The scan ledger

The completed validation phase used counted scans of other people’s repositories, and this page retains the counts. One row is one scan: a public repository, a base and candidate commit pair, the observe profile, a release build. Raw values come from the run’s machine report or git diff over the same commit pair; historical density is derived and rejection class is assigned from those recorded artifacts, never remembered.

These scans predate the grouped PR-feedback contract, so their row-level numbers remain historical evidence rather than a product threshold. Advisory rows are findings whose effective disposition was warn; records are excluded. Changed documentation lines are the added plus removed lines git diff --numstat reports for Markdown files between the row’s two commits. The final numeric column is the old advisory-row density per hundred changed lines. It is retained to reproduce the study, not interpreted as reviewer effort or used as a gate; small denominators make it especially noisy.

July 2026

Ten repositories, scanned 2026-07-18 with the v0.5.1 release build under --profile observe, each from its latest release tag to that day’s default-branch head. That build resolved no heading anchors, so every reference counted here is a path or a line range. The same ten trees later supplied the anchor measurement behind What twelve renderers call a heading, which is a separate study and not a row on this page. Two bases bend that convention: ripgrep tags rarely, so its base is the 150th ancestor of its head, and alacritty tags on release branches, so its base is the latest stable tag’s merge point with master.

helix’s one missing reference was a real introduced break: a guide page linked ./themes.md where the page lives one directory up, invisible to mdBook’s own build. A community pull request (helix-editor/helix#16034) was already in flight with the identical one-character fix, which is independent confirmation of the finding rather than a missed contribution. ripgrep and just were spotless on missing references; just’s single advisory row sits on a nine-line change, the small-denominator case that shows why the historical ratio is not a product rule.

The three rows with a named rejection class map the adoption boundary, and none of their missing counts is a resolver bug. mdBook’s 36 all live inside its own link-handling test suite, deliberately broken fixtures under tests/testsuite; its range changed no Markdown at all. starship’s 242 are extensionless clean URLs its site router resolves and the tree does not, concentrated in translation mirrors of the preset pages. ruff’s 102 name targets its docs build generates and the repository never holds, settings.md and rules.md mostly, plus three literal template placeholders. Amiss reads every one of these correctly against the tree; the maintainers would still close the report, and they would be right to, which is what makes the class worth recording. These are the measured adoption boundary that put declared generated targets on the roadmap, and the answer has since shipped from the tracked ignore file, recorded in Reference coverage.

The four later rows were picked deliberately from repositories without a docs-site generator, and they produced no rejection class at all: every nonzero count there is a real break. bat’s twelve are pre-existing and live in four translated READMEs whose relative links carry the wrong prefix, doc/LICENSE-MIT for a root file and a doubled doc/doc/ for siblings, and each renders as a 404 on GitHub today. alacritty’s one is pre-existing in the recorded range: an earlier commit moved the escape-sequence docs into the manpage and docs/features.md still links the deleted escape_support.md. fd and hyperfine were spotless. On this evidence the rejection classes are a docs-site phenomenon; a plain tree yields either zero or the genuinely broken.

The same ten trees, rescanned

Heading anchors resolve since What twelve renderers call a heading, so the ten trees were scanned again on 2026-07-26 with that work’s release build. These are not rows. Each is a whole-tree count at that day’s head against a synthetic empty base, so there is no commit range, no changed-line denominator, and no density figure. They are kept because the class mix that Reference coverage later answered moved.

Missing splits three ways, and the July study’s two rejection classes are two of them.

247 name a target the tree holds under another spelling: X where X.md is present, or an .html output name where the .md source is. All 241 of starship’s are that, eleven preset page names across twenty-two translations, and its presets/README.md links the same file twice in one paragraph, once as ./plain-text.md and once as ./plain-text. mdBook’s six are its own output extension, inside its guide and its fixtures. These resolve now, against the spellings harvested from the routers themselves. Two columns of this table read differently on the current build for that reason and one more: starship reads 103 missing, and mdBook reads none at all, its whole count having been fixtures under tests/, which discovery now skips by name.

