polish: end-of-session bundle — ~35 real-bug fixes across detectors, evidence, MCP

Major fix categories (60+ polish agents, accumulate-then-squash; H3+L3 verified GREEN):

Pattern-1 family seals
- F2: mcp_server.py _parse_subprocess_result Variant-B try-parse passthrough
- T2: cmd_attest empty-resolution structured envelope
- D3: cmd_delete_check silent-SAFE on missing-git CI gate
- C3: runs/ledger _write_meta atomicized
- Q2: cga signed=True without artifacts + emit_vsa whitespace ROAM_RUN_ID
- E3: cmd_describe test_cmd silent-clobber (v7.0-era)
- X2: cmd_pr_bundle validate --read_only producer asymmetry
- YY: cmd_relate edge-kind plural-calls filter dropped
- V2: cmd_capabilities registry showing 10/233 + cmd_next 24h cutoff

Atomic-write hardening (J3 + G3 batches)
- cmd_capsule, cmd_audit_trail_export, cmd_article_12_check, constitution/loader,
  modes/policy, laws/serializer — all torn-write paths routed through atomic_io

Pattern-3 / metric-definition consistency
- W937 cp1253-mojibake em-dash sweep (28 sites across 5 files) + drift-guard test
- Cross-cutting risk-item _stringify fallback key order (output/formatter.py)

Plus: AGENTS.md substrate count drift sealed (10→11 packages, W800);
restored server.json + glama.json (J3 unintended deletes); new tests/_helpers/cli_ast.py
extracted from 24+ duplicate AST-parse sites; W662 bare-except drift-guard wiring.

Async-JIT polish-loop pattern adopted mid-session — saved [[loop-async-jit-replenishment]]
memory to lock in run_in_background:true requirement on Agent dispatch.

Author: Cranot

AGENTS.md

@@ -54,15 +54,15 @@ These are language-model behavioral laws (validated on Haiku/Sonnet/Opus 4.5/4.6
 
 4. **[LAW] "Code" nouns activate analytical mode on any input.** (D15) — In roam: `agent_contract.facts` strings should anchor on concrete nouns ("`useThemeClasses` has 528 callers") not abstract ones ("this symbol has many callers"). Concrete nouns activate analytical processing; abstract nouns activate summary mode.
 
-   **Concrete-noun anchor vocabulary**: the LAW 4 lint at `tests/test_law4_lint.py` accepts a fact string as concrete-noun-anchored if its terminal token (last word, punctuation stripped) is in a known anchor set. Authoritative sources: `src/roam/output/formatter.py:concrete_plural_terminals` (91 entries, drives the humanizer's "skip findings suffix" rule) and `tests/test_law4_lint.py:_CONCRETE_NOUN_ANCHORS` (108 entries = 91 shared with the formatter + 17 SBOM/registry additions; mirrors the formatter set per the `# Keep these two lists in sync.` comment, and the count drift is pinned by `tests/test_law4_anchor_counts.py`). Representative entries — consult the source files for the full list:
+   **Concrete-noun anchor vocabulary**: the LAW 4 lint at `tests/test_law4_lint.py` accepts a fact string as concrete-noun-anchored if its terminal token (last word, punctuation stripped) is in a known anchor set. Authoritative sources: `src/roam/output/formatter.py:concrete_plural_terminals` (98 entries, drives the humanizer's "skip findings suffix" rule) and `tests/test_law4_lint.py:_CONCRETE_NOUN_ANCHORS` (115 entries = 98 shared with the formatter + 17 SBOM/registry additions; mirrors the formatter set per the `# Keep these two lists in sync.` comment, and the count drift is pinned by `tests/test_law4_anchor_counts.py`). Representative entries — consult the source files for the full list:
 
