValidationError("no")\n')
+    found = semantics.run_check("onchange_tries_to_enforce", body)
+    assert [line for line, _, _ in found] == [2]
+
+
+# ------------------------------------------------- sudo, all three clauses
+
+@pytest.mark.parametrize("clause,body", [
+    ("read", "def f(self):\n"
+             "    return self.env['res.partner'].sudo().search([])\n"),
+    ("create", "def f(self, vals):\n"
+               "    return self.env['res.partner'].sudo().create(vals)\n"),
+    ("write", "def f(self):\n"
+              "    self.env['res.partner'].sudo().write({'name': 'x'})\n"),
+    ("unlink", "def f(self):\n"
+               "    self.env['res.partner'].sudo().unlink()\n"),
+    ("handed to a call", "def f(self):\n"
+                         "    p = self.env['res.partner'].sudo()\n"
+                         "    return self._handle(p)\n"),
+    ("returned", "def f(self):\n"
+                 "    p = self.env['res.partner'].sudo()\n"
+                 "    return p\n"),
+])
+def test_sudo_covers_the_three_clauses_its_rule_states(clause, body):
+    """The rule says three things -- scope it narrowly, re-apply company
+    filtering, never pass a sudo recordset onward -- and only the read was
+    checked. `.sudo(` is the largest cluster in the recall harvest at 70
+    missed against 6 caught, and on the OpenSPP tree the unchecked write
+    clause has 136 call sites against the read clause's 116."""
+    assert semantics.run_check("sudo_drops_record_rules", body), clause
+
+
+@pytest.mark.parametrize("why,body", [
+    ("the call re-applies company scoping by hand",
+     "def f(self):\n"
+     "    return self.env['res.partner'].sudo().search("
+     "[('company_id', 'in', self.env.company.ids)])\n"),
+    ("the recordset never leaves the function",
+     "def f(self):\n"
+     "    p = self.env['res.partner'].sudo()\n"
+     "    return p.mapped('name')\n"),
+])
+def test_sudo_stays_quiet_where_the_rule_is_already_followed(why, body):
+    assert semantics.run_check("sudo_drops_record_rules", body) == [], why
+
+
+# ------------------------------------------------------------- docstrings
+
+def test_a_docstring_is_prose_and_is_not_matched_as_code():
+    """Two of the 50 findings the Python composition added were this: `eval()`
+    named in a docstring in a sentence arguing against using it, and a
+    `datetime.now()` inside a doctest example."""
+    src = ('def f():\n'
+           '    """Never use eval() here.\n'
+           '\n'
+           '    >>> datetime.now()\n'
+           '    """\n'
+           '    return 1\n')
+    view = semantics.strip_comments(src)
+    assert "eval(" not in view
+    assert "datetime.now()" not in view
+
+
+def test_a_real_string_literal_survives_and_the_geometry_does_too():
+    """Only docstrings. A triple-quoted SQL query is data the checkers have a
+    legitimate interest in, and a line or column that moved would misreport
+    every finding below it."""
+    src = 'Q = """SELECT COUNT(*) FROM t"""\n\ndef f():\n    """doc"""\n    return Q\n'
+    view = semantics.strip_comments(src)
+    assert "SELECT COUNT(*)" in view
+    assert "doc" not in view
+    assert len(view) == len(src)
+    assert view.count("\n") == src.count("\n")
+
+
+def test_rebinding_self_to_sudo_elevates_the_rest_of_the_method():
+    """The shape behind the one miss the README names by hand.
+
+    OCA server-tools cbefaa511485, "[FIX] excel_import_export: remove sudo()
+    when importing record", deletes a single line -- `self = self.sudo()` --
+    and says what it cost: "finding multiple records across all companies
+    during import when they have same record name. Previously, importing with
+    sudo could bypass multi-company record rules."
+
+    Nothing below that line names sudo, so every clause that looks for
+    `.sudo().<method>()` is blind to it, and the recordset is never passed
+    anywhere either. It replaces the thing the whole method is written
+    against, which is the escape clause at its widest.