146 name a target no spelling reaches, and 102 of those are ruff’s generated pages, 63 of them into docs/settings.md. That is the class a docs build writes and a tree never holds.

123 are heading anchors no rule publishes, which the July build could not see because it resolved none. 122 are real breaks in five repositories: 103 in starship’s translated pages, where the heading was translated and the English fragment stayed, every one of them checked against the rendered page on starship.rs and absent there; 9 in helix from one reference definition whose section moved; 7 in bat from case and translation; 2 in ruff and 1 in fd from changelog entries that moved out of the file. The remaining one is deliberate, inside mdBook’s link-handling fixtures.

Those 516 have since become 238, and the arithmetic closes: 247 resolve as router spellings, 30 left with the fixture trees discovery now skips, and one was the defect below. What remains is 122 heading anchors and 116 targets no spelling reaches, with mdBook joining the three that were already clean.

The rescan also found one false missing, which is a defect and not a class: just’s README titles itself with <h1 align=center><code>just</code></h1>, github.com anchors that, and the rule table did not. It got a pinned harvest and a fix, which is why just reads zero above.

The Sphinx yield, measured

The v0.14 release taught the reStructuredText adapter the two Sphinx roles and the label table behind :ref:. These are that work’s counts, taken 2026-07-31 on two Sphinx-native trees with the main build carrying the two lexer fixes below, engine sha256:5d1df7f8a4756f23aa7a78330ebc030438dc246f89cb06a7bb676062abc81c92. Like the rescan above these are whole-tree counts at that day’s head, base one commit back, so there is no range and no density figure. Django, the tree that motivated the adapter, was still unmeasurable when these counts were taken: its reStructuredText lives in .txt, which the built-in rows refuse. A policy include can now bind the rst adapter to exactly those paths, stated in discovery, and the measured row follows below.

CPython’s Doc tree reads clean: every one of its 3,366 :ref: uses resolves through the label table except a single genuine duplicate declaration. pytest’s five label misses split two ways: package_env, twice in its changelog, is a tox setting no pytest label can satisfy and renders unresolved in its own Sphinx build, a real break found live; the other three are prefixless references an intersphinx inventory satisfies at build time, which no tree-only scanner can tell from drift, the boundary resolution states. The six inventory rows are the colon-prefixed form, declared unsupported rather than missing. The remaining missing counts in each tree’s summary, twenty and forty-two, are ordinary path references outside this study’s question.

The measurement earned its keep the way the just defect above did, twice over. The v0.14 build’s first pass read 131 of pytest’s labels as missing, and triage proved the docs innocent both times: pytest declares 180 labels in the backtick-quoted phrase form the lexer kept quotes on, and CPython’s three “dead” labels were declarations sitting in grid-table cells and a list item. Both false-missing classes got pinned fixes (#203, #205), which is why the table reads as it does.

The Django yield, measured

The binding shipped and Django stopped being the counterexample. These counts were taken 2026-08-10 at that day’s default-branch head, on the main build carrying the three lexer fixes below, engine sha256:3a7263e876ec5ccd55f3b4899f8189af4567b8b21051bec255d93ffba0257a34. The method bends one convention and states it: Django’s tree carries no Amiss policy, so the candidate is a local commit whose only change is .amiss/scanner-policy.json, then holding 674 document includes that bind the rst adapter to every .txt under docs/, and the base is the unmodified upstream head. The whole tree read in 1.1 seconds on an ordinary development machine. The exact commit tree was checked again on 2026-08-22: it still holds 674 regular .txt blobs and 66 differently suffixed blobs under docs. The current policy grammar names the same measured set with one {"path": "docs", "kind": "tree", "suffix": ".txt", "adapter": "rst"} selector without admitting those 66 other files.

Every one of the 22 label misses is a reference an intersphinx inventory satisfies at build time, into Python’s own documentation (old-string-formatting, context-managers, tut-packages and kin) or into Sphinx’s generated genindex and modindex, the same tree-only boundary resolution states and pytest’s row hit first. The ten inventory rows are the colon-prefixed intersphinx form, declared unsupported rather than guessed. No label is declared twice.

