context: the version floor is a gap, not a finding

Two of this layer's findings never depended on the answer:

this module targets Odoo 17.0; the corpus was checked against 18.0
tsconfig has strict off, so the compile-time half is not enforced

Both are true and both were in the wrong slot. A finding says something in THIS
ANSWER is wrong or unproven. These say the corpus was verified against a
different series, and that this project has not finished turning strict on --
facts about the corpus and the tree, which hold whatever the answer says.

As findings they were a floor. Every Odoo module off the newest series and every
project mid-migration drew a WARN on every run, so PASS was unreachable for most
real users and the WARN stopped carrying information -- the same argument that
keeps `check` silent about a file that fits.

The deciding detail: 0 of the 15 Odoo rules carries an odoo_versions field, so
_version_applies -- the check that names a retrieved rule which genuinely does
not hold on this series -- has never fired and cannot. The blanket warning was
standing in for per-rule data that does not exist yet, and spending a verdict on
it. That per-rule check keeps its finding; only the blanket one moves.

Both are gaps now, under "Not checked", and the layer reports UNKNOWN when they
were all it had. Contextual confidence reads none, which is the claim the WARN
was making without taking the verdict with it.

WHAT IT DOES TO THE MEASUREMENT, INCLUDING THE UNCOMFORTABLE PART

Arithmetic on the rows in eval-check-2026-09.json -- not a second run, and
labelled as such in both documents -- moves five of the twenty WARNs to PASS:

fsm_job.py WARN x5 -> WARN x5
fsm_visit.py WARN x5 -> PASS x5
load_prices.py WARN x5 -> WARN x5
partners.ts WARN x5 -> WARN x5
board.js REJECT x5 -> REJECT x5

All five are the truncated file: 24% of it never sent, a 435-character answer
naming 1 of its 19 symbols, and across five runs the context fact was the only
thing any layer found. That file now reads PASS.

It was never being caught for being unreviewed. It was being caught for its
manifest, and a right verdict for an unrelated reason is an accident rather than
a safety property. Removing the accident is what makes the real gap visible:
truncation is not evidence-bearing. A review of the first 6,000 characters of a
7,929-character file should not reach PASS without the verdict saying so, and
today the only thing that says so is a line of prose above the answer.

Not fixed here. It belongs with the per-rule version data and the by-symbol
review, not with a floor that happened to mask it.

The eval is not re-run: Ollama is down on this machine and a projection is not a
measurement. Both documents say which numbers were measured and which were
derived.

4 tests: the mismatch as a gap, the per-rule check that still warns, strict off
as a gap and strict on as something checked. 340 total.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ARCHITECTURE.md

@@ -695,7 +695,8 @@ running the command could reach them. They are now `bin/subject.py`, so
 copy of them that drifts away quietly.
 
 **Five files, five runs each, 25 reviews.** `subjects/` is committed — one file
-per route `check` can take, one of them too long to fit.
+per route `check` can take, one of them too long to fit. Measured before the
+context floor was demoted; 3.27 says what that does to the table.
 
 | | |
 |---|---|
@@ -708,12 +709,12 @@ per route `check` can take, one of them too long to fit.
 
 **The stability number is not the one `ask` reports.** 12/12 on `ask` means the
 model landed in the same place five times running. Here, four of the five files
-carry a context finding decided before generation starts — a module on Odoo 17.0
-against a corpus checked against 18.0, a `tsconfig` with `strict` off — so their
-verdict cannot move whatever the model writes. `subjects/` was built that way on
-purpose, to give the layer `ask` can never run something real to do. The
-consequence is worth stating plainly: that WARN is an environment fact, not a
-review, and every module not on the corpus's checked series has it.
+carried a context finding decided before generation starts — a module on Odoo
+17.0 against a corpus checked against 18.0, a `tsconfig` with `strict` off — so
+their verdict could not move whatever the model wrote, and 5 of 5 was mostly a
+constant. `subjects/` was built that way on purpose, to give the layer `ask` can
+never run something real to do; what it exposed instead was that the layer was
+answering with the wrong kind of statement. Both are gaps now (3.27).
 