+
+    Run against that commit's own before and after images, the finding sits on
+    line 283, is gone afterwards, and 283 is one of the two lines the fix
+    changed -- an on-target catch by recall's own definition.
+    """
+    before = ("class X(models.AbstractModel):\n"
+              "    def import_xlsx(self, res_id, template):\n"
+              "        self = self.sudo()\n"
+              "        record = self.env[template.res_model].browse(res_id)\n"
+              "        return record\n")
+    after = before.replace("        self = self.sudo()\n", "")
+    found = semantics.run_check("sudo_drops_record_rules", before)
+    assert [line for line, _, _ in found] == [3]
+    assert not semantics.run_check("sudo_drops_record_rules", after)
+
+
+def test_a_rebind_keeps_the_rules_own_grade():
+    """The touch and escape clauses report `unproven` because nothing measured
+    has met a real one. This clause has: a fix commit that deletes the line and
+    explains the multi-company leak it caused. So it carries no grade of its
+    own and keeps the rule's `defect`."""
+    body = ("def f(self):\n"
+            "    self = self.sudo()\n"
+            "    return self.env['res.partner'].search([])\n")
+    grades = {grade for _, _, grade in
+              semantics.run_check("sudo_drops_record_rules", body)}
+    assert None in grades, "a rebind must not be downgraded to unproven"
+
+
+def test_a_sudo_recordset_bound_to_a_fresh_name_is_not_a_rebind():
+    """`p = self.env['x'].sudo()` binds a new name and elevates nothing that
+    was not already written against it. Only rebinding a name to its OWN sudo
+    form silently elevates the code below."""
+    body = ("def f(self):\n"
+            "    p = self.env['res.partner'].sudo()\n"
+            "    return p.mapped('name')\n")
+    assert semantics.run_check("sudo_drops_record_rules", body) == []
+
+
+def test_sudo_false_is_de_escalation_and_is_never_a_finding():
+    """`sudo(False)` turns record rules back ON.
+
+    It is how a method that must run under the caller's own rights says so.
+    Odoo core does it 60 times, including mail's `_check_attachments_access`,
+    whose docstring reads "This method relies on access rules/rights and
+    therefore it should not be called from a sudo env." Reading it as an
+    escalation reports the safeguard as the defect.
+
+    Neither OpenSPP nor the OCA trees contain a single `sudo(False)`, so this
+    was invisible until the corpus was pointed at odoo core.
+    """
+    for body in ("class A(models.Model):\n"
+                 "    def f(self, toks):\n"
+                 "        self = self.sudo(False)\n"
+                 "        return self.env['x'].search([])\n",
+                 "def f(self):\n"
+                 "    return self.env['res.partner'].sudo(False).search([])\n",
+                 "def f(self, vals):\n"
+                 "    return self.env['res.partner'].sudo(False).create(vals)\n"):
+        assert semantics.run_check("sudo_drops_record_rules", body) == [], body
+
+
+def test_a_computed_sudo_flag_still_counts_as_escalation():
+    """`sudo(flag)` can be either, and an unreadable argument must leave the
+    finding standing rather than suppress it -- the same direction every other
+    trigger on this rule errs in."""
+    body = ("def f(self, flag):\n"
+            "    self = self.sudo(flag)\n"
+            "    return self.env['x'].search([])\n")
+    assert semantics.run_check("sudo_drops_record_rules", body)
+
+
+def test_an_unstored_framework_field_is_not_a_stored_compute():
+    """odoo/models.py adds display_name to every model as
+    `fields.Char(automatic=True, compute='_compute_display_name', search=...)`
+    with no store. An override that omits a dependency therefore cannot leave
+    a stale row, because there is no row.
+
+    The checker read "no declaration in this file" as unknown storedness and
+    kept the finding, which is right for an ordinary field declared in another
+    module and wrong here: the framework's declaration is knowable and says
+    not stored. 121 of the 1,051 findings this rule made on odoo core were
+    this shape.