The first pass read 43 rows as missing, and triage proved twelve of them innocent in three classes, which became the lexer fixes this section’s build carries: an indirect hyperlink target (.. _MySQL manual: MySQL_, and the embedded <Granian_> form) is an alias to another target, not a path; the :file: role is presentation markup that makes no link, distinct from the csv-table option the extractor exists for; and a figure ending .* is Sphinx’s builder-resolved glob. Each shape now extracts nothing, pinned one line at a time in the adapter’s tests.

What remains after the fixes is nine path references that are genuinely dead in the tree: relative directory links like ../middleware/ and ../settings/ in five pages, docs/topics/i18n/translation.txt holding four, left from the documentation structure Django retired when it moved to Sphinx, plus ../url_dispatch/ in the sitemaps reference. Each names a route the current tree does not hold under the spellings a documentation router serves, which is the same class as helix’s one-character break: real, pre-existing, and invisible to a build that never resolves them.

The same ten trees, a third time

Scanned 2026-08-10 on the main build the Django row used, engine sha256:3a7263e876ec5ccd55f3b4899f8189af4567b8b21051bec255d93ffba0257a34, each tree at that day’s default-branch head against the same synthetic empty base as the second pass, depth-one clones. The wall column is new: one process, one scan, measured around the whole invocation on an ordinary development machine. These are the book’s first recorded timings.

The second pass’s arithmetic predicted 122 real heading anchors, and the current build measures exactly 122, in the same five repositories at the same counts: 103 in starship’s translated pages, 9 in helix, 7 in bat, 2 in ruff, 1 in fd. The absent class fell from 116 to 21. The tracked-ignore answer emptied ruff’s generated-target class whole, alacritty’s one break was fixed upstream between passes, and mdBook stays clean at a newer head. Reference totals move with coverage and with the trees themselves: mdBook’s count drops because discovery now skips its fixture suites, bat’s because its documentation moved.

Every remaining absent row was read at its source line, and none is a resolver defect. helix still carries the one-character ./themes.md break, its community fix (helix-editor/helix#16034) open since July. bat’s twelve are the translated-README 404s of the first study, unchanged. ruff’s eight split three ways: five angle-bracket placeholders in an agent-skill template, one literal teaching example inside a changelog entry, and two broken relative links inside ty’s markdown-based test fixtures under resources/mdtest, a fixture tree the deliberately closed skip list does not name. A maintainer would close all eight, and the rejection classes of the first study still describe them.

The timings say what the architecture promises: a scan is one pass over two snapshots, so every plain tree answers in under two seconds, and Django’s 674 bound documents in the section above answered in 1.1. starship is the outlier its 7,510 references across twenty-two translation mirrors earn, and even that finishes inside fifteen seconds.

Remeasured 2026-08-11 after the anchor lane learned to reuse discovery’s own parse: starship reads 5.7 seconds on the same tree, engine sha256:3423bdfa922c64f9c6ebc7be0fb6242ac1afb5d977b0504f7c0c273f8ac44fd0. The removed cost was a second full parse of every distinct anchor target; what remains is the parse-and-discovery baseline over the mirrors’ 17 MB, a recorded fact with a weekly bench now watching the mirror shape.

Notebook Markdown yield, measured and held

The notebook question was measured on 2026-08-26 before admitting another document format. Ten pinned trees supplied 3,878 exact lowercase .ipynb blobs and 461,907,733 bytes. Every tree with at most 120 notebooks supplied all of them; larger trees supplied 120 paths at evenly spaced indexes after lexicographic sorting, including the first and last. That deterministic sample held 762 blobs and 104,270,321 raw bytes.

Fourteen sampled blobs were empty, all from the Microsoft tree. The other 748 were nbformat 4.0 through 4.5 documents. Their Markdown source values were joined exactly as the notebook format requires and each cell was passed independently through the production Markdown extractor. No code, output, attachment, kernel, or repository program was interpreted. The extractor accepted all 15,245 cells.

Path-like is deliberately the lower-bound lexical class: no URI scheme, no leading fragment, no attachment: scheme, and no network-path // prefix. It does not count a same-repository forge URL which the resolver could answer. Even under that restriction, 306 of 748 valid notebooks held 1,825 candidates for the existing repository resolver. The full extraction held 7,914 occurrences: 5,836 scheme-bearing or network-path destinations, 231 cell-local fragments, and 22 attachments in addition to those 1,825. The format has real coverage yield rather than merely category adjacency.