 **The checkers never look at the file.** They run over the answer. On the Python
 and TypeScript subjects the model reproduced the file, so the file's own defects
@@ -741,6 +742,54 @@ found.
 sampled from anybody's production tree. `nexa eval --check <path>` takes a real
 one; `subjects/README.md` says what the committed set does and does not buy.
 
+### 3.27 The context floor was a finding, and is now a gap
+
+The context layer had two findings that did not depend on the answer:
+
+    this module targets Odoo 17.0; the corpus was checked against 18.0, so
+    version-specific behaviour in these rules is unverified here
+
+    tsconfig has strict off, so the compile-time half of any type-based
+    guarantee in this answer is not actually enforced
+
+Both are true, both are worth knowing, and both were in the wrong slot. A
+finding says something in THIS ANSWER is wrong or unproven. These say the corpus
+was verified against a different series, and that this project has not finished
+turning strict on -- facts about the corpus and the tree, which hold whatever
+the answer says.
+
+As findings they were a floor. Any Odoo module not on the newest series, and any
+project mid-migration, drew a WARN on every run forever, so PASS was unreachable
+for most real users and the WARN stopped carrying information. That is the same
+argument that keeps `check` silent about a file that fits: a warning on every
+run trains people to skip it.
+
+The deciding detail: **0 of the 15 Odoo rules carries an `odoo_versions`
+field.** `_version_applies` -- the check that produces a real finding, naming a
+retrieved rule that genuinely does not hold on this series -- has therefore
+never fired and cannot. The blanket warning was standing in for per-rule data
+that does not exist yet, and spending a verdict to do it.
+
+Both are gaps now, printed under "Not checked", and the layer reports UNKNOWN
+when they were all it had. Contextual confidence reads `none`, which is the same
+claim the WARN was making without burning the verdict. The per-rule version
+check keeps its finding.
+
+**What it does to 3.26, and the part that is uncomfortable.** Arithmetic on the
+recorded rows -- not a second run -- moves five of the twenty WARNs to PASS, and
+all five are `fsm_visit.py`: the file that lost 24% of itself to truncation and
+came back with a 435-character answer naming 1 of its 19 symbols. Five runs, and
+the context fact was the only thing any layer found.
+
+That file now reads PASS. It was never being caught for being unreviewed; it was
+being caught for its manifest, and getting the right verdict for an unrelated
+reason is an accident rather than a safety property. Removing the accident is
+what makes the gap visible: **truncation itself is not evidence-bearing.** A
+review of the first 6,000 characters of a 7,929-character file should not be
+able to reach PASS without saying so, and today the only thing that says so is a
+line of prose above the answer. That belongs with the per-rule version data and
+the by-symbol review, not with a floor that happened to mask it.
+
 ## 4. Performance traps, all found by measurement
 
 Within four instrumented runs the report showed the 7B at ~10 tok/s against a

README.md

@@ -146,15 +146,22 @@ Rules retrieved:
 `--stack` overrides the detection in either direction. Unlike `nexa ask`, this one has **surroundings to read**: the nearest
 `__manifest__.py` gives the Odoo series, the file gives its model names and existing
 imports, the nearest `tsconfig.json` says whether `strict` is on. Those facts go into
-the question *and* into the context layer, so an answer can be flagged as right in
-general and wrong for this module:
+the question *and* into the context layer.
+
+Where they say the corpus was verified somewhere else, that is reported as a **gap**,
+not a finding — it is true of the corpus whatever the answer says, and a verdict that
+fires on every run in every project off the newest series stops being read:
 
 ```
-[medium] context
-      this module targets Odoo 17.0; the corpus was checked against 18.0, so
-      version-specific behaviour in these rules is unverified here
+Not checked
+  context      version-specific behaviour
+               this module targets Odoo 17.0 and the corpus was checked against
+               18.0, so anything version-specific in these rules is unverified here
 ```
 