+    """
+    body = ("class M(models.Model):\n"
+            "    _inherit = 'res.partner'\n"
+            "\n"
+            "    @api.depends('phone')\n"
+            "    def _compute_display_name(self):\n"
+            "        for rec in self:\n"
+            "            rec.display_name = rec.name + rec.phone\n")
+    assert semantics.run_check("depends_covers_compute_reads", body) == []
+
+
+def test_a_model_that_stores_display_name_itself_is_still_checked():
+    """The narrowing is about the framework's default, not about the name. A
+    model that declares `display_name = fields.Char(..., store=True)` in its
+    own file has opted into a stored row, and all 10 hand-verified true
+    positives that compute display_name -- every one of them in OpenSPP -- do
+    exactly that. Losing those is what this test exists to prevent.
+    """
+    body = ("class M(models.Model):\n"
+            "    _name = 'a.b'\n"
+            "\n"
+            "    display_name = fields.Char(compute='_compute_display_name', store=True)\n"
+            "\n"
+            "    @api.depends('phone')\n"
+            "    def _compute_display_name(self):\n"
+            "        for rec in self:\n"
+            "            rec.display_name = rec.name + rec.phone\n")
+    found = semantics.run_check("depends_covers_compute_reads", body)
+    assert any("'name'" in message for _, message, _ in found), found
+
+
+def test_a_sql_view_model_has_no_foreign_key_to_decide_about():
+    """`_auto = False` means odoo builds no table for the model, so there is
+    no foreign key, and `ondelete` is not a decision anybody can make about
+    it. Two of the 15 sampled ondelete findings on odoo core were report
+    models of exactly this kind: hr.contract.history and
+    purchase.bill.line.match.
+
+    None of the 26 hand-verified true positives for this rule sits on an
+    _auto = False model, which is what makes the exemption free.
+    """
+    view = ("class R(models.Model):\n"
+            "    _name = 'a.report'\n"
+            "    _auto = False\n"
+            "\n"
+            "    employee_id = fields.Many2one('hr.employee', readonly=True)\n"
+            "\n"
+            "    def f(self):\n"
+            "        return self.employee_id.name\n")
+    assert semantics.run_check("ondelete_leaves_a_dangling_read", view) == []
+
+    table = view.replace("    _auto = False\n", "")
+    assert semantics.run_check("ondelete_leaves_a_dangling_read", table), \
+        "a real table with the same declaration is still the rule's subject"
+
+
+def test_sudo_de_escalation_is_recognised_by_keyword_too():
+    """odoo's signature is `sudo(self, flag=True)`, so `sudo(flag=False)` is
+    the same de-escalation as `sudo(False)`. Reading only positional
+    arguments missed it, and core writes it that way twice."""
+    body = "def f(self):\n    return self.env['res.partner'].sudo(flag=False).search([])\n"
+    assert semantics.run_check("sudo_drops_record_rules", body) == []
+
+
+def test_restoring_the_ambient_level_is_not_an_escalation():
+    """`x.sudo(self.env.su)` sets su to whatever the environment already has,
+    so it cannot raise privilege above ambient. It is how a method hands a
+    record back at the caller's own level, and odoo core writes it beside the
+    comment "Unsudo the invoice after creation if not already sudoed".
+
+    `sudo(self.env.su or field.compute_sudo)` is not the same thing: the `or`
+    can turn it on, so only the bare attribute reads as ambient.
+    """
+    ambient = "def f(self, invoice):\n    invoice = invoice.sudo(self.env.su)\n    return invoice\n"
+    assert semantics.run_check("sudo_drops_record_rules", ambient) == []
+
+    may_raise = ("def f(self, rec):\n"
+                 "    rec = rec.sudo(self.env.su or self.compute_sudo)\n"
+                 "    return rec\n")
+    assert semantics.run_check("sudo_drops_record_rules", may_raise)