The cell bodies are small. The file row covers all 3,878 tree entries; the other two rows cover the sample. Each percentile selects the sorted value at zero-based index round((n - 1) * p / 100), with half-way ranks rounded to even.

Only five tree entries exceed the current 4 MiB document ceiling, and none exceeds 16 MiB. Size is not the reason to refuse the format. Materializing the notebook is: code-cell outputs alone occupied 69,870,711 of the sample’s 100,218,023 whitespace-free JSON bytes, 69.7 percent, before counting execution state or notebook metadata. Outputs were present in 342 notebooks, exceeded half the bytes in 204, and exceeded 90 percent in 106. Five more notebooks carried 15,230,286 bytes of Markdown attachments. A future reader must skip those values while decoding rather than build an owned notebook tree or feed them to the Markdown parser.

Location is the unsatisfied gate. Of 15,245 Markdown cells, 15,189 used an array source and 56 one string; 104 of 78,157 array members themselves held more than one source line. A decoded Markdown span can therefore cross JSON strings, quotes, commas, and escapes. It is not one physical notebook byte span. Cell IDs do not rescue the current contract: only 2,429 of 27,601 cells had one, and the sample contained one duplicate. An index plus an optional valid ID and a cell-local span can name the source honestly, but the current report location has only repository path and physical document span.

The provider UIs cannot consume a substitute. GitHub Check annotations require a path and physical start/end lines, while its rich notebook diff still requires switching to the raw source diff to comment on a line (Checks API, notebook diff limitation). GitLab transforms notebook diffs on commit and compare pages, explicitly not on merge request pages, and offers no code suggestions for notebooks (GitLab notebook diffs). A raw-JSON annotation would be clickable but would name the serialization rather than the Markdown source the finding describes.

Notebook parsing is therefore held, not rejected. Shipping waits for a cell-aware report location and at least one provider or design partner that can use it. That change must be reviewed as a wire migration before the parser: cell source stays isolated, output and metadata stay skipped, empty or malformed notebooks fail visibly, and a cell-local finding is never disguised as a contiguous raw-JSON span.

MyST, Quarto, and Org yield, measured and held

The three adjacent markup formats were measured on 2026-08-27 before admitting another parser. Thirteen pinned trees supplied every exact lowercase source suffix outside the nine built-in excluded directory names: .md in four MyST-family trees, .qmd in four Quarto trees, and .org in five Org trees. There was no sampling. The resulting 1,559 documents held 22,015,633 bytes.

For MyST and Quarto, every document was first passed unchanged through the production Markdown extractor. A second, source-positioned pass counted only the documented dialect forms outside ordinary code fences and escaped examples: MyST directives and roles, and exact Quarto shortcodes and cross-references. Triple-brace Quarto examples are escapes, not shortcodes. Org bracket links and keywords were read with lossless orgize 0.10.0-alpha.10 and cross-checked against Pandoc 3.1.11.1. No code cell, Babel block, plugin, shortcode, included file, or repository program was executed. A repository candidate was then resolved under the format’s documented relative-path rule against the pinned Git tree; generated output and renderer context were never guessed into existence.

MyST

These files are already discovered as Markdown, and the production adapter accepted all 642. It extracted 4,284 ordinary references, including 895 path-like repository candidates. That is genuine existing coverage, but not MyST coverage. The dialect pass found another 423 repository candidates in {include}, {literalinclude}, {image} and {figure} directives and {doc} and {download} roles; 419 name an entry under the documented source-relative spelling. It also found 2,074 internal role uses, predominantly 2,069 {ref}, {numref}, and {eq} uses whose label and inventory semantics CommonMark does not have. Twenty-one dialect file targets are external.

