ledger(control_flow_ratio): narrow the vocabulary-tally entry after gitgalaxy#2789

[squid-protocol]

Corpus side of gitgalaxy#2770, step 2 of docs/GATING.md § "Cross-repo flow". The engine half is gitgalaxy#2789, merged to main at 08a08c6a with the rosetta:rebless-owed label.

No manifests move

dependency_density is a bias-report metric derived from the import_count and coding_loc recorder columns — not a SIGNAL_SCHEMA key, so no expected_signals.json cell changes and no verify_language gate moves. gitgalaxy#2789's own rosetta-audit confirmed this before it merged:

46 language(s) checked -- 0 regression(s), 2 pre-existing, 0 broken.

(The two pre-existing were objective-c and typescript, already re-blessed here by #66.)

bias-history.yml regenerated the report against engine 08a08c6 in 8ba80c2, so the numbers are already on main. This PR is the ledger work that automation cannot do.

Ledger

control-flow-ratio-denominator-is-a-vocabulary-tally — narrowed. The entry's reading of the spread stands and its cells stay explained; two of its other claims did not survive being checked against the engine source:

1. "No engine change is wanted" was scoped to control_flow_ratio itself and silently covered its derived consumer. dependency_density divided by max(int(coding_loc * control_flow_ratio), 1) — a gated metric reading this ungoverned denominator. gitgalaxy#2789 removed that dependency; the column is now import_count / max(coding_loc, EVIDENCE_MASS_FLOOR), the gitgalaxy#2655 doctrine every other per-file density already used.

2. The "gitgalaxy compares control_flow_ratio between files WITHIN one repository, where the vocabulary is held constant" defense has two holes the entry had never tested:

   • It is a within-language defect that control_flow_ratio is 0 for any file with no branches at all. Measured over all 46 languages' 184 program shells: 133 (72%) record control_flow_ratio == 0, and in 39 of the 46 languages exactly three of the four do — only main.* carries the planted branches, so a/b/c are branchless by the corpus's own design. Any consumer multiplying by it sees a discontinuity when one if is added: measured at 21× on yaml (denominator 1 → 21) and 6× on python, with the vocabulary held perfectly constant.
   • The within-repository premise only holds for a monolingual repo. security_auditor._build_feature_frame — the very consumer the entry cites — one-hot encodes language but applies no per-language normalisation and no groupby, so in a polyglot repository the vocabularies are not held constant.

still_reproduces stays true: the vocabulary tally is still what control_flow_ratio's own cells measure. gitgalaxy#2770 shapes (a) and (b) remain open, and under shape (b) — branch over coding_loc — the metric becomes plantable and this entry retires rather than narrows.

no-dependency-capture-languages — figures superseded, resolution unaffected. Its resolved m4/yacc profile quotes dependency_density "1.0 on a/b and 0.1667-0.2 on main", measured under the old definition where the denominator collapsed to 1 on a branchless file — so "1.0 on a/b" was the raw import count, not a density. Re-checked at the new values: still the healthy sibling shape, still_reproduces stays false. The old numbers are kept in place rather than rewritten, because they are what was measured at the time.

docs/findings_by_language.md regenerates off the ledger, so #2770 joins the issue list for the languages the narrowed entry covers. That is the whole of its diff.

Gates

• tools/bias_report.py --gate — exit 0. out-of-band cells: 0 unexplained; length leaks: 0 leak / 2 weak -- none.
• tools/na_check.py — exit 0, unreviewed n/a cells: 0, no new unreviewed absences.
• docs/bias_report.md, bias_data.json and bias_variance_chart.svg regenerated to a zero diff against 8ba80c2 — confirming the auto-update was already current and this PR changes no measurement.

The measured effect

dependency_density was the metric gitgalaxy#2770 flagged as inheriting an ungoverned denominator. Across the 46-language corpus it now reads a flat 0.015 (0.02/0.035 where a shell imports more), against a previous range of 0.048–2.000. Its consistency badge goes 83% → 93%, and the old 83% was itself an artifact — the denominator was the constant 1 for most cells, so the column was reporting raw import counts, not a density.

Cross-repo

• gitgalaxy#2789 (engine) — merged first, per step 1. Nothing here was edited beforehand.
• This PR — step 2, against engine main. verify.yml is green by construction: no manifest changed.
• gitgalaxy#2770 stays open for shapes (a) and (b); the design comment on it carries the measurements and the two implementation traps for (b).
• Nothing re-runs after this beyond bias-history.yml's normal push regeneration.

🤖 Generated with Claude Code

https://claude.ai/code/session_016BHBDqfybkLJqnQt9AoyTt