    - **Code structure**: `files`, `symbols`, `edges`, `nodes`, `cycles`, `clusters`, `layers`, `modules`, `commands`, `tools`, `capabilities`, `imports`, `endpoints`, `dependencies`, `packages`, `routes`
    - **Findings**: `findings`, `hotspots`, `smells`, `violations`, `warnings`, `errors`, `alerts`, `issues`, `gaps`, `leaks`, `secrets`, `vulnerabilities`
    - **Quality metrics**: `keys`, `values`, `chars`, `lines`, `tokens`, `bytes`, `items`, `entries`, `records`, `fields`
    - **Past participles / state qualifiers**: `passed`, `failed`, `scanned`, `checked`, `affected`, `scored`, `confirmed`, `analyzed`, `skipped`, `reached`
    - **Time units**: `days`, `weeks`, `months`, `years`, `hours`, `minutes`, `seconds`, `milliseconds`
 
-   When writing a new fact, ensure the terminal token is in the anchor set. If not, either rephrase to anchor on a different terminal OR add the new noun to BOTH `src/roam/output/formatter.py:concrete_plural_terminals` AND `tests/test_law4_lint.py:_CONCRETE_NOUN_ANCHORS`. The test set is a deliberate superset of the formatter set (formatter has 91 entries; the test mirrors all of them and adds 17 SBOM/registry-domain terminals — `capabilities`, `commands`, `tools`, `packages`, `phantom`, `reachable`, etc.). The mirror is hand-maintained rather than imported so the lint stays decoupled from `roam.output.formatter` — see the `# Keep these two lists in sync.` comment in the test file.
+   When writing a new fact, ensure the terminal token is in the anchor set. If not, either rephrase to anchor on a different terminal OR add the new noun to BOTH `src/roam/output/formatter.py:concrete_plural_terminals` AND `tests/test_law4_lint.py:_CONCRETE_NOUN_ANCHORS`. The test set is a deliberate superset of the formatter set (formatter has 98 entries; the test mirrors all of them and adds 17 SBOM/registry-domain terminals — `capabilities`, `commands`, `tools`, `packages`, `phantom`, `reachable`, etc.). The mirror is hand-maintained rather than imported so the lint stays decoupled from `roam.output.formatter` — see the `# Keep these two lists in sync.` comment in the test file.
 
    Example:
    - WRONG: `"7 of 10 capabilities are AI-safe"` (ends on `AI-safe`, not anchored)
@@ -139,8 +139,8 @@ roam health
 
 ```
 src/roam/
-  cli.py              # Click CLI entry point — LazyGroup, _COMMANDS dict, _CATEGORIES. 217 commands surfaced.
-  mcp_server.py       # FastMCP server (58 tools in core preset; up to 149 in `full`) + `roam mcp` CLI command
+  cli.py              # Click CLI entry point — LazyGroup, _COMMANDS dict, _CATEGORIES. 241 command names (234 canonical + 7 aliases).
+  mcp_server.py       # FastMCP server (57 tools in core preset; up to 224 in `full`) + `roam mcp` CLI command
   mcp_extras/         # MCP-native enhancements: sampling, watcher, session, progress, completions
     sampling.py       # Sampling-driven result compression (summarize=True) via Context.sample
     watcher.py        # watchdog observer + notifications/resources/updated (opt-in via ROAM_MCP_WATCH)
@@ -218,12 +218,12 @@ src/roam/
     gate_presets.py    # Framework-specific gate rules + .roam-gates.yml loader
     graph_helpers.py   # Shared graph utilities (adjacency builders, BFS helpers)
     context_helpers.py # Data-gathering helpers extracted from cmd_context.py
-    cmd_*.py           # One module per CLI command (201 modules, 211 commands)
+    cmd_*.py           # One module per CLI command family (232 modules backing 241 command names)
   output/
     formatter.py       # Token-efficient text formatting, abbrev_kind(), loc(), format_table(), to_json(), json_envelope()
     sarif.py           # SARIF 2.1.0 output (--sarif flag on health/debt/complexity)
     schema_registry.py # JSON envelope schema versioning + validation
-tests/                 # 267 test files
+tests/                 # 740 test_*.py files
   # Core & legacy
   test_basic.py, test_comprehensive.py, test_fixes.py, test_performance.py,
   test_resolve.py, test_salesforce.py, test_v6_features.py,
@@ -305,12 +305,13 @@ ledger, and (c) compose proof bundles a human reviewer can trust. Everything
 below is repo-local (stored under `.roam/`), zero-network, and additive to the
 analysis core.
 
-### The 10 substrate packages
+### The 11 substrate packages
 