The four file targets a plain source-relative lookup did not find are the useful boundary, not four defects. Three are deliberate my-file teaching values in MyST’s own reference guide. LXD’s root CONTRIBUTING.md supplies the fourth: doc/contributing.md includes it, and its {doc} role reaches doc/debugging.md in the including Sphinx document’s context. The MyST include contract makes the include path relative to its source, while roles and extension points still require the parsed document context. A suffix alias cannot reproduce that distinction.

Quarto

All 626 .qmd documents were valid input to the production Markdown adapter, which found 4,829 references and 2,017 path-like repository candidates. Amiss currently sees none of them because .qmd is outside the document set. The Quarto-only pass found 376 exact include shortcode targets, every one present in the pinned tree, and 63 cross-reference uses. Initial YAML metadata held 35 file-bearing fields which expanded to 22 concrete bibliography, resource, or body-include values.

That large safe-looking Markdown subset still does not justify binding .qmd to the Markdown adapter. Quarto’s include contract preprocesses an include even inside a code fence and resolves references in the inserted text from the main document rather than from the included file. The same corpus held 598 executable or diagram cells and 452 other renderer shortcodes, including 18 notebook embeds. Cross-reference declarations can also be produced by executed cells. Those are renderer evidence, not repository syntax the engine may simulate.

Org

The lossless pass found 9,570 double-bracket links: 524 relative file links, 380 internal targets, 8,644 external schemes, one absolute file, and 21 custom or fuzzy shapes. Sixty-one INCLUDE and seventeen SETUPFILE keywords raise the explicit repository-candidate total to 602. Of those, 427 reach an entry by the plain source-relative rule and 175 do not. Pandoc produced 12,628 link or image nodes because its Org reader also recognizes plain external URLs; those add no same-repository coverage and were not substituted for the lossless source counts.

The misses split along renderer boundaries. orgmode.org links generated manual, guide, PDF, and HTML outputs absent from the source tree. System Crafters’ committed live-streams.org is a generated sitemap whose sibling-looking links resolve from the content/live-streams publishing project, not from the file’s physical content parent. The C++ notes repeatedly include an absent theme/style.org, while two encoded file names need Org’s decoding rule. The Org file-link contract, include grammar, and HTML export rewrite are separate semantics; recognizing brackets alone would turn build context into false missing rows.

One Org document, Rosetta_Stone_Translation.org, is 7,154,544 bytes and exceeds the default 4 MiB document ceiling. It carries 2,189 bracket links, three repository candidates, and thirteen source blocks. The other 290 Org documents fit the current byte limit. The size crossing remains a visible per-document refusal and is not a reason to raise the built-in per-document ceiling for a new parser.

Admission decision

The measurement establishes real yield but admits none of the three formats yet. MyST needs a distinct, policy-bindable grammar for roles, directives, labels, and transclusion context; the production dependency graph has no pure-Rust MyST parser pinned to that contract. Quarto needs a dedicated adapter which preserves the measured Markdown subset while representing includes and refusing execution- or plugin-derived targets; calling it Markdown would overstate coverage. Org needs a bounded parser pinned against the GNU Org renderer plus explicit publishing-context evidence; the pure-Rust parser used for measurement is still an alpha, not the production contract.

Unlike notebooks, all three formats can identify their authored constructs with physical byte spans in the source file. None needs a new location shape or wire v2; an admitted adapter would still move the normal additive schema and examples. What is missing is renderer conformance and, for Quarto and Org publishing, trustworthy build context. Shipping waits for that evidence and a provider or design partner that needs the format; executable outputs and plugins remain external evidence in every design.

Editor latency and reverse-impact demand, measured and held

The reverse-impact query had no user population to measure on 2026-08-27. It merged in PR #526 on August 24, after v0.25.0, the latest release, was cut on August 21. Authenticated GitHub code search for the exact amiss refs phrase returned six matches, all in this repository, and the issue register held no LSP request. Aggregate clone traffic cannot distinguish a command invocation. A source build may have used the query, but there is no observable evidence that an author has, much less that its latency blocks an editor workflow.

