diff --git a/research/finding_identity/README.md b/research/finding_identity/README.md
index 5b8e0bb..91dac7e 100644
--- a/research/finding_identity/README.md
+++ b/research/finding_identity/README.md
@@ -21,6 +21,7 @@ ports of their source code at a pinned version, checked against the original too
 | `line_text` | the exact text of the flagged line | |
 | `github` | GitHub code scanning's `primaryLocationLineHash`: a rolling hash over the 100 non-blank characters from the start of the line, plus an occurrence count | github/codeql-action `src/fingerprints.ts` |
 | `sonar` | SonarQube's issue tracker, a **multi-pass matcher**: (1) same rule, line, line hash and message; (2) same rule, line and line hash; (3) code moves, by unique 11-line block hashes and then by the longest identical block; (4) same rule, line hash and message; (5) same rule, line and message; (6) same rule and line hash. The line hash is the MD5 of the line without spaces and tabs | SonarQube 26.10.0.133078, `sonar-core` `issue/tracking/Tracker.java`, `AbstractTracker.java`, `BlockRecognizer.java`, `BlockHashSequence.java`, `hash/SourceLineHashesComputer.java` |
+| `sonar_branch` | the `sonar` tracker as a **branch analysis** runs it. A renamed file keeps its findings only if SonarQube's file move detection takes it for the old file: line counts within (0.84×, 1.18×) and a similarity of at least 85, where similarity is 100 × (1 − edit distance / longer length) over the line hashes. `sonar` is the **pull-request** analysis, which takes renames from the SCM | SonarQube 26.10.0.133078, `sonar-ce-task-projectanalysis` `filemove/FileMoveDetectionStep.java`, `SourceSimilarityImpl.java` |
 | `bandit` | `bandit -b baseline.json`: a result is known when an issue with the same text, severity, CWE, confidence, file, test name and test ID is in the baseline. No location at all, and **set membership**: once one such issue is baselined, any number of equal new ones are hidden | Bandit 1.9.4 `bandit/core/manager.py` (`_compare_baseline_results`), `bandit/core/issue.py` (`Issue.__eq__`) |
 | `semgrep` | Semgrep's `match_based_id` (JSON `extra.fingerprint`, SARIF `fingerprints["matchBasedId/v1"]`): BLAKE2b of the rule's patterns with metavariables replaced by the code they bound, the path and the rule ID, plus an ordinal among equal keys in the file. No line, column or matched code beyond the bindings. **Semgrep findings only** | Semgrep 1.180.0 `semgrep/rule_match.py` (`get_match_based_key`, `get_match_based_id`, `RuleMatches.add`), `semgrep/rule.py` (`formula_string`) |
 | `codeguard` | CodeGuard's `codeguard/v1` fingerprint: enclosing function/class plus the normalized statement (literals masked, comments and whitespace removed) | `src/codeguard/engine/fingerprint.py` |
@@ -28,9 +29,10 @@ ports of their source code at a pinned version, checked against the original too
 | `cg_no_mask` | ablation: `codeguard` without masking literals | |
 | `cg_raw` | ablation: `codeguard` without any normalization (scope plus raw line) | |
 
-`sonar` and `bandit` match with an algorithm rather than a key (`trackers.py`, plugged in
-through `trackers.MATCHERS`); their keys hold what that algorithm compares and are used
-only for the collision rate (`sonar`: rule and line hash). Bandit pairs nothing, so to
+`sonar`, `sonar_branch` and `bandit` match with an algorithm rather than a key
+(`trackers.py`, plugged in through `trackers.MATCHERS`); their keys hold what that
+algorithm compares and are used only for the collision rate (`sonar` and `sonar_branch`:
+rule and line hash). Bandit pairs nothing, so to
 score mispairs the `bandit` matcher pairs equal issues in line order and sends surplus
 new issues to the last equal old one.
 
@@ -43,7 +45,11 @@ Where a port fixes what the tool leaves to its environment:
   ranges; a SonarQube language plugin that reports such ranges hashes only those. Only
   the tracking of open issues runs (there are no closed issues to reopen between two
   consecutive versions). The tie-breaking order of `BlockRecognizer`, which iterates
-  `java.util.HashMap` key sets, is reproduced exactly by a port of `HashMap`.
+  `java.util.HashMap` key sets, is reproduced exactly by a port of `HashMap`. For
+  `sonar_branch`, the file move detection scores every removed file against every added
+  file and elects the best pairs; the harness already pairs files by git's rename
+  detection (`git diff -M`, 50% similarity), so only SonarQube's decision for that pair
+  is ported. A move SonarQube would find but git would not is therefore not modelled.
 - **Bandit.** Findings from other analyzers fill Bandit's fields with their closest
   equivalents: CodeGuard's description, severity, confidence, CWE and rule title;
   Semgrep's message, severity and the rule's `confidence` and `cwe` metadata.
@@ -268,8 +274,15 @@ python -m research.finding_identity transform https://github.com/DefectDojo/djan
 
 # A subset of transformations, on a local directory
 python -m research.finding_identity transform path/to/src --transforms rename_local,extract_helper
+
+# A pinned commit of a corpus clone (clones made by `batch` have no working tree)
+python -m research.finding_identity transform research/finding_identity/.repos/zulip \
+    --ref <pinned sha> --label zulip --samples 40
 ```
 
+With a local repository and `--ref`, the Python files of that commit are exported to a
+temporary directory and `summary.json` records the commit as `head`.
+
 `--samples` is the number of files with findings to use; `--seed` fixes the sample and
 the target findings. Results go to `results/transform-<label>/` (git-ignored):
 
@@ -432,6 +445,17 @@ repository). Failures do not stop the batch: each attempt is appended to
 `results/_logs/<label>.log`; the command exits with status 1 if any repository failed.
 `--only a,b` restricts the run, `--delete-clones` removes each clone after its replay.
 
+`--analyzer bandit|semgrep` replays the corpus with that analyzer's findings (see
+[Analyzers](#analyzers)); results go to `results/corpus-<analyzer>/` unless `--out` is
+given. Bandit reads Python only, so its batch leaves out the JavaScript repositories. A
+result directory counts as done only for the analyzer named in its `analyzer.json`, so
+runs of different analyzers never satisfy each other's resume check.
+
+```bash
+python -m research.finding_identity batch research/finding_identity/corpus.csv \
+    --commits 200 --jobs 4 --analyzer bandit
+```
+
 Every replay also records its totals **per rule category** (`by_category` in
 `summary.json`, with the same `totals` and `collisions` blocks as the summary itself).
 Scheme keys include the rule ID and the ground truth pairs findings of the same rule
@@ -479,25 +503,27 @@ Outputs in `--out`:
 
 ### Committed results
 
-`paper/` holds the aggregated outputs of the corpus run of 2026-10-14 (CodeGuard 2.2.0,
-200 commit pairs per repository, all rule categories), produced with:
-
-```bash
-python -m research.finding_identity batch research/finding_identity/corpus.csv --commits 200 --jobs 4
-python -m research.finding_identity stats research/finding_identity/results \
-    --corpus research/finding_identity/corpus.csv --out research/finding_identity/paper --plot
-```
-
-The batch took 14 min 44 s of wall-clock time for the 35 repositories on 4 cores
-(2,781 s summed over repositories, fetching included): 7,000 commit pairs, 34,275 file
-versions scanned, 36,232 findings, 8,703 of them security findings. Clones and per-commit
-results are not committed.
-
-That run predates the `sonar` and `bandit` schemes, so `paper/` has no columns for them.
-It also predates CodeGuard's fix for line separators (lines split on LF, CRLF and CR
-only), which can shift the `codeguard`-family keys slightly. Re-running the batch with
-`--force` (otherwise `batch` skips repositories whose results are already done) scores
-every scheme.
+`paper/` holds the outputs the paper is written from, produced on 2026-10-17 from the
+corpus pinned on 2026-10-14 (CodeGuard 2.2.0, Bandit 1.9.4, 200 commit pairs per
+repository, all rule categories):
+
+- `outline.md`: the plan of the paper; its *Regenerating* section has the exact commands
+  that produce every file below;
+- `claims.md`: every number the paper can cite, with its interval and source;
+- `table_rq1.tex`, `numbers.md`, `rq1.csv`: RQ1 from `paper_kit.py`, including the
+  false-new rate split by renamed files and Bandit's findings with and without B101;
+- `fig_rq2.pdf`, `rq2.csv`: RQ2, the invariance matrix pooled over the 25 Python
+  repositories (40 sampled files each);
+- `tables.md`, `pooled.csv`, `per_repo.csv`, `per_repo.md`, `repos.csv`,
+  `false_new_by_repo.png`: the `stats` tables for the CodeGuard replays;
+- `ground_truth_check/`: a seeded sample of 100 ground-truth decisions to check by hand.
+
+The CodeGuard batch took 18 min 20 s of wall-clock time for the 35 repositories on 4
+cores, the Bandit batch 6 min 55 s for the 25 Python repositories, and the
+transformation runs 7 min 41 s. Clones and per-commit results are not committed. The
+replay results of the `line`, `line_text`, `github` and `codeguard` families are
+identical to those of the first corpus run (2026-10-14), which had no SonarQube or
+Bandit schemes.
 
 ## Known limitations
 
diff --git a/research/finding_identity/batch.py b/research/finding_identity/batch.py
index 60c4cfc..00dfd7f 100644
--- a/research/finding_identity/batch.py
+++ b/research/finding_identity/batch.py
@@ -38,14 +38,33 @@ class BatchOptions:
     details: bool = False
     timeout: float | None = None
     delete_clones: bool = False
+    #: What produces the findings: ``codeguard``, ``bandit`` or ``semgrep``.
+    analyzer: str = "codeguard"
 
 
 def summary_path(opts: BatchOptions, label: str) -> Path:
     return opts.out / label / "summary.json"
 
 
+def recorded_analyzer(result_dir: Path) -> str | None:
+    """The analyzer named in *result_dir*'s ``analyzer.json``; ``codeguard`` if it has none.
+
+    Replays from before ``analyzer.json`` existed all used CodeGuard. ``None`` if the file
+    cannot be read.
+    """
+    path = result_dir / "analyzer.json"
+    if not path.exists():
+        return "codeguard"
+    try:
+        name = json.loads(path.read_text(encoding="utf-8")).get("analyzer")
+    except (OSError, ValueError, AttributeError):
+        return None
+    return name if isinstance(name, str) else None
+
+
 def is_done(entry: CorpusEntry, opts: BatchOptions) -> bool:
-    """True if a finished replay of *entry* at its pinned SHA covers ``opts.commits``."""
+    """True if a finished replay of *entry* at its pinned SHA, by ``opts.analyzer``,
+    covers ``opts.commits``."""
     path = summary_path(opts, entry.label)
     if not path.exists():
         return False
@@ -53,7 +72,11 @@ def is_done(entry: CorpusEntry, opts: BatchOptions) -> bool:
         summary = json.loads(path.read_text(encoding="utf-8"))
     except (OSError, ValueError):
         return False
-    return bool(summary.get("head") == entry.sha and summary.get("commit_pairs", 0) >= opts.commits)
+    return bool(
+        summary.get("head") == entry.sha
+        and summary.get("commit_pairs", 0) >= opts.commits
+        and recorded_analyzer(path.parent) == opts.analyzer
+    )
 
 
 def prepare(entry: CorpusEntry, opts: BatchOptions) -> Path:
@@ -88,6 +111,8 @@ def run_one(entry: CorpusEntry, opts: BatchOptions) -> None:
     ]
     if opts.details:
         cmd.append("--details")
+    if opts.analyzer != "codeguard":
+        cmd += ["--analyzer", opts.analyzer]
     with log_path.open("w", encoding="utf-8") as log:
         log.write(" ".join(cmd) + "\n")
         log.flush()
diff --git a/research/finding_identity/commands.py b/research/finding_identity/commands.py
index 73c437e..b2d1b88 100644
--- a/research/finding_identity/commands.py
+++ b/research/finding_identity/commands.py
@@ -11,10 +11,18 @@
 
 from .batch import BatchOptions, run_batch
 from .corpus import CorpusEntry, load_corpus, measure, pin, save_corpus
+from .schemes import ANALYZERS
 from .stats import ALL, run_stats
 
 HERE = Path(__file__).parent
 
+#: Corpus languages each analyzer can scan; the others are left out of its batch.
