fix(core-engine): the api rule's own declarations are not new orphan surface (#2731)

[squid-protocol]

Closes #2731. Part of #2669.

The double count

galaxyscope.py's Contextual Baseline Fix converts an imported file's orphans into API
exposure. It never asked whether the language's own api rule had already counted those
declarations, so a function that is both declared public and uncalled contributed twice.

keyword-rosetta data/go/a.go — three exported functions, none called in-file, imported by
main.go:

column	before	after
function_count	3	3
raw_arch_api	3	3
raw_state_slop_orphans	3	3
arch_api (what scoring reads)	6	3
risk_api_exposure	5.939	3.022
risk_documentation	79.155	40.613

The fix

detector.py reports api_declared_orphans — how many of the file's orphans the api rule
matched at their own declaration — and the conversion credits only the remainder
(orphans - api_declared_orphans, clamped). The debt wipe stays unconditional: the file is
imported, so an already-public orphan is surface the rule counted already, not dead weight.

The test is by name, not by span. An orphan's name occurs exactly once in the whole file —
that is precisely what the orphan census just proved (token_counts[name] <= 1) — so a name
appearing on a line the api rule matched can only be its own declaration. No false positive is
possible. Span containment (hit_vector["api"] > 0) is both looser and tighter than that:

• looser — C's api rule matches any non-static declaration-shaped line, including
  body-local int counter = 0;, so every long function suppresses itself. Measured: the span
  form suppressed all 73 orphans in c/cpython/ceval.c and all 27 in frameobject.c (both
  files of static helpers); the name form suppresses 6 and 0.
• tighter — the public marker often sits outside the slicer's own span: JS/TS export
  precedes start_idx, php's span starts a line early, a java @Test line pulls start_line
  back off the public one. The span form scored javascript/typescript 0-of-3.

New api_declared_orphans is consumed by the orchestrator only — it is not a signal, does not
reach the recorder schema, and appears in no output artifact (checked against the audit JSON,
LLM digest, SBOM and the file_data schema).

Verification

• Golden masters re-blessed, both modes. Every one of the 1254 full-precision / 1253
  zero-dependency differences is attributed, with nothing left over:

  class	count
  Topological Coordinates X/Y/Z (mass re-solve, corpus-wide)	853
  API Exposure %	87
  Documentation Exposure %	71
  Exposed API / Public Exports	61
  Structural Magnitude	61
  Directory Group Magnitude / total_mass	29 + 40
  avg api_exposure / documentation roll-ups	50
  ecosystem composition/*/impact, health/avg_documentation	11
  forensic top-3 rankings (api_exposure/highest, undocumented_critical_path)	2

  61 files move on the real-world corpus, all downward, zero increases, and no structural
  signal other than api moves at all. A control A/B (same venv, origin/main vs this branch)
  measured total arch_api 35892 → 35127 (−2.13%).

• keyword-rosetta: 21 of 46 languages move — 20 go 6 → 3 (three probe functions, three units
  of public surface), c goes 12 → 9 / 10 → 7, makefile 8 → 7. The other 25 are unchanged
  (their api rule marks export lists or non-function surfaces, which never overlapped the
  orphan set). The corpus re-bless follows as a keyword-rosetta PR against this merged engine,
  per the no-pins flow.

• pytest tests/ — 7568 passed (3 new regression tests: the go double count, the C
  static-vs-exported discrimination, and the orchestrator's credit/clamp arithmetic).

• ruff_audit.py --ci, mypy_audit.py --ci, dead_key_audit.py --ci — all clean against
  baseline. tree_sitter_accuracy_audit.py / tri_comparison_chart.py measure function/class/arg
  extraction and never read api (neither tool contains the string); this change cannot move them.

Follow-up for the corpus side

#2729's gate pins api_orphan_credit (arch_api - raw_arch_api) as its only assertion that the
main → a → b → c import chain resolved. That credit legitimately becomes 0 for every language
whose probes are all declared public. raw_state_slop_orphans 3 alongside state_slop_orphans 0
still proves the conversion ran, so the gate has a replacement available; it needs to be swapped
in the same PR that re-blesses the manifests.

🤖 Generated with Claude Code

[github-actions]

🐦‍⬛ Muninn Security Scan

✅ No security issues found.

🐦‍⬛ Powered by Muninn · Skald Lab

[squid-protocol]

CI: everything green except rosetta-audit, which is the expected corpus-side red and is the fix's own confirmation.

All 21 failing languages report only api_orphan_credit expected 3, got 0 (makefile: 1 file) —
64 mismatches, not one of them any other column, and the language list matches the local sweep
exactly. The credit is arch_api - raw_arch_api, so it going to 0 is the double count
disappearing: the api rule counted these declarations, and the orphan conversion no longer counts
them a second time.

Per the no-pins flow the corpus re-blesses against merged main, so this clears with the
keyword-rosetta PR that regenerates the 21 manifests. That PR also needs to replace what
api_orphan_credit was asserting for #2729 (that the main → a → b → c chain resolved) — the
credit is legitimately 0 now wherever every probe is declared public. raw_state_slop_orphans 3
with state_slop_orphans 0 still proves the conversion ran.

crucible-audit (both modes), tree-sitter-accuracy-audit, tri-comparison-audit,
ast-accuracy-audit, full-suite, ruff/mypy/dead-key and all 12 smoke-test matrix cells
pass.

[squid-protocol]

Labelled rosetta:rebless-owed — the documented mechanism for an intentional corpus-visible change. rosetta-audit now passes, reporting the same 21 languages as warnings rather than failures, so the PR is fully green. The re-bless is still owed on the corpus side exactly as described above.