The performance half was measured independently rather than inferred from that absence. The release-mode binary at b70ec4164269, engine sha256:c8c667d59c8b960472815999ba45b1fbafcdfaa1adf017c0f238d722a696b1d3, ran on Linux 6.12 on an AMD Ryzen 7 PRO 7840U. Each sample was a new process against a warm page cache, with stdin closed and output written to the null device. One unrecorded warm-up preceded each series. Wall time surrounded process creation and wait4; CPU time and peak resident memory came from that same child. The table uses the median and nearest-rank p95.

Three fully hydrated depth-one SHA-1 clones span the existing workload. Each staged index equaled its base. Django’s local base additionally held the same exact {"path":"docs","kind":"tree","suffix":".txt","adapter":"rst"} policy binding as the earlier yield study, so both sides scanned the adopted document set. Every warm-up produced a complete observe report with no analysis error.

Startup is amiss --help. A refs row reopens the corresponding complete report and queries its most frequent repository target. A scan row runs the complete staged evaluation and serialization under --profile observe --format json.

Process startup is not the bottleneck: even the smallest complete scan costs eighteen times its fresh-process floor, while starship costs about nineteen hundred times it. A resident daemon would save roughly 2.5 ms and leave the material work untouched. Report replay stays subsecond here, but its owned JSON tree makes the 35.7 MiB starship report peak above the full scan. That mirror workload clearly exceeds interactive latency and needs a proved selective or incremental evaluation, not merely a process kept alive.

No editor mode ships from this evidence. Reopen the question only after a release containing refs has an external user or design partner who can name the interaction and repository where latency hurts. Start by measuring a stateless explicit invocation there. Any later worktree or buffer overlay remains observe-only convenience output, never provider-gating evidence; hidden incremental state, a long-lived engine, and background network access remain out until their own correctness and resource model is proved.

Provider service packaging demand audited and held

No operator request justified a deployment package on 2026-08-28. Authenticated GitHub issue and pull-request searches for docker, container image, OCI image, Helm, Kubernetes, self-hosted, provider service, systemd, and deployment platform returned no result in this repository. Exact public code searches for each of amiss-controller-github, amiss-controller-gitlab, and amiss-controller-gitea found only this source tree. The one observable live lane repository is the maintainer-owned amiss-lane-github, whose stated purpose is to exercise a real GitHub App against a deliberate test scenario. It proves that a source-built lane has run; it does not establish demand for an image or an operator’s packaging contract.

The latest release at the time of the audit was v0.25.0. Its platform assets contain the scanner and prober, checksums, and provenance, but no provider service. That is consistent with the supported contract rather than a missing release step: the three service crates are unpublished, and their setup pages direct an operator to build the chosen repository commit with --locked. One commit therefore selects the controller, provider adapter, engine wire, constraint producer, and sealed bootstrap together.

The process boundary is already suitable for an operator-selected supervisor. Each service loads one absolute strict-JSON configuration, validates it offline before startup, binds plain HTTP to a private address behind an operator TLS proxy, exposes private health, readiness, and fixed metrics routes, and drains admitted work on termination. Configuration names pre-created, disjoint scratch, ledger, artifact, and, for webhook lanes, inbox roots. Credentials, webhook keys, execution constraints, bootstrap binaries, and optional controls arrive through bounded regular files. These are the inputs an image would have to mount and the state a rollout would have to preserve.

There is consequently no neutral container definition to add. Choosing a base and target architecture would not answer the runtime user and filesystem ownership, secret injection, TLS edge, private-route exposure, persistent-volume backup, or configuration migration rules. A Helm chart or generated configuration would make even more assumptions, while a separately versioned provider package would break the single-commit closure before 1.0.

No OCI image, service-manager unit, configuration generator, or control plane ships from this audit. Reopen packaging when an operator names the deployment platform, image-signing verification flow, upgrade and rollback contract, and isolation model for secrets, routes, and durable roots. The first package must preserve the same-commit service/bootstrap/engine closure and reuse the release’s existing platform provenance where that operator can verify it; it must not publish the controller crates as a second library product.

What a row must be

A row enters this page only from a recorded run: the machine report kept, the commit pair stated, every raw value sourced from and every derived or classified column traceable to those two artifacts, on a repository that is not this one. The validation phase used the ledger to retain the ten-repository adoption and false-missing evidence; focused PR feedback is now a separately tested product invariant.