+ANALYZER_LANGUAGES = {
+    "codeguard": {"python", "javascript"},
+    "bandit": {"python"},
+    "semgrep": {"python", "javascript"},
+}
+
 Handler = Callable[[argparse.Namespace], None]
 
 
@@ -24,7 +32,17 @@ def register(sub: Any) -> dict[str, Handler]:
     bp.add_argument("corpus", type=Path, help="corpus CSV (see corpus.csv)")
     bp.add_argument("--commits", type=int, default=200, help="commit pairs per repository")
     bp.add_argument("--jobs", type=int, default=4, help="repositories replayed in parallel")
-    bp.add_argument("--out", type=Path, default=HERE / "results", help="results directory")
+    bp.add_argument(
+        "--out",
+        type=Path,
+        help="results directory (default: results/, or results/corpus-<analyzer>/)",
+    )
+    bp.add_argument(
+        "--analyzer",
+        choices=ANALYZERS,
+        default="codeguard",
+        help="what produces the findings; bandit replays only the Python repositories",
+    )
     bp.add_argument("--workdir", type=Path, default=HERE / ".repos", help="where to clone")
     bp.add_argument("--only", help="comma-separated labels to run (default: all)")
     bp.add_argument(
@@ -74,17 +92,30 @@ def _select(entries: list[CorpusEntry], only: str | None) -> list[CorpusEntry]:
 
 def _batch(args: argparse.Namespace) -> None:
     entries = _select(load_corpus(args.corpus), args.only)
+    languages = ANALYZER_LANGUAGES[args.analyzer]
+    skipped = [e.label for e in entries if e.language not in languages]
+    if skipped:
+        print(f"{args.analyzer} skips {', '.join(skipped)} (language)", file=sys.stderr)
+        entries = [e for e in entries if e.language in languages]
+    out = args.out
+    if out is None:
+        out = (
+            HERE / "results"
+            if args.analyzer == "codeguard"
+            else HERE / "results" / f"corpus-{args.analyzer}"
+        )
     unpinned = [e.label for e in entries if not e.sha]
     if unpinned:
         raise SystemExit(f"not pinned (run `corpus pin` first): {', '.join(unpinned)}")
     opts = BatchOptions(
         commits=args.commits,
-        out=args.out,
+        out=out,
         workdir=args.workdir,
         categories=args.categories,
         details=args.details,
         timeout=args.timeout,
         delete_clones=args.delete_clones,
+        analyzer=args.analyzer,
     )
     statuses = run_batch(entries, opts, jobs=args.jobs, force=args.force)
     if any(s["status"] == "failed" for s in statuses):
diff --git a/research/finding_identity/drift.py b/research/finding_identity/drift.py
index 9d9f77c..b10dbf8 100644
--- a/research/finding_identity/drift.py
+++ b/research/finding_identity/drift.py
@@ -247,7 +247,8 @@ def _compare_span(
         by_unit[u][0].append(i)
     for j, u in enumerate(new_unit):
         by_unit[u][1].append(j)
-    for _, (olds, news) in sorted(by_unit.items()):
+    for u, (olds, news) in sorted(by_unit.items()):
+        p, q = units[u]
         local = {i: k for k, i in enumerate(olds)}
         unit_gt = {
             k: (local[gt_pairs[j][0]], gt_pairs[j][1]) for k, j in enumerate(news) if j in gt_pairs
@@ -258,6 +259,7 @@ def _compare_span(
             unit_gt,
             schemes,
             keep_records=records is not None,
+            renamed=p is not None and q is not None and p != q,
         )
         for key, count in result.gt.items():
             totals["gt"][key] += count
diff --git a/research/finding_identity/gt_sample.py b/research/finding_identity/gt_sample.py
new file mode 100644
index 0000000..ea2b22b
--- /dev/null
+++ b/research/finding_identity/gt_sample.py
@@ -0,0 +1,237 @@
+# SPDX-License-Identifier: Apache-2.0
+
+"""A stratified sample of ground-truth decisions, for a manual check.
+
+``python -m research.finding_identity.gt_sample <results> --corpus corpus.csv --out <dir>``
+draws findings from the replays' ``findings.jsonl`` (``--details``) in five strata, where
+the ground truth is most and least likely to be wrong:
+
+- ``edited``: persisting findings whose line was edited (every scheme struggles here);
+- ``known_but_new``: persisting findings on an unchanged line, in a file that kept its
+  path, that SonarQube or CodeGuard report as new (is the truth's pairing right?);
+- ``new_but_matched``: introduced findings that a content scheme matched to an old one
+  (is the finding really new?);
+- ``agree_known`` and ``agree_new``: every content scheme agrees with the truth (control).
+
+It writes ``sample.md``, one entry per finding with the code before and after the commit
+and a link to the commit, and ``sample.csv`` with an empty ``verdict`` column to fill in:
+``same`` (the old and new finding are the same issue), ``different``, or ``unclear``.
+The sample is seeded, so rerunning it gives the same findings.
+"""
+
+from __future__ import annotations
+
+import argparse
+import csv
+import json
+import random
+import subprocess
+from collections.abc import Callable
+from pathlib import Path
+from typing import Any
+
+from .corpus import load_corpus
+
+HERE = Path(__file__).parent
+
+#: Schemes whose agreement defines the strata.
+CONTENT_SCHEMES = ("line_text", "github", "codeguard", "sonar")
+
+Record = dict[str, Any]
+
+
+def _known(r: Record) -> bool:
+    return bool(r["truth"] == "known")
+
+
+STRATA: dict[str, Callable[[Record], bool]] = {
+    "edited": lambda r: _known(r) and r.get("truth_kind") == "edited",
+    "known_but_new": lambda r: (
+        _known(r)
+        and r.get("truth_kind") == "equal"
+        and not str(r.get("status", "")).startswith("R")
+        and any(r["outcomes"][s] == "false_new" for s in ("sonar", "codeguard"))
+    ),
+    "new_but_matched": lambda r: (
+        not _known(r) and any(r["outcomes"][s] == "false_known" for s in CONTENT_SCHEMES)
+    ),
+    "agree_known": lambda r: (
+        _known(r) and all(r["outcomes"][s] == "known_ok" for s in CONTENT_SCHEMES)
+    ),
+    "agree_new": lambda r: (
+        not _known(r) and all(r["outcomes"][s] == "new_ok" for s in CONTENT_SCHEMES)
+    ),
+}
+
+
+def _git(repo: Path, *args: str) -> str:
+    done = subprocess.run(["git", "-C", str(repo), *args], capture_output=True, check=False)
+    return done.stdout.decode("utf-8", "replace") if done.returncode == 0 else ""
+
+
+def snippet(repo: Path, commit: str, path: str, line: int, context: int = 4) -> str:
+    """Lines around *line* of *path* at *commit*, numbered, the line itself marked."""
+    lines = _git(repo, "show", f"{commit}:{path}").split("\n")
+    lo, hi = max(1, line - context), min(len(lines), line + context)
+    return "\n".join(
+        f"{'>' if n == line else ' '}{n:5d}  {lines[n - 1]}" for n in range(lo, hi + 1)
+    )
+
+
+def diff_hunks(repo: Path, old: str, new: str, path: str, old_path: str, line: int) -> str:
+    """The hunks of the commit's diff of this file that come within 6 lines of *line*."""
+    paths = [path] if path == old_path else [old_path, path]
+    text = _git(repo, "diff", "-M", "--unified=3", old, new, "--", *paths)
+    hunks: list[list[str]] = []
+    current: list[str] = []
+    for row in text.split("\n"):
+        if row.startswith("@@"):
+            if current:
+                hunks.append(current)
+            current = [row]
+        elif current:
+            current.append(row)
+    if current:
+        hunks.append(current)
+    near = []
+    for hunk in hunks:
+        # @@ -a,b +c,d @@: the new side starts at c and spans d lines.
+        new_side = hunk[0].split("+")[1].split(" ")[0].split(",")
+        start = int(new_side[0])
+        length = int(new_side[1]) if len(new_side) > 1 else 1
+        if start - 6 <= line <= start + length + 6:
+            near.append(_clip(hunk))
+    return "\n".join(near[:MAX_HUNKS]) or "(no diff hunk near this line)"
+
+
+#: A diff shows at most this many hunks, each clipped to this many lines.
+MAX_HUNKS = 2
+MAX_HUNK_LINES = 40
+
+
+def _clip(hunk: list[str]) -> str:
+    if len(hunk) <= MAX_HUNK_LINES:
+        return "\n".join(hunk)
+    return "\n".join([*hunk[:MAX_HUNK_LINES], f"... ({len(hunk) - MAX_HUNK_LINES} more lines)"])
+
+
+def load_records(results: Path, labels: list[str]) -> list[tuple[str, Record, str]]:
+    """``(label, record, old commit)`` for every finding of every replay."""
+    out = []
+    for label in labels:
+        d = results / label
+        if not (d / "findings.jsonl").exists():
+            continue
+        parent = {}
+        with (d / "pairs.jsonl").open(encoding="utf-8") as f:
+            for line in f:
+                pair = json.loads(line)
+                parent[pair["new"]] = pair["old"]
+        with (d / "findings.jsonl").open(encoding="utf-8") as f:
+            for line in f:
+                rec = json.loads(line)
+                out.append((label, rec, parent[rec["commit"]]))
+    return out
+
+
+def draw(
+    records: list[tuple[str, Record, str]], per_stratum: int, seed: int
+) -> list[tuple[str, str, Record, str]]:
+    """``(stratum, label, record, old commit)``, *per_stratum* from each stratum."""
+    rng = random.Random(seed)  # noqa: S311  (reproducible sampling, not security)
+    chosen = []
+    for name, test in STRATA.items():
+        pool = [(label, rec, old) for label, rec, old in records if test(rec)]
+        for label, rec, old in rng.sample(pool, min(per_stratum, len(pool))):
+            chosen.append((name, label, rec, old))
+    return chosen
+
+
+def write_sample(
+    chosen: list[tuple[str, str, Record, str]],
+    repos: Path,
+    urls: dict[str, str],
+    out: Path,
+) -> None:
+    out.mkdir(parents=True, exist_ok=True)
+    md = [
+        "# Ground-truth check",
+        "",
+        "For each finding, decide whether the old and the new finding are the **same**",
+        "issue (for an introduced finding: whether it is **new** in this commit), and write",
+        "`same`, `different` or `unclear` in the `verdict` column of `sample.csv`.",
+        "The harness's answer is given under *Truth*; judge the code, not the answer.",
+        "",
+    ]
+    rows = []
+    for i, (stratum, label, rec, old) in enumerate(chosen, start=1):
+        repo = repos / label
+        new = rec["commit"]
+        path, old_path = rec["path"], rec.get("old_path") or rec["path"]
+        truth = rec["truth"] if rec["truth"] == "new" else f"known ({rec['truth_kind']})"
+        disagree = sorted(
+            s for s in CONTENT_SCHEMES if rec["outcomes"][s] not in ("known_ok", "new_ok")
+        )
+        url = f"{urls[label].removesuffix('.git')}/commit/{new}"
+        md += [
+            f"## {i}. {label}: `{rec['rule']}` ({stratum})",
+            "",
+            f"- Commit: [{new[:10]}]({url}), file `{path}`"
+            + (f" (was `{old_path}`)" if old_path != path else ""),
+            f"- Truth: **{truth}**"
+            + (f", old line {rec['old_line']}" if rec.get("old_line") else "")
+            + f", new line {rec['line']}",
+            "- Schemes that disagree with the truth: "
+            + (", ".join(f"`{s}` ({rec['outcomes'][s]})" for s in disagree) or "none"),
+            "",
+        ]
+        if rec.get("old_line"):
+            md += ["Before:", "", "```", snippet(repo, old, old_path, rec["old_line"]), "```"]
+        md += ["After:", "", "```", snippet(repo, new, path, rec["line"]), "```", ""]
+        if rec["truth"] == "new" or rec.get("truth_kind") == "edited":
+            hunks = diff_hunks(repo, old, new, path, old_path, rec["line"])
+            md += ["Diff near the line:", "", "```diff", hunks, "```", ""]
+        rows.append(
+            {
+                "id": i,
+                "stratum": stratum,
+                "repository": label,
+                "commit": new,
+                "path": path,
+                "rule": rec["rule"],
+                "truth": truth,
+                "old_line": rec.get("old_line") or "",
+                "line": rec["line"],
+                "disagreeing_schemes": " ".join(disagree),
+                "verdict": "",
+                "note": "",
+            }
+        )
+    # Quoted source can end lines in spaces; the repository's hooks strip them.
