docs(vuln-id): remove stale dual-write/flag comments (entity-only)

The compat fields and reconcile/copy paths still described the removed
read-flag + dual-write architecture. Reword to the entity-only reality:
VulnerabilityIdsField reads the entity references; copy()/reimport read
through the entity helper and write through the entity seam; the
unique_finding_order comment says "write path" not "dual-write".

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Maffooch

dojo/finding/api/serializer.py

@@ -309,10 +309,10 @@ class VulnerabilityIdsField(serializers.Field):
     """
     Wire-frozen v2 vulnerability_ids field.
 
-    Reads ``[{"vulnerability_id": str}]`` from the flag-appropriate store (legacy rows or the
-    entity references) — byte-identical either way because writes are dual. Accepts the same
-    object list (tolerating bare strings) on write and hands the parsed strings to create/update
-    under ``parsed_vulnerability_ids``, which funnel to save_vulnerability_ids (unchanged path).
+    Reads ``[{"vulnerability_id": str}]`` from the finding's entity references (ordered,
+    primary/cve first). Accepts the same object list (tolerating bare strings) on write and hands
+    the parsed strings to create/update under ``parsed_vulnerability_ids``, which funnel to
+    save_vulnerability_ids (unchanged path).
     """
 
     def __init__(self, **kwargs):
@@ -325,7 +325,7 @@ def get_attribute(self, instance):
         return instance
 
     def to_representation(self, finding):
-        from dojo.vulnerability.queries import finding_vulnerability_id_strings  # noqa: PLC0415 -- flag seam
+        from dojo.vulnerability.queries import finding_vulnerability_id_strings  # noqa: PLC0415 -- avoid import cycle
         return [{"vulnerability_id": value} for value in finding_vulnerability_id_strings(finding)]
 
     def to_internal_value(self, data):

dojo/finding/models.py

@@ -705,10 +705,9 @@ def copy(self, test=None):
         # Assign any tags
         copy.tags.set(old_tags)
         # Copy the vulnerability ids and CWEs (relation rows aren't copied by copy_model_util).
-        # Route vulnerability ids through the dual-write seam so the copy gets legacy rows AND
-        # entity references (copy.cve was already carried over by copy_model_util). Read the SOURCE
-        # ids through the flag seam too (not the legacy relation directly), so copy() keeps working
-        # after the legacy Vulnerability_Id store is retired.
+        # Write the copy's ids through the entity write seam (copy.cve was already carried over by
+        # copy_model_util), and read the SOURCE ids through the entity read helper (not a legacy
+        # relation).
         from dojo.vulnerability.manager import persist_for_finding  # noqa: PLC0415 -- avoid import cycle
         from dojo.vulnerability.queries import finding_vulnerability_id_strings  # noqa: PLC0415
 

dojo/importers/default_reimporter.py

@@ -988,10 +988,9 @@ def reconcile_vulnerability_ids(
         # while vulnerability_ids do not, and vice versa).
         self.reconcile_cwes(finding)
 
-        # Read the existing ids through the flag seam (entity references when the flag is on, legacy
-        # rows when off) instead of the legacy relation directly, so reconcile keeps working after
-        # the legacy Vulnerability_Id store is retired. The prefetch is seam-matched upstream (the
-        # reimport finding query uses vulnerability_id_prefetch()), so this stays a no-query read.
+        # Read the existing ids through the entity read helper (not a legacy relation). The prefetch
+        # is matched upstream (the reimport finding query uses vulnerability_id_prefetch()), so this
+        # stays a no-query read.
         from dojo.vulnerability.queries import finding_vulnerability_id_strings  # noqa: PLC0415 -- avoid import cycle
 
         existing_vuln_ids = set(finding_vulnerability_id_strings(finding))
@@ -1005,7 +1004,7 @@ def reconcile_vulnerability_ids(
             )
             return finding
 
-        # Accumulate delete + insert for batch flush (legacy rows + entity refs, dual-write).
+        # Accumulate delete + insert for batch flush (entity references).
         self.vulnerability_id_manager.record_reconcile(finding, vulnerability_ids_to_process)
         if vulnerability_ids_to_process:
             finding.cve = vulnerability_ids_to_process[0]

dojo/vulnerability/models.py

@@ -77,7 +77,7 @@ class Meta:
             models.UniqueConstraint(fields=["finding", "vulnerability"], name="unique_finding_vulnerability"),
             # Structural guarantee of a single primary id per finding: no two references may share
             # an order (in particular, never two order-0 rows). Compatible with the delete-then-
-            # insert dual-write, which assigns 0..n-1 in one transaction (see manager.py).
+            # insert write path, which assigns 0..n-1 in one transaction (see manager.py).
             models.UniqueConstraint(fields=["finding", "order"], name="unique_finding_order"),
         ]
         indexes = [models.Index(fields=["finding", "order"]), models.Index(fields=["vulnerability"])]