+A rule that was actually retrieved and genuinely does not apply to this series is a
+different claim, and stays a finding with the rule id attached.
+
 ### Ask about your own code
 
 ```bash
@@ -269,7 +276,7 @@ Same principle as `z.infer<typeof Schema>`: one definition, derived artifacts, n
 | **Recall against 56 real Odoo bugfixes** | **1. See below.** |
 | Verdict stability, 12 questions x 5 runs | 12/12 same verdict every run |
 | Escalation rescued a bad draft | 12 of 22, 95% CI 35–73% |
-| **`nexa check`, 5 files x 5 runs** | **0 of 25 reached PASS. See below.** |
+| **`nexa check`, 5 files x 5 runs** | **0 of 25 reached PASS, and not for a good reason. See below.** |
 
 29 of 32 rules carry an automated check. The remaining three are decidable only with
 context a snippet does not contain, so they return **no verdict** — never a false pass
@@ -453,7 +460,8 @@ adds the four things only a file can produce: which corpus it was routed to, how
 much of it fitted, what the surroundings on disk let the context layer say, and
 whether the answer mentions the file at all.
 
-Five files, five runs each:
+Five files, five runs each, measured **before** the context floor was demoted
+(see below):
 
 | | |
 |---|---|
@@ -463,12 +471,21 @@ Five files, five runs each:
 | Same verdict every run | 5 of 5 files |
 | Files whose answer named nothing they declare | 2 of 5 |
 
-**That stability is not `ask`'s stability.** Four of the five files carry a
-context finding decided before the model runs — a module on Odoo 17.0 against a
-corpus checked against 18.0, a `tsconfig` with `strict` off — so the verdict
-cannot move whatever the answer says. The subject set was built that way on
-purpose; the consequence is that every module not on the checked series has a
-WARN floor that is an environment fact, not a review.
+**That 0 was not strictness, it was an accident.** Four of the five files carried
+a context finding decided before the model ran — a module on Odoo 17.0 against a
+corpus checked against 18.0, a `tsconfig` with `strict` off — so their verdict
+could not move whatever the answer said, and 5 of 5 "stable" was mostly a
+constant. Both are now **gaps** rather than findings, for the reason above: they
+are true of the corpus and the project, not of the answer, and none of the 15
+Odoo rules carries an `odoo_versions` field, so the blanket warning was standing
+in for per-rule data that does not exist yet.
+
+Arithmetic on the recorded rows — not a second run — puts the demotion at **five
+WARNs becoming PASS**, and every one of them is the truncated file, where the
+context fact was the only thing any layer found across five runs. Which is the
+uncomfortable half: the file that lost 24% of itself and came back with a
+435-character answer naming 1 of its 19 symbols now reads PASS. It was never
+being caught for that. It was being caught for its manifest.
 
 **The checkers run over the answer, not over the file.** On the Python and
 TypeScript subjects the model reproduced the file, so its real defects came back

bin/layers.py

@@ -585,14 +585,25 @@ def layer_context(rules, ctx):
     verified_against = (meta.get("checked_against") or {}).get(ctx.get("stack"))
 
     if ctx.get("stack") == "odoo":
-        if series:
+        if series and verified_against and series != verified_against:
+            # A gap, not a finding, and the difference is the whole point of
+            # having both. A finding says something in THIS ANSWER is wrong or
+            # unproven. This says the corpus was verified against a different
+            # series, which is a fact about the corpus and holds whatever the
+            # answer says -- so as a finding it made WARN the floor for every
+            # module not on the newest series, and a verdict that fires on every
+            # run stops being read. Same argument as the truncation warning that
+            # deliberately says nothing about a file that fits.
+            #
+            # The per-rule check below is the one that stays a finding: it names
+            # a rule that was actually retrieved and actually does not apply.
+            gaps.append(("version-specific behaviour",
+                         "this module targets Odoo {0} and the corpus was checked "
+                         "against {1}, so anything version-specific in these rules "
+                         "is unverified here".format(series, verified_against)))
+        elif series:
             checked.append("Odoo series {0} from {1}".format(