 ```
 src/roam/atomic_io.py     - atomic_write_text/bytes/json (os.replace; POSIX+Windows safe)
 src/roam/agents_md/       - AGENTS.md generator (compositional; consumes the rest)
 src/roam/constitution/    - capstone .roam/constitution.yml unifying laws+rules+memory+gates
+src/roam/db/findings.py   - cross-detector finding registry (roam findings list/show/count); USER_VERSION 17 schema
 src/roam/laws/            - invariant mining (roam laws mine/check) - self-installing
 src/roam/leases/          - multi-agent coordination (roam lease claim/release/list)
 src/roam/memory/          - repo-local agent memory (.roam/memory.jsonl)
@@ -518,5 +519,5 @@ Index-aware text search (added on top of grep / refs):
 - `roam delete-check [--source working|staged|pr|head] [--ci]` — gates the diff on surviving references; exits 5 on BREAK-RISK with `--ci`.
 - `roam history-grep <pattern> [--polarity]` — git pickaxe (-S/-G) with author/date and introduced/removed annotation.
 
-Run `roam --help` for the 5-verb core; `roam --help-all` for all 217 commands; `roam surface --json` for the machine-readable inventory. Use `roam --json <cmd>` for structured output.
+Run `roam --help` for the 5-verb core; `roam --help-all` for all 241 command names; `roam surface --json` for the machine-readable inventory. Use `roam --json <cmd>` for structured output.
 Use `roam --sarif health` for CI integration (SARIF 2.1.0).

CONTRIBUTING.md

@@ -96,7 +96,7 @@ Add the following to your project's `.pre-commit-config.yaml`:
 ```yaml
 repos:
   - repo: https://github.com/Cranot/roam-code
-    rev: v13.1            # pin to a release tag
+    rev: v13.2            # pin to a release tag
     hooks:
       - id: roam-secrets        # secret scanning -- no index required
       - id: roam-syntax-check   # tree-sitter syntax validation -- no index required
@@ -297,7 +297,7 @@ wrangler pages deploy templates/distribution/landing-page \
 ```
 
 PyPI publishes from a tag (`.github/workflows/publish.yml`). After a
-version-bump commit lands on main: `git tag v12.50 && git push origin v12.50`.
+version-bump commit lands on main: `git tag v13.2 && git push origin v13.2`.
 
 ## PR Guidelines
 
@@ -329,7 +329,7 @@ roam-code is organized into these key areas:
 | `src/roam/bridges/` | Cross-language symbol resolution |
 | `src/roam/output/` | Formatting, JSON envelopes, SARIF output |
 | `src/roam/mcp_server.py` | MCP server with 224 tools (57 in the default `core` preset) |
-| `tests/` | Test suite (408 test files) |
+| `tests/` | Test suite (740 test files) |
 
 For full architectural details, see the [Architecture Guide](https://roam-code.com/docs/architecture).
 

README.md

@@ -751,7 +751,7 @@ The sentinel pair `<!-- roam:minimap -->` / `<!-- /roam:minimap -->` is replaced
 |--------|-------------|
 | `roam --json <command>` | Structured JSON output with consistent envelope |
 | `roam --compact <command>` | Token-efficient output: TSV tables, minimal JSON envelope |
-| `roam --sarif <command>` | SARIF 2.1.0 output for dead, health, complexity, rules, secrets, algo, py-types, py-modern (GitHub/CI integration) |
+| `roam --sarif <command>` | SARIF 2.1.0 output for 37 commands incl. health, complexity, dead, smells, clones, vulns, taint, secrets, n1, dark-matter, supply-chain, critique, stale-refs (run `roam --help` for the live list — GitHub Code Scanning integration) |
 | `roam health --gate` | CI quality gate. Reads `.roam-gates.yml` thresholds. Exit code 5 on failure |
 
 </details>