+    text = "\n".join(row.rstrip() for row in "\n".join(md).split("\n"))
+    (out / "sample.md").write_text(text.rstrip("\n") + "\n", encoding="utf-8")
+    with (out / "sample.csv").open("w", newline="", encoding="utf-8") as f:
+        w = csv.DictWriter(f, fieldnames=list(rows[0]))
+        w.writeheader()
+        w.writerows(rows)
+
+
+def main(argv: list[str] | None = None) -> None:
+    ap = argparse.ArgumentParser(prog="python -m research.finding_identity.gt_sample")
+    ap.add_argument("results", type=Path, help="batch results with findings.jsonl")
+    ap.add_argument("--corpus", type=Path, default=HERE / "corpus.csv")
+    ap.add_argument("--repos", type=Path, default=HERE / ".repos", help="the batch's clones")
+    ap.add_argument("--out", type=Path, default=HERE / "paper" / "ground_truth_check")
+    ap.add_argument("--per-stratum", type=int, default=20)
+    ap.add_argument("--seed", type=int, default=20261017)
+    args = ap.parse_args(argv)
+    corpus = load_corpus(args.corpus)
+    records = load_records(args.results, [e.label for e in corpus])
+    chosen = draw(records, args.per_stratum, args.seed)
+    write_sample(chosen, args.repos, {e.label: e.url for e in corpus}, args.out)
+    counts = {name: sum(1 for c in chosen if c[0] == name) for name in STRATA}
+    print(f"wrote {len(chosen)} findings to {args.out}: {counts}")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/research/finding_identity/matching.py b/research/finding_identity/matching.py
index 308f7af..3b929e4 100644
--- a/research/finding_identity/matching.py
+++ b/research/finding_identity/matching.py
@@ -22,7 +22,7 @@
 from collections.abc import Sequence
 from dataclasses import dataclass, field
 
-from .trackers import MATCHERS
+from .trackers import MATCHERS, RENAME_CHECKS
 
 OUTCOMES = ("known_ok", "mispaired", "false_new", "false_known", "new_ok")
 
@@ -74,9 +74,16 @@ def ground_truth(
 
 
 def scheme_pairs(
-    old: Sequence[Observation], new: Sequence[Observation], scheme: str
+    old: Sequence[Observation], new: Sequence[Observation], scheme: str, *, renamed: bool = False
 ) -> dict[int, int]:
-    """``{new index: old index}`` as the scheme would match them."""
+    """``{new index: old index}`` as the scheme would match them.
+
+    *renamed* says the two versions have different paths (a rename the ground truth
+    follows); schemes in :data:`trackers.RENAME_CHECKS` then decide whether to pair at all.
+    """
+    check = RENAME_CHECKS.get(scheme)
+    if renamed and check is not None and old and new and not check(old, new):
+        return {}
     matcher = MATCHERS.get(scheme)
     if matcher is not None:
         return matcher(old, new)
@@ -102,9 +109,10 @@ def evaluate(
     schemes: Sequence[str],
     *,
     keep_records: bool = False,
+    renamed: bool = False,
 ) -> FileResult:
     gt_pairs = ground_truth(old, new, line_map)
-    return score(old, new, gt_pairs, schemes, keep_records=keep_records)
+    return score(old, new, gt_pairs, schemes, keep_records=keep_records, renamed=renamed)
 
 
 def score(
@@ -114,6 +122,7 @@ def score(
     schemes: Sequence[str],
     *,
     keep_records: bool = False,
+    renamed: bool = False,
 ) -> FileResult:
     """Score every scheme against true pairs ``{new index: (old index, kind)}``."""
     gt = {
@@ -128,7 +137,7 @@ def score(
     by_scheme: dict[str, dict[str, int]] = {}
     statuses: dict[str, list[str]] = {}
     for scheme in schemes:
-        predicted = scheme_pairs(old, new, scheme)
+        predicted = scheme_pairs(old, new, scheme, renamed=renamed)
         counts = dict.fromkeys(OUTCOMES, 0)
         counts["false_new_equal"] = counts["false_new_edited"] = 0
         per_new: list[str] = []
diff --git a/research/finding_identity/paper/claims.md b/research/finding_identity/paper/claims.md
new file mode 100644
index 0000000..a23fe0e
--- /dev/null
+++ b/research/finding_identity/paper/claims.md
@@ -0,0 +1,102 @@
+# Claims and the numbers behind them
+
+Every quantitative statement the paper can make, with its value, interval, counts and
+source. Rates in percent; intervals are 95% cluster-bootstrap intervals over
+repositories (10,000 resamples, seed 20261014) unless marked Wilson. Phrase the claims
+as you like, but keep each number tied to the row it comes from.
+
+Sources:
+
+- `numbers.md`, `table_rq1.tex`, `rq1.csv`: `paper_kit.py` over the corpus replays
+  (CodeGuard: `results/corpus-v3`; Bandit: `results/corpus-bandit`, B101 left out of the
+  table and kept as `bandit_all_rules`).
+- `tables.md`, `pooled.csv`, `per_repo.csv`: `stats` over `results/corpus-v3`.
+- `rq2.csv`, `fig_rq2.pdf`: `paper_kit.py --transform` over `results/transform/`.
+
+Runs: CodeGuard 2.2.0 and Bandit 1.9.4, corpus pinned 2026-10-14, 200 first-parent
+commit pairs per repository, replayed on 2026-10-17.
+
+## Setup facts
+
+| # | Fact | Value | Source |
+|---|---|---|---|
+| S1 | Repositories | 35 (25 Python, 10 JavaScript/TypeScript) | `corpus.csv` |
+| S2 | Commit pairs replayed | 7,000 (CodeGuard); 5,000 (Bandit, Python only) | `numbers.md` |
+| S3 | Persisting / introduced findings, CodeGuard | 23,237 / 1,974 | `numbers.md` |
+| S4 | Persisting / introduced findings, Bandit without B101 | 15,718 / 1,097 | `numbers.md` |
+| S5 | Persisting / introduced findings, Bandit with B101 | 174,853 / 13,024 | `numbers.md` (`bandit_all_rules`) |
+| S6 | B101's share of Bandit's persisting / introduced findings | 91.0% (159,135) / 91.6% (11,927); 98% of B101 findings are in test code | `numbers.md`, rule table of *Bandit (all rules)* |
+| S6b | Without B101, Bandit's findings are mostly hard-coded password strings | B105 35.9% and B106 31.0% of persisting findings; 76% and 99% of them in test code | `numbers.md`, rule table of *Bandit* |
+| S7 | Persisting CodeGuard findings on edited lines | 142 of 23,237 (0.6%) | `pooled.csv`, `false_new_edited` den |
+| S8 | Persisting CodeGuard findings in renamed files | 287 (1.2%), in 8 repositories | `numbers.md` |
+| S9 | Replay time, CodeGuard batch | 1,100 s wall clock on 4 cores for 35 repositories | batch log |
+| S10 | SonarQube tracker port check | 20,000 generated cases, 0 mismatches against the unmodified Java tracker | PR #56; `fidelity/sonar_cases.py` |
+| S11 | Semgrep port check | all 716 `match_based_id` values emitted during the Flask and DefectDojo replays reproduced | PR #56 |
+
+## RQ1: real histories
+
+| # | Claim | Value | Source |
+|---|---|---|---|
+| C1 | Line numbers report about half of all persisting findings as new | `line` 52.6 (48.5–57.6) on CodeGuard findings; 55.0 (49.6–61.6) on Bandit findings | `table_rq1.tex` |
+| C2 | Content-based schemes report 0.3–4.4% as new | CodeGuard findings: `sonar` 0.4 (0.3–0.6), `sonar_branch` 0.6 (0.3–1.0), `codeguard` 1.8 (0.7–3.4), `line_text` 1.9 (0.8–3.5), `github` 3.1 (2.0–4.9), `bandit` 4.4 (3.1–6.3) | `table_rq1.tex` |
+| C3 | The ranking holds on Bandit's own findings | `sonar` 0.27 (0.11–0.52), `codeguard` 0.42 (0.23–0.72), `line_text` 0.78 (0.52–1.08), `github` 1.93 (1.10–3.05) | `numbers.md`, Bandit section |
+| C4 | Renamed files: every key scheme includes the path and reports all their findings as new | 287/287 for `line`, `line_text`, `github`, `codeguard`, `bandit` | `numbers.md` (`false_new_renamed`) |
+| C5 | Renames are a minority of findings but most of the content schemes' false-new reports | 1.2% of persisting findings; 69% of `codeguard`'s false-new reports (287 of 417), 65% of `line_text`'s (287/440), 39% of `github`'s (287/730) | `numbers.md` (counts) |
+| C6 | On files that keep their path, the content schemes are close | `sonar` 0.36 (0.24–0.53), `codeguard` 0.57 (0.39–0.80), `line_text` 0.67 (0.48–0.91), `github` 1.93 (1.62–2.32) | `numbers.md` (`false_new_same_path`) |
+| C7 | SonarQube's identity depends on the analysis type across renames | renamed files: pull-request mode 2.8 (1.7–8.3), 8/287; branch mode 20.2 (4.3–62.3), 58/287. Overall 0.39 vs 0.61 | `numbers.md` |
+| C8 | Edited lines are where every scheme fails | false-new on the 142 edited-line findings: `line_text` 100, `github` 87.3, `codeguard` 74.6, `sonar` 63.4, `bandit` 23.9 (Bandit ignores location and code) | `pooled.csv`, `false_new_edited` |
+| C9 | **Set membership hides new findings** | Bandit's baseline on Bandit findings without B101: 29.2 (20.1–40.9) hidden, 320 of 1,097; with B101: 51.2 (42.5–65.2), 6,670/13,024; on CodeGuard findings: 20.0 (14.1–28.6), 394/1,974 | `table_rq1.tex`, `numbers.md` |
+| C9b | It is not a test-fixture effect | without B101, outside test code: 36.3% of 273 introduced findings in 22 repositories hidden (in test code: 26.8% of 824). Other schemes outside test code: `github` 1.8, `codeguard` 2.9, `sonar` 5.9. No interval: a sensitivity check (see note C) | note C |
+| C10 | Every other scheme hides far fewer | on Bandit findings without B101: `line` 1.9, `codeguard` 2.5, `github` 3.3, `sonar` 4.5, `line_text` 6.0; on CodeGuard findings 0.8–1.9 | `table_rq1.tex` |
+| C11 | Schemes that survive more edits collide more | collision rate, CodeGuard findings: `github` 2.1 (1.1–3.5), `line_text` 17.4 (14.0–21.3), `codeguard` 18.6 (12.9–24.8), `sonar` 20.3 (16.5–24.4), `bandit` 54.2 (44.4–62.5) | `table_rq1.tex` |
+| C12 | The pooled rate hides a skewed spread; one repository dominates `codeguard`'s rate | Ghost: `codeguard` 19.9% of 687 persisting findings (renames from `.js` to `.ts`), `sonar` 1.0, `sonar_branch` 1.7. Per-repository median of `codeguard`: 0.48 | `per_repo.csv`, `numbers.md` |
+| C13 | Findings within a repository are correlated, so per-finding intervals are too narrow | `line_text` false-new 1.89: Wilson 1.73–2.08 against cluster bootstrap 0.80–3.51 | `pooled.csv` |
+
+Caution when pairing C11 with hidden rates: `codeguard`'s hidden rate (1.9, 0.9–3.5) and
+`github`'s (0.8, 0.2–1.9) have overlapping intervals, so collisions cost "tends to hide
+more", not "hides more".
+
+## RQ2: controlled changes
+
+Setup: ten transformations, each applied to one target finding in each of 40 sampled
+files per repository (seeded), in the 25 Python repositories at their pinned commits.
+Cases per transformation range from 150 (`extract_helper`) to 937 (`insert_top`); a
+transformation that does not fit a file is skipped with a recorded reason. Rates are
+pooled over repositories (`rq2.csv` has the cluster-bootstrap intervals). Fig. 1 omits
+`sonar_branch`: no transformation renames a file, so it equals `sonar` in every cell.