                 series, os.path.basename(ctx.get("manifest") or "manifest")))
-            if verified_against and series != verified_against:
-                findings.append(Finding("medium",
-                                        "this module targets Odoo {0}; the corpus was checked "
-                                        "against {1}, so version-specific behaviour in these "
-                                        "rules is unverified here".format(series, verified_against)))
         else:
             gaps.append(("Odoo series", "no __manifest__.py with a version was found "
                                         "above this file"))
@@ -608,10 +619,15 @@ def layer_context(rules, ctx):
                                             declared, series), rule=r["id"]))
 
     if ctx.get("ts_strict") is False:
-        findings.append(Finding("medium",
-                                "tsconfig has strict off, so the compile-time half of any "
-                                "type-based guarantee in this answer is not actually enforced"))
-        checked.append("tsconfig strict")
+        # Demoted with the series mismatch above, for the same reason: it fires
+        # on the project rather than on the answer, and it fires on every run in
+        # any project that has not finished turning strict on. Making it a
+        # finding again would mean checking whether this answer leans on the
+        # type system at all -- its declared enforcement layer -- rather than
+        # assuming every answer does.
+        gaps.append(("type-based guarantees",
+                     "tsconfig has strict off, so the compile-time half of any "
+                     "type-based guarantee in this answer is not enforced here"))
     elif ctx.get("ts_strict") is True:
         checked.append("tsconfig strict")
     elif ctx.get("stack") in ("typescript", "javascript"):

tests/test_layers.py

@@ -120,12 +120,47 @@ def test_context_that_actually_checked_something_can_pass(odoo_rules):
     assert result.verdict in (layers.PASS, layers.WARN)
 
 
-def test_context_mismatched_series_warns(odoo_rules):
-    """The corpus was checked against 18.0; a 15.0 module deserves to be told."""
+def test_context_mismatched_series_is_a_gap_and_not_a_finding(odoo_rules):
+    """The corpus was checked against 18.0 and a 15.0 module deserves to be told
+    -- under 'Not checked', which is where things that are true of the corpus
+    rather than of the answer belong.
+
+    It was a finding, and as a finding it was the floor: no module off the
+    newest series could reach PASS however good the answer was, on any run. A
+    verdict that fires every time stops being read, and none of the 15 Odoo
+    rules carries an odoo_versions field, so the blanket warning was standing in
+    for per-rule data that does not exist yet.
+    """
     result = layers.layer_context(odoo_rules, _ctx(odoo_series="15.0",
                                                    manifest="__manifest__.py"))
+    assert result.findings == []
+    assert result.verdict == layers.UNKNOWN, "nothing was established, and it says so"
+    assert any("15.0" in why and "18.0" in why for _, why in result.not_checked)
+
+
+def test_context_still_warns_about_a_rule_that_does_not_apply(odoo_rules):
+    """The half that survived the demotion, and the half that earns a finding:
+    this one names a rule that was retrieved and genuinely does not hold here."""
+    versioned = [dict(odoo_rules[0], odoo_versions="17.0-18.0")]
+    result = layers.layer_context(versioned, _ctx(odoo_series="15.0",
+                                                  manifest="__manifest__.py"))
     assert result.verdict == layers.WARN
-    assert any("15.0" in f.message for f in result.findings)
+    assert any(f.rule == odoo_rules[0]["id"] for f in result.findings)
+
+
+def test_strict_off_is_a_gap_too():
+    """Same shape as the series mismatch: true of the project, not of the
+    answer, and true on every run until somebody finishes the migration."""
+    result = layers.layer_context([], _ctx(stack="typescript", ts_strict=False))
+    assert result.findings == []
+    assert result.verdict == layers.UNKNOWN
+    assert any("strict off" in why for _, why in result.not_checked)
+
+
+def test_strict_on_is_something_this_layer_checked():
+    result = layers.layer_context([], _ctx(stack="typescript", ts_strict=True))
+    assert result.verdict == layers.PASS
+    assert "tsconfig strict" in result.checked
 
 
 # ------------------------------------------------------------ semantic gating