Repair UTF8 byte-boundary panic in native complexity analysis #1

SESSION_EXECUTION_AUTHORIZATION from Heyasa dependency audit PLF-19975 (paxlet-com workspace), 2026-11-05. Installed code2llm-rust0.1.0 panics at src/complexity.rs137: body[i..] uses a byte offset advanced one byte through UTF8. Reproduced by calculate_complexity on C-family body with en dash, and real www-heyasa-com/app/Services/BenefitCalculator.php. code2llm worker then cannot pickle pyo3_runtime.PanicException and drops the file while returning success, producing incomplete report. Fix byte-prefix scanning or advance by Unicode boundaries, preserve ASCII/Unicode keyword boundaries, add regression controls and validate installed wheel. Source checkout main7a3a7ffc is dirty with an incomplete untracked governance adoption; mandated project/new-ticket.sh and gate are missing. Do not edit source until native allocation/adoption and canonical scope are available. Local mitigation: remove defective optional acceleration from root analysis environment and retain Python fallback. Evidence /home/tom/github/paxlet-com/.planfile/evidence/heyasa-dependency-audit-20261105/code2llm-trace.log

Ticket impact radar (advisory)

• Complexity: M
• Score: 60/100
• Estimated effort: 56 min
• Split recommended: yes

This estimate does not grant execution, review or merge authority.

Strategy Metadata:

• repository: semcod/code2llm-rust
• planfile_id: semcod/code2llm-rust:95b1235e5262be83:PLF-001

SESSION_EXECUTION_AUTHORIZATION: root Heyasa dependency audit PLF-19975, source-selection coordination rootPLF-131. Correction after canonical-source qualification: do not implement a second UTF8 fix. Existing main7a3a7ffc60c636d0875b3318da4e81777faac9fb already adds is_char_boundary checks to C-family, Go and Rust branch counters and includes test_multibyte_utf8_complexity. The previously installed0.1.0binary lacked that existing source fix; an equal package version did not prove equal contents. Earlier attribution to missing source code was too broad.

Observed original failure remains valid: old root0.1.0panicked on en dash/emoji, and the multiprocessing analysis omitted BenefitCalculator.php. Canonical source qualification now passes all19Rust unit tests with locked dependencies. Built a new immutable Git-archive wheel for7a3a7ffc, Cargo.lock unchanged, SHA2562dae47be8158c9e490d8ca84469ea46375fb44a435b3511c8e2709c97d657873. Private and installed wheel tests pass3UTF8 modes and41/41parallel PHP modules including the original BenefitCalculator. No source edit, native allocation or claimed trusted review/new source merge.

Retained activation is still deferred: full root pipeline with this wheel exits0, but identical root analysis inputs select1388README modules versus1589with Python, with201removed/0added. Read-only Git classification:21removed paths are tracked,180untracked,183ignored by current Git rules;18tracked hidden config paths have no matching Git ignore rule. Several differences are runtime/generated copies, so the delta is not proof that every removed file is required application code. Native hidden/nested/global ignore semantics must be made explicit and qualified against the selected source-role contract before retaining activation. The trial package was uninstalled only from root venv; verified Python fallback restored. Preserve the wheel and evidence; no cache-policy or Git-ignore edits were made to force equivalence.

Acceptance remaining for this existing ticket: qualify native discovery/hidden/ignore semantics with same explicit source policy and declare selected/excluded roles; prove complete expected file identity coverage and fresh installed-wheel provenance before any retained activation/release. Existing UTF8 implementation and19unit regressions are satisfied; reuse them. No registry publication, service deployment or source implementation is claimed. Source future writes still need its incomplete adoption resolved and the declared native allocation/ownership route; unknown untracked adoption is preserved.

Evidence under rootPLF19975 continuation-readme-20261105: rust-all-tests.log, rust-build-provenance.json, native-canary-final.log, native-installed-check.log, native-real-scope-verification.json, native-scope-delta-classification.json, native-rollback.log, project-run-final.log. Full standalone wheel retained for independent source-owner review.