+
+| # | Claim | Value | Source |
+|---|---|---|---|
+| R1 | Every single-key scheme has a blind spot | `line`: insert_top 99.1, move_function 96.2, extract_helper 97.3, reformat 85.9. `github`: insert_below 77.5 (its hash reads up to 100 characters forward). `codeguard`: rename_function 100, extract_helper 100, rename_local 97.9 (the enclosing scope and the statement). `line_text`/`github`: change_literal 100/99.6, rename_local 100/100 | `rq2.csv`, Fig. 1 |
+| R2 | Literal masking works | change_literal: `codeguard` 0, against `line_text` 100 and `github` 99.6 | `rq2.csv` |
+| R3 | SonarQube's fallbacks on different evidence make it the most robust | 0 on insert_top, insert_below, move_function, change_literal and extract_helper (a later pass matches the same line hash elsewhere in the file); still loses rename_function 59.0, reformat 17.6, rename_local 9.8 | `rq2.csv` |
+| R4 | Function-level findings break text schemes on renames | rename_function: `line_text`/`github` 59.5. 485 of the 822 cases are complexity, nesting and parameter-count findings (CG-QUAL-003/004/005) reported on the `def` line, which the rename changes | `results/transform/*/cases.jsonl` (note D) |
+| R5 | A copy of a finding is hidden; which copy depends on pairing order | duplicate_above: hidden 100 for every scheme except `github` 11.5; duplicate_below: `github` 88.5 (its forward hash moves to the copy), `bandit` 97.3 (set membership), all others 0.4–5.4 | `rq2.csv` |
+| R6 | Locations inside messages break message-based identity | insert_top moves no code, yet `bandit` reports 2.5% as new: CG-SEC-001, -013 and -014 put source line numbers in their messages ("built on line N", "(line N)") | `cases.jsonl`; `src/codeguard/rules/security/_taint.py`, `cg_sec_001_sql_injection.py` |
+
+Caution: reformat runs black at 79 columns, so how much it changes depends on how each
+repository was formatted before; the row measures that edit, not formatting in general.
+
+## Notes
+
+A. **Why B101 is left out of Bandit's column.** B101 flags every `assert`, and almost all
+of them are in tests; many projects skip it there. Its message never varies, so
+Bandit's set-membership baseline hides every new `assert` once one is baselined, which
+would dominate the hidden rate. The paper reports Bandit without B101 and gives the
+all-rules figure (C9) as a sensitivity check.
+
+C. **C9b** counts introduced Bandit findings (B101 excluded) whose path contains `test`
+or `conftest` (the same test-code rule as `paper_kit.TEST_PATH_PARTS`), from
+`results/corpus-bandit/*/findings.jsonl`. If the paper keeps it, add the split to
+`paper_kit.py` so it gets an interval.
+
+D. **R4** counts scored `rename_function` cases by rule from
+`results/transform/*/cases.jsonl` (`target_outcomes.line_text == "false_new"`).
+
+E. **Still to do before submission.**
+- Manual check of the ground truth on a stratified sample (for Threats): a sample file
+  for labelling can be generated from `findings.jsonl`.
+- Verify every related-work reference in `outline.md` before citing it.
+- Decide whether `sonar` or `sonar_branch` is "SonarQube" in the abstract. Branch mode
+  is what compares a long-lived baseline on the main branch; pull-request mode is what
+  gates a PR.
diff --git a/research/finding_identity/paper/false_new_by_repo.png b/research/finding_identity/paper/false_new_by_repo.png
index 83b2dfc..91d1f02 100644
Binary files a/research/finding_identity/paper/false_new_by_repo.png and b/research/finding_identity/paper/false_new_by_repo.png differ
diff --git a/research/finding_identity/paper/fig_rq2.pdf b/research/finding_identity/paper/fig_rq2.pdf
new file mode 100644
index 0000000..a08565c
Binary files /dev/null and b/research/finding_identity/paper/fig_rq2.pdf differ
diff --git a/research/finding_identity/paper/fig_rq2.png b/research/finding_identity/paper/fig_rq2.png
new file mode 100644
index 0000000..73c823b
Binary files /dev/null and b/research/finding_identity/paper/fig_rq2.png differ
diff --git a/research/finding_identity/paper/ground_truth_check/sample.csv b/research/finding_identity/paper/ground_truth_check/sample.csv
new file mode 100644
index 0000000..535dbaa
--- /dev/null
+++ b/research/finding_identity/paper/ground_truth_check/sample.csv
@@ -0,0 +1,101 @@
+id,stratum,repository,commit,path,rule,truth,old_line,line,disagreeing_schemes,verdict,note
+1,edited,arches,403c4626495b979fe831a8f0baf6d8577708e3d7,arches/app/media/js/views/resource/edit-log.js,CG-QUAL-101,known (edited),58,61,codeguard github line_text sonar,,
+2,edited,healthchecks,b83e3791d6e2c276a13c0b40c2e435c6ec01125c,static/js/checks.js,CG-QUAL-104,known (edited),13,13,codeguard github line_text,,
+3,edited,documenso,9c27ce6d185f7e25eec80439b931c4709723a2ae,packages/app-tests/e2e/teams/team-documents.spec.ts,CG-PERF-101,known (edited),37,29,codeguard github line_text sonar,,
+4,edited,pgadmin,5f56805162c117ac1de17368ef8fdc0b07221e2c,web/pgadmin/tools/sqleditor/static/js/components/QueryToolComponent.jsx,CG-QUAL-101,known (edited),713,749,codeguard github line_text sonar,,
+5,edited,openlibrary,53015559ebcd126850e7b07792ebc7bcfa847919,openlibrary/plugins/openlibrary/js/jsdef.js,CG-QUAL-104,known (edited),77,80,github line_text,,
+6,edited,hoppscotch,863b1b29a803f6c456b04dd82d19a53c7afc9102,packages/hoppscotch-common/src/lib/sync/settings/index.ts,CG-QUAL-101,known (edited),49,42,codeguard github line_text sonar,,
+7,edited,habitica,e6ffd69148396eeff7130b102a93d774fa11dcbc,website/common/script/ops/buy/purchase.js,CG-QUAL-103,known (edited),79,79,codeguard github line_text sonar,,
+8,edited,habitica,e6ffd69148396eeff7130b102a93d774fa11dcbc,website/common/script/ops/feed.js,CG-QUAL-103,known (edited),39,37,codeguard github line_text sonar,,
+9,edited,habitica,e6ffd69148396eeff7130b102a93d774fa11dcbc,website/common/script/ops/buy/hourglassPurchase.js,CG-QUAL-103,known (edited),16,15,codeguard github line_text sonar,,
+10,edited,hedgedoc,2eeb2c72c680f2ce27b22a2d2e43fc86771a02f5,frontend/src/components/render-page/hooks/use-on-html-export-request.ts,CG-SEC-103,known (edited),32,41,codeguard github line_text sonar,,
+11,edited,ghost,0f623f3f5daf914e9896e29cfe28bfbce0f0a8e3,tools/scripts/check-internal-packages.ts,CG-PERF-101,known (edited),285,339,codeguard github line_text sonar,,
+12,edited,kiwi,362febe93063899b8c7468cf7490c26028368a5c,tcms/testplans/static/testplans/js/clone.js,CG-SEC-109,known (edited),110,112,github line_text,,
+13,edited,hoppscotch,9861ee84ad593372885ebfc7cb1c487f3b9dd290,packages/hoppscotch-desktop/src/services/persistence.service.ts,CG-PERF-101,known (edited),112,294,codeguard github line_text sonar,,
+14,edited,uptime-kuma,4e7c4ae382f4038369922a7981babba43403ff1c,test/backend-test/test-migration-v2-to-v3.ts,CG-SEC-105,known (edited),17,21,github line_text sonar,,
+15,edited,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/payment/handleNoShowFee.ts,CG-QUAL-103,known (edited),21,19,line_text,,
+16,edited,hedgedoc,c2ccf48c3966608f7292c6818d1b95469aa1b3cd,backend/src/api/public/notes/notes.controller.ts,CG-PERF-101,known (edited),134,134,codeguard github line_text,,
+17,edited,warehouse,7320d9052b59a7e3b1c2122034396f5d339cd3e0,tests/frontend/filter_list_controller_test.js,CG-SEC-103,known (edited),39,101,codeguard github line_text sonar,,
+18,edited,pgadmin,5f56805162c117ac1de17368ef8fdc0b07221e2c,web/pgadmin/tools/sqleditor/static/js/components/QueryToolComponent.jsx,CG-QUAL-101,known (edited),813,872,codeguard github line_text sonar,,
+19,edited,indico,4c706171e684907abb2a5a032d81be1c10f919b0,indico/modules/events/registration/util.py,CG-QUAL-003,known (edited),596,596,codeguard github line_text sonar,,
+20,edited,edx-platform,b3f862e61aa84a5f8c027081b7d1a07a8619917d,cms/djangoapps/contentstore/api/views/course_import.py,CG-SEC-013,known (edited),142,145,line_text,,
+21,known_but_new,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts,CG-SEC-105,known (equal),1370,1704,codeguard github line_text,,
+22,known_but_new,documenso,97835b8dbb2ca24670c8a410972d949c982c8f61,packages/app-tests/e2e/envelope-editor-v2/envelope-fields.spec.ts,CG-SEC-105,known (equal),1000,1149,codeguard,,
+23,known_but_new,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts,CG-SEC-105,known (equal),2486,3172,codeguard line_text,,
+24,known_but_new,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts,CG-SEC-105,known (equal),1260,1594,codeguard github,,
+25,known_but_new,openlibrary,f5aff19fb7d0c27f3bb91f08db81a8750bae604a,openlibrary/tests/core/test_bookshelves_events_async.py,CG-SEC-001,known (equal),48,136,codeguard,,
+26,known_but_new,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts,CG-SEC-105,known (equal),1395,1728,codeguard line_text,,
+27,known_but_new,kitsune,59b6937db573505c764bec9c87bd786981848487,kitsune/sumo/static/sumo/js/markup.js,CG-QUAL-104,known (equal),965,969,codeguard,,
+28,known_but_new,erpnext,750bf9d9b378fb92eab68733ae727214f3961c0a,erpnext/stock/utils.py,CG-PERF-002,known (equal),159,185,codeguard,,
+29,known_but_new,openlibrary,f5aff19fb7d0c27f3bb91f08db81a8750bae604a,openlibrary/tests/core/test_bookshelves_events_async.py,CG-SEC-001,known (equal),52,140,codeguard,,
+30,known_but_new,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts,CG-SEC-105,known (equal),2622,3308,codeguard line_text,,
+31,known_but_new,nodebb,9d122948cf783fc72c8c01c7aab0f42b2561b3c3,test/user.js,CG-SEC-105,known (equal),2384,2415,codeguard,,
+32,known_but_new,lnbits,f5989201d9c21a4690334f91bbbb421214c989e7,lnbits/static/js/wasm-extension-component.js,CG-QUAL-102,known (equal),904,1126,codeguard,,
+33,known_but_new,erpnext,ddc764b3608610fa659dd722da44e115850cc4da,erpnext/stock/doctype/material_request/material_request.js,CG-QUAL-101,known (equal),810,809,codeguard,,
+34,known_but_new,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts,CG-SEC-105,known (equal),2494,3180,codeguard github line_text,,
+35,known_but_new,arches,2e02ce6e61999d93c10b05d853ae08f1912fa294,arches/app/media/js/views/graph/permission-manager/permission-settings-form.js,CG-QUAL-104,known (equal),128,210,codeguard github line_text,,
+36,known_but_new,nodebb,9d122948cf783fc72c8c01c7aab0f42b2561b3c3,test/user.js,CG-SEC-105,known (equal),1999,2030,codeguard line_text sonar,,
+37,known_but_new,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts,CG-SEC-105,known (equal),1267,1601,codeguard,,
+38,known_but_new,nodebb,b8d9cf9d1ee03115d28b3548911e9076a275311a,test/user.js,CG-SEC-105,known (equal),2318,2335,codeguard,,
+39,known_but_new,nodebb,331599fe89bed8c8ae80199efafeee9e81f72dbf,test/topics/crossposts.js,CG-SEC-105,known (equal),660,678,codeguard github line_text,,
+40,known_but_new,openlibrary,f5aff19fb7d0c27f3bb91f08db81a8750bae604a,openlibrary/tests/core/test_bookshelves_events_async.py,CG-SEC-001,known (equal),56,144,codeguard,,
+41,new_but_matched,hoppscotch,803e4633a27be10d80e752d62bd0dab09ed2924a,packages/hoppscotch-backend/src/team-collection/team-collection.service.ts,CG-PERF-101,new,,131,codeguard github line_text sonar,,
+42,new_but_matched,ckan,7a60264189f543fba04043d2193b09f545a6ef32,ckan/public-midnight-blue/base/javascript/modules/data-viewer.js,CG-QUAL-104,new,,27,sonar,,
+43,new_but_matched,pgadmin,a4bdcff7dc65e1b667b981574a7c7263bc84afd2,web/pgadmin/misc/cloud/static/js/cloud_components.jsx,CG-QUAL-101,new,,58,codeguard,,
+44,new_but_matched,intelowl,80107d6f05e8c1ca1e9ca1d0a937e5df400b7fe0,frontend/src/components/auth/utils/validator.jsx,CG-SEC-105,new,,24,sonar,,
+45,new_but_matched,intelowl,80107d6f05e8c1ca1e9ca1d0a937e5df400b7fe0,frontend/tests/components/auth/utils/validator.test.jsx,CG-SEC-105,new,,45,sonar,,
+46,new_but_matched,arches,2e02ce6e61999d93c10b05d853ae08f1912fa294,arches/app/media/js/views/graph/permission-designer.js,CG-QUAL-104,new,,148,codeguard github sonar,,
+47,new_but_matched,geonode,6f00ca5b66b2459cf3a6556434d476810cabe0d4,geonode/geoserver/gwc.py,CG-SEC-002,new,,50,line_text,,
+48,new_but_matched,hoppscotch,342d0cbdf0c5435b715dc9f1917b851e413e08e3,packages/hoppscotch-common/src/lib/sync/collections/index.ts,CG-QUAL-101,new,,384,codeguard line_text,,
+49,new_but_matched,ghost,0f623f3f5daf914e9896e29cfe28bfbce0f0a8e3,tools/scripts/test/public-apps.test.ts,CG-PERF-101,new,,67,sonar,,
+50,new_but_matched,immich,e66f2c7615bacbe6a9b156e300fc182e4d1a4fa3,server/src/services/person.service.ts,CG-PERF-101,new,,162,codeguard github sonar,,
+51,new_but_matched,arches,2e02ce6e61999d93c10b05d853ae08f1912fa294,arches/app/media/js/views/graph/permission-manager/permission-settings-form.js,CG-QUAL-104,new,,30,codeguard line_text,,
+52,new_but_matched,readthedocs,857138d4d9659a62ce46f52a358f535b6ffeef75,readthedocs/rtd_tests/tests/test_api.py,CG-SEC-002,new,,331,github line_text,,
+53,new_but_matched,openlibrary,53015559ebcd126850e7b07792ebc7bcfa847919,openlibrary/plugins/openlibrary/js/graphs/plot.js,CG-QUAL-104,new,,20,sonar,,
+54,new_but_matched,calcom,ab21c7f805a089fa3a11ffd61c4a9aecc349c16c,packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts,CG-SEC-105,new,,806,codeguard github line_text,,
+55,new_but_matched,ckan,7a60264189f543fba04043d2193b09f545a6ef32,ckan/public/base/javascript/modules/data-viewer.js,CG-QUAL-104,new,,27,sonar,,
+56,new_but_matched,calcom,1660adeb537a3524290c6885c6b9feca63cf675b,scripts/seed.ts,CG-SEC-105,new,,1008,codeguard github line_text sonar,,
+57,new_but_matched,hoppscotch,863b1b29a803f6c456b04dd82d19a53c7afc9102,packages/hoppscotch-common/src/lib/sync/collections/index.ts,CG-QUAL-101,new,,511,sonar,,
+58,new_but_matched,ghost,7da91e095b2803c62bc67fe70f2c4f0d114846d9,tools/scripts/test/ci-path-filters.test.js,CG-PERF-101,new,,69,codeguard line_text,,
+59,new_but_matched,arches,ac6a5ab6907f92256a1ebdbc373de7cabb41e3b0,arches/app/media/js/views/graph-designer.js,CG-QUAL-104,new,,793,sonar,,
+60,new_but_matched,kitsune,59b6937db573505c764bec9c87bd786981848487,kitsune/sumo/static/sumo/js/markup.js,CG-QUAL-104,new,,844,codeguard,,
+61,agree_known,ckan,fd309bc144f08505087d8b8d463aa8da296ba766,ckan/public/base/javascript/client.js,CG-QUAL-104,known (equal),227,226,,,
+62,agree_known,hoppscotch,1855faabbc4ff968d874f54510f6c586a7fdae05,packages/hoppscotch-common/src/lib/sync/collections/index.ts,CG-QUAL-101,known (equal),796,799,,,
+63,agree_known,indico,1ab29e13596cacf234ce75f7c0d4be217010ba6d,indico/modules/events/registration/util.py,CG-QUAL-003,known (equal),474,474,,,
+64,agree_known,securedrop,871378be59567ac2916c1ae5d8f347784288d46f,securedrop/tests/test_journalist_api2.py,CG-QUAL-003,known (equal),738,738,,,
+65,agree_known,weblate,f4e6cc3fe00e4ea1c0dd849af897442246f14191,weblate/trans/tests/test_autotranslate.py,CG-QUAL-004,known (equal),1621,1639,,,
+66,agree_known,securedrop,db86920ded3273f0fec3f7cb7287817bf5167000,securedrop/tests/test_journalist.py,CG-SEC-002,known (equal),1339,1338,,,
+67,agree_known,arches,ef3a5efc290afac95e3a6b5e3c8edabd51a9ddab,arches/app/permissions/arches_default_deny.py,CG-QUAL-003,known (equal),230,264,,,
+68,agree_known,habitica,78c62a5aec6f6270ff432de6fdb6efb0e120526d,website/server/controllers/api-v3/tasks.js,CG-SEC-111,known (equal),1017,1018,,,
+69,agree_known,arches,719e7c189df8cc023d756198938d60b280be9c61,arches/app/media/js/views/graph-designer.js,CG-QUAL-104,known (equal),775,777,,,
+70,agree_known,inventree,5244b8a4f21436f699ea266eb5a7381f899409f0,src/backend/InvenTree/plugin/registry.py,CG-QUAL-003,known (equal),688,689,,,
+71,agree_known,readthedocs,6b9919fd2891a30f9f75a99c81fd71d6f09bb821,readthedocs/rtd_tests/tests/test_api.py,CG-SEC-002,known (equal),762,759,,,
+72,agree_known,arches,fbfb7c909265301e0945f9bad49f5c68ae2a76da,arches/app/media/js/viewmodels/map-editor.js,CG-QUAL-104,known (equal),358,359,,,
+73,agree_known,defectdojo,7e2af4942cfddf89ecace7bffb35c0d006d76a53,dojo/static/dojo/js/metrics.js,CG-QUAL-104,known (equal),836,836,,,
+74,agree_known,ckan,ea3c0fd8814de0fa83e744bcb4d5ab5a93902a34,ckan/logic/action/update.py,CG-QUAL-003,known (equal),474,500,,,
+75,agree_known,geonode,e653caf78f3567996934967448a7e959db44236e,geonode/utils.py,CG-SEC-002,known (equal),1061,1061,,,
+76,agree_known,geonode,e653caf78f3567996934967448a7e959db44236e,geonode/utils.py,CG-QUAL-002,known (equal),377,377,,,
+77,agree_known,erpnext,028a9ed1d94ce99702dd65b32ca3aede52b52006,erpnext/stock/doctype/pick_list/pick_list.py,CG-QUAL-005,known (equal),1354,1451,,,
+78,agree_known,kitsune,7558489f48358f1f90ab0dfd5e4cc1a285240693,kitsune/sumo/static/sumo/js/markup.js,CG-QUAL-104,known (equal),421,568,,,
+79,agree_known,inventree,02da01dfec309ac410e846a57d329d0e96b90e21,src/frontend/src/pages/stock/TransferOrderDetail.tsx,CG-QUAL-101,known (equal),160,166,,,
+80,agree_known,kitsune,59b6937db573505c764bec9c87bd786981848487,kitsune/sumo/static/sumo/js/markup.js,CG-QUAL-104,known (equal),633,633,,,
+81,agree_new,ckan,9c010ae0a9dca9967292563ad856ca99079b891f,ckan/public/base/javascript/modules/autocomplete.js,CG-QUAL-104,new,,77,,,
+82,agree_new,lnbits,653924a6dcb6d821a9dae32cd9aac5d287351c57,lnbits/static/i18n/fo.js,CG-SEC-105,new,,300,,,
+83,agree_new,openlibrary,ff9577a078ac1492c1ce4cef0bd53b69e98a692e,openlibrary/bookworm/cli.py,CG-QUAL-003,new,,406,,,
+84,agree_new,inventree,99893f3453c6a213a331c022e82cbafbde7ebd51,src/frontend/src/components/tables/InvenTreeTable.tsx,CG-QUAL-101,new,,940,,,
+85,agree_new,calcom,0d164da8ddc68474300dc85677856950ef81ee7e,apps/web/playwright/fixtures/users.ts,CG-QUAL-103,new,,813,,,
+86,agree_new,erpnext,8c85cef29b0b80a23a499516a94d4319cf45503d,erpnext/stock/doctype/landed_cost_voucher/landed_cost_voucher.js,CG-QUAL-104,new,,119,,,
+87,agree_new,hoppscotch,e633b55a0b9da30f3d6ddefcc9ab3c393cd52be8,packages/hoppscotch-common/src/services/__tests__/ai-chat-ui.spec.ts,CG-PERF-101,new,,325,,,
+88,agree_new,lnbits,7eb996520584b3da9ed865c944e11ddbd2095998,tests/api/test_admin_api.py,CG-QUAL-003,new,,151,,,
+89,agree_new,netbox,9d96894f4e1c622c25de40ccca5847efa5e15153,netbox/utilities/tests/test_ltree.py,CG-SEC-001,new,,1184,,,
+90,agree_new,lnbits,c0806ca59c90464e424f881a92efd8033fd9bd2b,tests/e2e/extension-helpers.ts,CG-PERF-101,new,,540,,,
+91,agree_new,calcom,089a39f59f39f4cd613ab0064dc23117b080c538,apps/api/v2/src/ee/bookings/2024-08-13/controllers/e2e/update-booking-location.e2e-spec.ts,CG-SEC-105,new,,529,,,
+92,agree_new,edx-platform,294f05f57e3ba73c59b31394cbc2f2c9d6808c14,cms/djangoapps/contentstore/rest_api/v1/views/tests/test_course_index.py,CG-SEC-002,new,,279,,,
+93,agree_new,uptime-kuma,e62702d868a0b072c6e1870e5278762319637f04,server/notification-providers/indigo.js,CG-PERF-101,new,,52,,,
+94,agree_new,lnbits,61ed636df066ced4c600a5eb55af147e6d13d130,lnbits/core/services/extensions.py,CG-QUAL-005,new,,268,,,
+95,agree_new,netbox,8cc4548e1f51fcd4cb63299339b55e5ef179e28a,netbox/utilities/ltree.py,CG-SEC-001,new,,287,,,
+96,agree_new,ckan,1902693db45f27bd6a4b93fb0f16b83bba5f79b8,ckan/public/base/javascript/toast.js,CG-SEC-103,new,,162,,,
+97,agree_new,healthchecks,b83e3791d6e2c276a13c0b40c2e435c6ec01125c,hc/integrations/po/static/js/add_pushover.js,CG-QUAL-104,new,,7,,,
+98,agree_new,hoppscotch,e633b55a0b9da30f3d6ddefcc9ab3c393cd52be8,packages/hoppscotch-common/src/services/ai-chat.service.ts,CG-PERF-101,new,,4893,,,
+99,agree_new,arches,2e02ce6e61999d93c10b05d853ae08f1912fa294,arches/app/media/js/views/graph/permission-designer.js,CG-QUAL-104,new,,157,,,
+100,agree_new,healthchecks,cb1926bedaeca358a644e3096cd47d80648abfd3,hc/integrations/telegram/transport.py,CG-QUAL-004,new,,30,,,
diff --git a/research/finding_identity/paper/ground_truth_check/sample.md b/research/finding_identity/paper/ground_truth_check/sample.md
new file mode 100644
index 0000000..115330e
--- /dev/null
+++ b/research/finding_identity/paper/ground_truth_check/sample.md
@@ -0,0 +1,4768 @@
+# Ground-truth check
+
+For each finding, decide whether the old and the new finding are the **same**
+issue (for an introduced finding: whether it is **new** in this commit), and write
+`same`, `different` or `unclear` in the `verdict` column of `sample.csv`.
+The harness's answer is given under *Truth*; judge the code, not the answer.
+
+## 1. arches: `CG-QUAL-101` (edited)
+
+- Commit: [403c462649](https://github.com/archesproject/arches/commit/403c4626495b979fe831a8f0baf6d8577708e3d7), file `arches/app/media/js/views/resource/edit-log.js`
+- Truth: **known (edited)**, old line 58, new line 61
+- Schemes that disagree with the truth: `codeguard` (false_new), `github` (false_new), `line_text` (false_new), `sonar` (false_new)
+
+Before:
+
+```
+    54                  }
+    55                  full_value[k] = {new_value: v};
+    56                  if (edit.card) {
+    57                      _.each(edit.card.nodes, function(node){
+>   58                          if (k == node.nodeid) {
+    59                              full_value[node.nodeid].node = node;
+    60                          }
+    61                      }, this);
+    62                  }
+```
+After:
+
+```
+    57                  }
+    58                  full_value[nodeid] = {new_value: val, is_array: is_array};
+    59                  if (edit.card) {
+    60                      _.each(edit.card.nodes, function(node){
+>   61                          if (nodeid == node.nodeid) {
+    62                              full_value[node.nodeid].node = node;
+    63                          }
+    64                      }, this);
+    65                  }
+```
+
+Diff near the line:
+
+```diff
+@@ -48,20 +50,21 @@ var ResourceEditLogView = BaseManagerView.extend({
+                 return value;
+             }
+
+-            _.each(value, function(v, k){
+-                if (_.isObject(v) && v['features']) {
+-                    v = _.map(v['features'], function(feature){return JSON.stringify(feature['geometry'], rounder, 4);});
++            _.each(value, function(val, nodeid){
++                var is_array = _.isArray(val);
++                if (_.isObject(val) && val['features']) {
++                    val = _.map(val['features'], function(feature){return JSON.stringify(feature['geometry'], rounder, 4);});
+                 }
+-                full_value[k] = {new_value: v};
++                full_value[nodeid] = {new_value: val, is_array: is_array};
+                 if (edit.card) {
+                     _.each(edit.card.nodes, function(node){
+-                        if (k == node.nodeid) {
++                        if (nodeid == node.nodeid) {
+                             full_value[node.nodeid].node = node;
+                         }
+                     }, this);
+                 }
+             });
+-            return _.map(full_value, function(v,k){return v;});   // eslint-disable-line @typescript-eslint/no-unused-vars
++            return _.map(full_value, function(val,nodeid){return val;});   // eslint-disable-line @typescript-eslint/no-unused-vars
+         };
+
+         _.each(edits, function(edit){
+```
+
+## 2. healthchecks: `CG-QUAL-104` (edited)
+
+- Commit: [b83e3791d6](https://github.com/healthchecks/healthchecks/commit/b83e3791d6e2c276a13c0b40c2e435c6ec01125c), file `static/js/checks.js`
+- Truth: **known (edited)**, old line 13, new line 13
+- Schemes that disagree with the truth: `codeguard` (false_new), `github` (false_new), `line_text` (false_new)
+
+Before:
+
+```
+     9          $("#update-name-form").attr("action", url);
+    10          $("#update-name-input").val(this.dataset.name);
+    11          $("#update-slug-input").val(this.dataset.slug);
+    12
+>   13          var tagsSelectize = document.getElementById("update-tags-input").selectize;
+    14          tagsSelectize.setValue(this.dataset.tags.split(" "));
+    15
+    16          $("#update-desc-input").val(this.dataset.desc);
+    17          $("#update-name-modal").modal("show");
+```
+After:
+
+```
+     9          $("#update-name-form").attr("action", url);
+    10          $("#update-name-input").val(this.dataset.name);
+    11          $("#update-slug-input").val(this.dataset.slug);
+    12
+>   13          var tagsTs = document.getElementById("update-tags-input").tomselect;
+    14          tagsTs.setValue(this.dataset.tags.split(" "));
+    15
+    16          $("#update-desc-input").val(this.dataset.desc);
+    17          $("#update-name-modal").modal("show");
+```
+
+Diff near the line:
+
+```diff
+@@ -10,8 +10,8 @@ $(function () {
+         $("#update-name-input").val(this.dataset.name);
+         $("#update-slug-input").val(this.dataset.slug);
+
+-        var tagsSelectize = document.getElementById("update-tags-input").selectize;
+-        tagsSelectize.setValue(this.dataset.tags.split(" "));
++        var tagsTs = document.getElementById("update-tags-input").tomselect;
++        tagsTs.setValue(this.dataset.tags.split(" "));
+
+         $("#update-desc-input").val(this.dataset.desc);
+         $("#update-name-modal").modal("show");
+```
+
+## 3. documenso: `CG-PERF-101` (edited)
+
+- Commit: [9c27ce6d18](https://github.com/documenso/documenso/commit/9c27ce6d185f7e25eec80439b931c4709723a2ae), file `packages/app-tests/e2e/teams/team-documents.spec.ts`
+- Truth: **known (edited)**, old line 37, new line 29
+- Schemes that disagree with the truth: `codeguard` (false_new), `github` (false_new), `line_text` (false_new), `sonar` (false_new)
+
+Before:
+
+```
+    33
+    34      // Check counts after filtering.
+    35      await checkDocumentTabCount(page, 'Inbox', 0);
+    36      await checkDocumentTabCount(page, 'Pending', 2);
+>   37      await checkDocumentTabCount(page, 'Completed', 0);
+    38      await checkDocumentTabCount(page, 'Draft', 1);
+    39      await checkDocumentTabCount(page, 'All', 3);
+    40
+    41      await apiSignout({ page });
+```
+After:
+
+```
+    25      // Apply filter.
+    26      await toggleDocumentSenderFilter(page, teamMember2.name ?? '');
+    27
+    28      // Check counts after filtering.
+>   29      await checkDocumentCounts(page, { inbox: 0, pending: 2, completed: 0, draft: 1, all: 3 });
+    30
+    31      await apiSignout({ page });
+    32    }
+    33  });
+```
+
+Diff near the line:
+
+```diff
+@@ -20,23 +20,13 @@ test('[TEAMS]: check team documents count', async ({ page }) => {
+     });
+
+     // Check document counts.
+-    await checkDocumentTabCount(page, 'Inbox', 0);
+-    await checkDocumentTabCount(page, 'Pending', 2);
+-    await checkDocumentTabCount(page, 'Completed', 1);
+-    await checkDocumentTabCount(page, 'Draft', 2);
+-    await checkDocumentTabCount(page, 'All', 5);
++    await checkDocumentCounts(page, { inbox: 0, pending: 2, completed: 1, draft: 2, all: 5 });
+
+     // Apply filter.
+-    await page.locator('button').filter({ hasText: 'Sender: All' }).click();
+-    await page.getByRole('option', { name: teamMember2.name ?? '' }).click();
+-    await page.waitForURL(/senderIds/);
++    await toggleDocumentSenderFilter(page, teamMember2.name ?? '');
+
+     // Check counts after filtering.
+-    await checkDocumentTabCount(page, 'Inbox', 0);
+-    await checkDocumentTabCount(page, 'Pending', 2);
+-    await checkDocumentTabCount(page, 'Completed', 0);
+-    await checkDocumentTabCount(page, 'Draft', 1);
+-    await checkDocumentTabCount(page, 'All', 3);
++    await checkDocumentCounts(page, { inbox: 0, pending: 2, completed: 0, draft: 1, all: 3 });
+
+     await apiSignout({ page });
+   }
+```
+
+## 4. pgadmin: `CG-QUAL-101` (edited)
+
+- Commit: [5f56805162](https://github.com/pgadmin-org/pgadmin4/commit/5f56805162c117ac1de17368ef8fdc0b07221e2c), file `web/pgadmin/tools/sqleditor/static/js/components/QueryToolComponent.jsx`
+- Truth: **known (edited)**, old line 713, new line 749
+- Schemes that disagree with the truth: `codeguard` (false_new), `github` (false_new), `line_text` (false_new), `sonar` (false_new)
+
+Before:
+
+```
+   709          for (const connItem of newConnList) {
+   710            if(newConnData.sid == connItem.sid
+   711              && newConnData.did == connItem.did
+   712              && newConnData.user == connItem.user
+>  713              && newConnData.role == connItem.role) {
+   714              connItem.is_selected = true;
+   715            } else {
+   716              connItem.is_selected = false;
+   717            }
+```
+After:
+
+```
+   745          for (const connItem of newConnList) {
+   746            if(newConnData.sid == connItem.sid
+   747              && newConnData.did == connItem.did
+   748              && newConnData.user == connItem.user
+>  749              && (newConnData.role || null) == (connItem.role || null)) {
+   750              connItem.is_selected = true;
+   751            } else {
+   752              connItem.is_selected = false;
+   753            }
+```
+
+Diff near the line:
+
+```diff
+@@ -702,15 +735,18 @@ export default function QueryToolComponent({params, pgWindow, pgAdmin, selectedN
+     const selectConn = (newConnData, connected=false, obtainingConn=true)=>{
+       setQtStatePartial((prevQtState)=>{
+         let newConnList = [...prevQtState.connection_list];
+-        /* If new, add to the list */
+-        if(isNew) {
++        /* If new, add to the list if not already present */
++        if(isNew && !newConnList.some((c)=>c.sid == newConnData.sid
++          && c.did == newConnData.did
++          && c.user == newConnData.user
++          && (c.role || null) == (newConnData.role || null))) {
+           newConnList.push(newConnData);
+         }
+         for (const connItem of newConnList) {
+           if(newConnData.sid == connItem.sid
+             && newConnData.did == connItem.did
+             && newConnData.user == connItem.user
+-            && newConnData.role == connItem.role) {
++            && (newConnData.role || null) == (connItem.role || null)) {
+             connItem.is_selected = true;
+           } else {
+             connItem.is_selected = false;
+```
+
+## 5. openlibrary: `CG-QUAL-104` (edited)
+
+- Commit: [53015559eb](https://github.com/internetarchive/openlibrary/commit/53015559ebcd126850e7b07792ebc7bcfa847919), file `openlibrary/plugins/openlibrary/js/jsdef.js`
+- Truth: **known (edited)**, old line 77, new line 80
+- Schemes that disagree with the truth: `github` (false_new), `line_text` (false_new)
+
+Before:
+
+```
+    73      this.index0 = -1;
+    74  }
+    75
+    76  ForLoop.prototype.next = function() {
+>   77      var i = this.index0+1;
+    78
+    79      this.index0 = i;
+    80      this.index = i+1;
+    81
+```
+After:
+
+```
+    76      this.index0 = -1;
+    77  }
+    78
+    79  ForLoop.prototype.next = function () {
+>   80      var i = this.index0 + 1;
+    81
+    82      this.index0 = i;
+    83      this.index = i + 1;
+    84
+```
+
+Diff near the line:
+
+```diff
+@@ -73,17 +76,17 @@ export function ForLoop(parent, seq) {
+     this.index0 = -1;
+ }
+
+-ForLoop.prototype.next = function() {
+-    var i = this.index0+1;
++ForLoop.prototype.next = function () {
++    var i = this.index0 + 1;
+
+     this.index0 = i;
+-    this.index = i+1;
++    this.index = i + 1;
+
+-    this.first = (i === 0);
+-    this.last = (i === this.length-1);
++    this.first = i === 0;
++    this.last = i === this.length - 1;
+
+-    this.odd = (this.index % 2 === 1);
+-    this.even = (this.index % 2 === 0);
++    this.odd = this.index % 2 === 1;
++    this.even = this.index % 2 === 0;
+     this.parity = ['even', 'odd'][this.index % 2];
+
+     this.revindex0 = this.length - i;
+```
+
+## 6. hoppscotch: `CG-QUAL-101` (edited)
+
+- Commit: [863b1b29a8](https://github.com/hoppscotch/hoppscotch/commit/863b1b29a803f6c456b04dd82d19a53c7afc9102), file `packages/hoppscotch-common/src/lib/sync/settings/index.ts` (was `packages/hoppscotch-selfhost-web/src/platform/settings/web/index.ts`)
+- Truth: **known (edited)**, old line 49, new line 42
+- Schemes that disagree with the truth: `codeguard` (false_new), `github` (false_new), `line_text` (false_new), `sonar` (false_new)
+
+Before:
+
+```
+    45    const res = await getUserSettings()
+    46
+    47    // create user settings if it doesn't exist
+    48    E.isLeft(res) &&
+>   49      res.left.error == "user_settings/not_found" &&
+    50      (await createUserSettings(JSON.stringify(getDefaultSettings())))
+    51
+    52    if (E.isRight(res)) {
+    53      runDispatchWithOutSyncing(() => {
+```
+After:
+
+```
+    38  async function loadUserSettings() {
+    39    const res = await getUserSettings()
+    40
+    41    // create user settings if it doesn't exist
+>   42    if (E.isLeft(res) && res.left.error == "user_settings/not_found") {
+    43      const createRes = await createUserSettings(
+    44        JSON.stringify(getDefaultSettings())
+    45      )
+    46
+```
+
+Diff near the line:
+
+```diff
+@@ -45,11 +39,19 @@ async function loadUserSettings() {
+   const res = await getUserSettings()
+
+   // create user settings if it doesn't exist
+-  E.isLeft(res) &&
+-    res.left.error == "user_settings/not_found" &&
+-    (await createUserSettings(JSON.stringify(getDefaultSettings())))
++  if (E.isLeft(res) && res.left.error == "user_settings/not_found") {
++    const createRes = await createUserSettings(
++      JSON.stringify(getDefaultSettings())
++    )
+
+-  if (E.isRight(res)) {
++    if (E.isRight(createRes)) {
++      runDispatchWithOutSyncing(() => {
++        bulkApplySettings(
++          JSON.parse(createRes.right.createUserSettings.properties)
++        )
++      })
++    }
++  } else if (E.isRight(res)) {
+     runDispatchWithOutSyncing(() => {
+       bulkApplySettings(JSON.parse(res.right.me.settings.properties))
+     })
+
+```
+
+## 7. habitica: `CG-QUAL-103` (edited)
+
+- Commit: [e6ffd69148](https://github.com/HabitRPG/habitica/commit/e6ffd69148396eeff7130b102a93d774fa11dcbc), file `website/common/script/ops/buy/purchase.js`
+- Truth: **known (edited)**, old line 79, new line 79
+- Schemes that disagree with the truth: `codeguard` (false_new), `github` (false_new), `line_text` (false_new), `sonar` (false_new)
+
+Before:
+
+```
+    75  }
+    76
+    77  const acceptedTypes = ['eggs', 'hatchingPotions', 'food', 'gear', 'bundles'];
+    78  const singlePurchaseTypes = ['gear'];
+>   79  export default async function purchase (user, req = {}, analytics) {
+    80    const type = get(req.params, 'type');
+    81    const key = get(req.params, 'key');
+    82
+    83    const quantity = req.quantity ? Number(req.quantity) : 1;
+```
+After:
+
+```
+    75  }
+    76
+    77  const acceptedTypes = ['eggs', 'hatchingPotions', 'food', 'gear', 'bundles'];
+    78  const singlePurchaseTypes = ['gear'];
+>   79  export default async function purchase (user, req = {}) {
+    80    const type = get(req.params, 'type');
+    81    const key = get(req.params, 'key');
+    82
+    83    const quantity = req.quantity ? Number(req.quantity) : 1;
+```
+
+Diff near the line:
+
+```diff
+@@ -76,7 +76,7 @@ async function purchaseItem (user, item, price, type, key) {
+
+ const acceptedTypes = ['eggs', 'hatchingPotions', 'food', 'gear', 'bundles'];
+ const singlePurchaseTypes = ['gear'];
+-export default async function purchase (user, req = {}, analytics) {
++export default async function purchase (user, req = {}) {
+   const type = get(req.params, 'type');
+   const key = get(req.params, 'key');
+
+```
+
+## 8. habitica: `CG-QUAL-103` (edited)
+
+- Commit: [e6ffd69148](https://github.com/HabitRPG/habitica/commit/e6ffd69148396eeff7130b102a93d774fa11dcbc), file `website/common/script/ops/feed.js`
+- Truth: **known (edited)**, old line 39, new line 37
+- Schemes that disagree with the truth: `codeguard` (false_new), `github` (false_new), `line_text` (false_new), `sonar` (false_new)
+
+Before:
+
+```
+    35      egg: pet.text(req.language),
+    36    }, req.language);
+    37  }
+    38
+>   39  export default function feed (user, req = {}, analytics) {
+    40    let pet = get(req, 'params.pet');
+    41    const foodK = get(req, 'params.food');
+    42    let amount = Number(get(req.query, 'amount', 1));
+    43    let foodFactor;
+```
+After:
+
+```
+    33      egg: pet.text(req.language),
+    34    }, req.language);
+    35  }
+    36
+>   37  export default function feed (user, req = {}) {
+    38    let pet = get(req, 'params.pet');
+    39    const foodK = get(req, 'params.food');
+    40    let amount = Number(get(req.query, 'amount', 1));
+    41    let foodFactor;
+```
+
+Diff near the line:
+
+```diff
+@@ -36,7 +34,7 @@ function evolve (user, pet, req) {
+   }, req.language);
+ }
+
+-export default function feed (user, req = {}, analytics) {
++export default function feed (user, req = {}) {
+   let pet = get(req, 'params.pet');
+   const foodK = get(req, 'params.food');
+   let amount = Number(get(req.query, 'amount', 1));
+```
+
+## 9. habitica: `CG-QUAL-103` (edited)
+
+- Commit: [e6ffd69148](https://github.com/HabitRPG/habitica/commit/e6ffd69148396eeff7130b102a93d774fa11dcbc), file `website/common/script/ops/buy/hourglassPurchase.js`
+- Truth: **known (edited)**, old line 16, new line 15
+- Schemes that disagree with the truth: `codeguard` (false_new), `github` (false_new), `line_text` (false_new), `sonar` (false_new)
+
+Before:
+
+```
+    12  import getItemInfo from '../../libs/getItemInfo';
+    13  import { removeItemByPath } from '../pinnedGearUtils';
+    14  import updateUserHourglasses from '../updateUserHourglasses';
+    15
+>   16  export default async function purchaseHourglass (user, req = {}, analytics, quantity = 1) {
+    17    const key = get(req, 'params.key');
+    18    if (!key) throw new BadRequest(errorMessage('missingKeyParam'));
+    19
+    20    const type = get(req, 'params.type');
+```
+After:
+
+```
+    11  import getItemInfo from '../../libs/getItemInfo';
+    12  import { removeItemByPath } from '../pinnedGearUtils';
+    13  import updateUserHourglasses from '../updateUserHourglasses';
+    14
+>   15  export default async function purchaseHourglass (user, req = {}, quantity = 1) {
+    16    const key = get(req, 'params.key');
+    17    if (!key) throw new BadRequest(errorMessage('missingKeyParam'));
+    18
+    19    const type = get(req, 'params.type');
+```
+
+Diff near the line:
+
+```diff
+@@ -13,7 +12,7 @@ import getItemInfo from '../../libs/getItemInfo';
+ import { removeItemByPath } from '../pinnedGearUtils';
+ import updateUserHourglasses from '../updateUserHourglasses';
+
+-export default async function purchaseHourglass (user, req = {}, analytics, quantity = 1) {
++export default async function purchaseHourglass (user, req = {}, quantity = 1) {
+   const key = get(req, 'params.key');
+   if (!key) throw new BadRequest(errorMessage('missingKeyParam'));
+
+```
+
+## 10. hedgedoc: `CG-SEC-103` (edited)
+
+- Commit: [2eeb2c72c6](https://github.com/hedgedoc/hedgedoc/commit/2eeb2c72c680f2ce27b22a2d2e43fc86771a02f5), file `frontend/src/components/render-page/hooks/use-on-html-export-request.ts`
+- Truth: **known (edited)**, old line 32, new line 41
+- Schemes that disagree with the truth: `codeguard` (false_new), `github` (false_new), `line_text` (false_new), `sonar` (false_new)
+
+Before:
+
+```
+    28            if (!documentContainer) {
+    29              return
+    30            }
+    31            const downloadElement = document.createElement('div')
+>   32            downloadElement.innerHTML = documentContainer.innerHTML
+    33            ;[
+    34              ...downloadElement.querySelectorAll(`.${clickShieldCss['click-shield']}`),
+    35              ...downloadElement.querySelectorAll(`.${copyButtonCss['copy-button']}`),
+    36              ...downloadElement.querySelectorAll(`.${highlightedCodeCss['linenumber']}`)
+```
+After:
+
+```
+    37            if (!documentContainer) {
+    38              return
+    39            }
+    40            const exportMarkdownBodyElement = document.createElement('div')
+>   41            exportMarkdownBodyElement.innerHTML = documentContainer.innerHTML
+    42            cleanupHtmlForExport(exportMarkdownBodyElement, noteUrl)
+    43
+    44            if (withStyles) {
+    45              await extractImagesToBase64(exportMarkdownBodyElement)
+```
+
+Diff near the line:
+
+```diff
+@@ -23,27 +30,25 @@ export const useOnHtmlExportRequest = (communicator: RendererToEditorCommunicato
+     CommunicationMessageType.EXPORT_HTML_REQUEST,
+     useMemo(
+       () =>
+-        ({ noteUrl }) => {
+-          const documentContainer = document.querySelector('.markdown-body')
++        async ({ noteUrl, withStyles, noteTitle }) => {
++          let finalHtml: string
++          const rootElementQuery = withStyles ? `.${markdownDocumentCss.document}` : '.markdown-body'
++          const documentContainer = document.querySelector(rootElementQuery)
+           if (!documentContainer) {
+             return
+           }
+-          const downloadElement = document.createElement('div')
+-          downloadElement.innerHTML = documentContainer.innerHTML
+-          ;[
+-            ...downloadElement.querySelectorAll(`.${clickShieldCss['click-shield']}`),
+-            ...downloadElement.querySelectorAll(`.${copyButtonCss['copy-button']}`),
+-            ...downloadElement.querySelectorAll(`.${highlightedCodeCss['linenumber']}`)
+-          ].forEach((element) => element.remove())
+-          console.debug('Note URL to replace: ', noteUrl)
+-          downloadElement.querySelectorAll('a[href]').forEach((element) => {
+-            const href = element.getAttribute('href')
+-            if (!href || !href.startsWith(noteUrl)) {
+-              return
+-            }
+-            element.setAttribute('href', href.replace(noteUrl, ''))
+-          })
+-          const finalHtml = downloadElement.innerHTML
++          const exportMarkdownBodyElement = document.createElement('div')
++          exportMarkdownBodyElement.innerHTML = documentContainer.innerHTML
++          cleanupHtmlForExport(exportMarkdownBodyElement, noteUrl)
++
++          if (withStyles) {
++            await extractImagesToBase64(exportMarkdownBodyElement)
++            const finalHtmlElement = await buildFullHtmlPageForExport(exportMarkdownBodyElement, noteTitle)
++            finalHtml = finalHtmlElement.outerHTML
++          } else {
++            finalHtml = exportMarkdownBodyElement.innerHTML
++          }
+... (4 more lines)
+```
+
+## 11. ghost: `CG-PERF-101` (edited)
+
+- Commit: [0f623f3f5d](https://github.com/TryGhost/Ghost/commit/0f623f3f5daf914e9896e29cfe28bfbce0f0a8e3), file `tools/scripts/check-internal-packages.ts`
+- Truth: **known (edited)**, old line 285, new line 339
+- Schemes that disagree with the truth: `codeguard` (false_new), `github` (false_new), `line_text` (false_new), `sonar` (false_new)
+
+Before:
+
+```
+   281          conditions.default,
+   282          `./build/${sourceStem}.js`,
+   283          `exports.${entryPoint}.default`,
+   284        );
+>  285        if (!(await exists(path.join(packageDirectory, conditions.source)))) {
+   286          errors.push(
+   287            `${manifestPath}: exports.${entryPoint}.source does not exist (${conditions.source})`,
+   288          );
+   289        }
+```
+After:
+
+```
+   335          conditions.default,
+   336          `./build/${sourceStem}.js`,
+   337          `exports.${entryPoint}.default`,
+   338        );
+>  339        if (!(await exists(path.join(packageDirectory, conditions.source as string)))) {
+   340          errors.push(
+   341            `${manifestPath}: exports.${entryPoint}.source does not exist (${conditions.source as string})`,
+   342          );
+   343        }
+```
+
+Diff near the line:
+
+```diff
+@@ -282,14 +336,14 @@ async function validateCompliantPackage({
+         `./build/${sourceStem}.js`,
+         `exports.${entryPoint}.default`,
+       );
+-      if (!(await exists(path.join(packageDirectory, conditions.source)))) {
++      if (!(await exists(path.join(packageDirectory, conditions.source as string)))) {
+         errors.push(
+-          `${manifestPath}: exports.${entryPoint}.source does not exist (${conditions.source})`,
++          `${manifestPath}: exports.${entryPoint}.source does not exist (${conditions.source as string})`,
+         );
+       }
+     }
+
+-    const rootExport = exports['.'];
++    const rootExport = (exports as JsonObject)['.'] as JsonObject | undefined;
+     if (!rootExport) {
+       errors.push(`${manifestPath}: exports must define the "." entry point`);
+     } else {
+```
+
+## 12. kiwi: `CG-SEC-109` (edited)
+
+- Commit: [362febe930](https://github.com/kiwitcms/Kiwi/commit/362febe93063899b8c7468cf7490c26028368a5c), file `tcms/testplans/static/testplans/js/clone.js`
+- Truth: **known (edited)**, old line 110, new line 112
+- Schemes that disagree with the truth: `github` (false_new), `line_text` (false_new)
+
+Before:
+
+```
+   106
+   107              if (newPlanIds.length === 1) {
+   108                  window.location.assign(`/plan/${newPlanIds[0]}/`)
+   109              } else {
+>  110                  window.location.assign(document.referrer || '/')
+   111              }
+   112          }
+   113
+   114          if (!rows.length) {
+```
+After:
+
+```
+   108              const redirectToClonedPlan = function () {
+   109                  if (isTree || newPlanIds.length === 1) {
+   110                      window.location.assign(`/plan/${newPlanIds[0]}/`)
+   111                  } else {
+>  112                      window.location.assign(document.referrer || '/')
+   113                  }
+   114              }
+   115
+   116              // in tree mode set the parent of every clone, which can only be
+```
+
+Diff near the line:
+
+```diff
+@@ -104,11 +105,44 @@ export function pageTestplansCloneReadyHandler () {
+                 return
+             }
+
+-            if (newPlanIds.length === 1) {
+-                window.location.assign(`/plan/${newPlanIds[0]}/`)
+-            } else {
+-                window.location.assign(document.referrer || '/')
++            const redirectToClonedPlan = function () {
++                if (isTree || newPlanIds.length === 1) {
++                    window.location.assign(`/plan/${newPlanIds[0]}/`)
++                } else {
++                    window.location.assign(document.referrer || '/')
++                }
+             }
++
++            // in tree mode set the parent of every clone, which can only be
++            // done once all of the clones have been created.
++            if (isTree) {
++                let updatedCount = 0
++
++                const updateIsDone = function () {
++                    updatedCount += 1
++
++                    if (updatedCount === rows.length) {
++                        redirectToClonedPlan()
++                    }
++                }
++
++                rows.each(function () {
++                    const row = $(this)
++
++                    jsonRPC(
++                        'TestPlan.update',
++                        [
++                            clonedPlanIds[row.data('plan-id')],
++                            { parent: clonedPlanIds[row.attr('data-parent-id')] }
++                        ],
++                        updateIsDone
++                    )
+... (10 more lines)
+```
+
+## 13. hoppscotch: `CG-PERF-101` (edited)
+
+- Commit: [9861ee84ad](https://github.com/hoppscotch/hoppscotch/commit/9861ee84ad593372885ebfc7cb1c487f3b9dd290), file `packages/hoppscotch-desktop/src/services/persistence.service.ts`
+- Truth: **known (edited)**, old line 112, new line 294
+- Schemes that disagree with the truth: `codeguard` (false_new), `github` (false_new), `line_text` (false_new), `sonar` (false_new)
+
+Before:
+
+```
+   108
+   109      if (currentVersion !== targetVersion) {
+   110        for (const migration of migrations) {
+   111          if (migration.version > parseInt(currentVersion)) {
+>  112            await migration.migrate()
+   113          }
+   114        }
+   115
+   116        await Store.set(STORE_NAMESPACE, STORE_KEYS.SCHEMA_VERSION, targetVersion)
+```
+After:
+
+```
+   290      }
+   291
+   292      for (const migration of migrations) {
+   293        if (migration.version > parseInt(currentVersion, 10)) {
+>  294          const result = await migration.migrate()
+   295          if (E.isLeft(result)) {
+   296            return result
+   297          }
+   298        }
+```
+
+Diff near the line:
+
+```diff
+@@ -87,176 +216,150 @@ export class DesktopPersistenceService {
+   async init(): Promise<E.Either<StoreError, void>> {
+     const initResult = await Store.init()
+     if (E.isLeft(initResult)) {
+-      console.error(
+-        "[PersistenceService] Failed to initialize store:",
+-        initResult.left
+-      )
++      Log.error(LOG_TAG, "Failed to initialize store", initResult.left)
+       return initResult
+     }
+-    await this.runMigrations()
+-    return initResult
+-  }
+-
+-  private async runMigrations() {
+-    const versionResult = await Store.get<string>(
+-      STORE_NAMESPACE,
+-      STORE_KEYS.SCHEMA_VERSION
+-    )
+-    const perhapsVersion = E.isRight(versionResult) ? versionResult.right : "1"
+-    const currentVersion = perhapsVersion ?? "1"
+-    const targetVersion = "1"
+-
+-    if (currentVersion !== targetVersion) {
+-      for (const migration of migrations) {
+-        if (migration.version > parseInt(currentVersion)) {
+-          await migration.migrate()
+-        }
+-      }
+-
+-      await Store.set(STORE_NAMESPACE, STORE_KEYS.SCHEMA_VERSION, targetVersion)
++    const migrationResult = await this.runMigrations()
++    if (E.isLeft(migrationResult)) {
++      return migrationResult
+     }
++    await this.setupRustSync()
++    return E.right(undefined)
+   }
+
+... (259 more lines)
+```
+
+## 14. uptime-kuma: `CG-SEC-105` (edited)
+
+- Commit: [4e7c4ae382](https://github.com/louislam/uptime-kuma/commit/4e7c4ae382f4038369922a7981babba43403ff1c), file `test/backend-test/test-migration-v2-to-v3.ts`
+- Truth: **known (edited)**, old line 17, new line 21
+- Schemes that disagree with the truth: `github` (false_new), `line_text` (false_new), `sonar` (false_new)
+
+Before:
+
+```
+    13  const fixturePath = path.join(__dirname, "../fixtures/v2-kuma.db.gz");
+    14  const dataDir = path.join(__dirname, "../../data/test-migration-v2-upgrade");
+    15
+    16  const username = "admin";
+>   17  const password = "Kuma-V2-Test-Password";
+    18
+    19  /**
+    20   * Get a free TCP port from the OS.
+    21   * @returns {Promise<number>} A free port
+```
+After:
+
+```
+    17
+    18  const username = "admin";
+    19
+    20  // A password that Have I Been Pwned reports as breached, to cover the migration path from #7946.
+>   21  const password = "Admin123!x";
+    22
+    23  /**
+    24   * Get a free TCP port from the OS.
+    25   * @returns {Promise<number>} A free port
+```
+
+Diff near the line:
+
+```diff
+@@ -7,6 +7,8 @@ import zlib from "node:zlib";
+ import { spawn } from "node:child_process";
+ import { fileURLToPath } from "node:url";
+ import { io } from "socket.io-client";
++import BetterSqlite3 from "better-sqlite3";
++import bcrypt from "bcryptjs";
+
+ const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+@@ -14,7 +16,9 @@ const fixturePath = path.join(__dirname, "../fixtures/v2-kuma.db.gz");
+ const dataDir = path.join(__dirname, "../../data/test-migration-v2-upgrade");
+
+ const username = "admin";
+-const password = "Kuma-V2-Test-Password";
++
++// A password that Have I Been Pwned reports as breached, to cover the migration path from #7946.
++const password = "Admin123!x";
+
+ /**
+  * Get a free TCP port from the OS.
+```
+
+## 15. calcom: `CG-QUAL-103` (edited)
+
+- Commit: [ab21c7f805](https://github.com/calcom/cal.com/commit/ab21c7f805a089fa3a11ffd61c4a9aecc349c16c), file `packages/features/bookings/lib/payment/handleNoShowFee.ts`
+- Truth: **known (edited)**, old line 21, new line 19
+- Schemes that disagree with the truth: `line_text` (false_new)
+
+Before:
+
+```
+    17  import type { Prisma } from "@calcom/prisma/client";
+    18  import type { CalendarEvent } from "@calcom/types/Calendar";
+    19  import type { IAbstractPaymentService } from "@calcom/types/PaymentService";
+    20
+>   21  export const handleNoShowFee = async ({
+    22    booking,
+    23    payment,
+    24  }: {
+    25    booking: {
+```
+After:
+
+```
+    15  import type { Prisma } from "@calcom/prisma/client";
+    16  import type { CalendarEvent } from "@calcom/types/Calendar";
+    17  import type { IAbstractPaymentService } from "@calcom/types/PaymentService";
+    18
+>   19  export const handleNoShowFee= async ({
+    20    booking,
+    21    payment,
+    22  }: {
+    23    booking: {
+```
+
+Diff near the line:
+
+```diff
+@@ -3,12 +3,10 @@ import { eventTypeMetaDataSchemaWithTypedApps } from "@calcom/app-store/zod-util
+ import dayjs from "@calcom/dayjs";
+ import { sendNoShowFeeChargedEmail } from "@calcom/emails/billing-email-service";
+ import { CredentialRepository } from "@calcom/features/credentials/repositories/CredentialRepository";
+-import { TeamRepository } from "@calcom/features/ee/teams/repositories/TeamRepository";
+ import {
+   type EventTypeBrandingData,
+   getEventTypeService,
+ } from "@calcom/features/eventtypes/di/EventTypeService.container";
+-import { MembershipRepository } from "@calcom/features/membership/repositories/MembershipRepository";
+ import { ErrorCode } from "@calcom/lib/errorCodes";
+ import { ErrorWithCode } from "@calcom/lib/errors";
+ import logger from "@calcom/lib/logger";
+@@ -18,7 +16,7 @@ import type { Prisma } from "@calcom/prisma/client";
+ import type { CalendarEvent } from "@calcom/types/Calendar";
+ import type { IAbstractPaymentService } from "@calcom/types/PaymentService";
+
+-export const handleNoShowFee = async ({
++export const handleNoShowFee= async ({
+   booking,
+   payment,
+ }: {
+```
+
+## 16. hedgedoc: `CG-PERF-101` (edited)
+
+- Commit: [c2ccf48c39](https://github.com/hedgedoc/hedgedoc/commit/c2ccf48c3966608f7292c6818d1b95469aa1b3cd), file `backend/src/api/public/notes/notes.controller.ts`
+- Truth: **known (edited)**, old line 134, new line 134
+- Schemes that disagree with the truth: `codeguard` (false_new), `github` (false_new), `line_text` (false_new)
+
+Before:
+
+```
+   130      for (const mediaUpload of mediaUploads) {
+   131        if (!noteMediaDeletionDto.keepMedia) {
+   132          await this.mediaService.deleteFile(mediaUpload);
+   133        } else {
+>  134          await this.mediaService.removeNoteFromMediaUpload(mediaUpload);
+   135        }
+   136      }
+   137      this.logger.debug(`Deleting note: ${noteId}`, 'deleteNote');
+   138      await this.noteService.deleteNote(noteId);
+```
+After:
+
+```
+   130      for (const mediaUpload of mediaUploads) {
+   131        if (!noteMediaDeletionDto.keepMedia) {
+   132          await this.mediaService.deleteFile(mediaUpload);
+   133        } else {
+>  134          await this.mediaService.removeNoteFromMediaUpload(mediaUpload, noteId);
+   135        }
+   136      }
+   137      this.logger.debug(`Deleting note: ${noteId}`, 'deleteNote');
+   138      await this.noteService.deleteNote(noteId);
+```
+
+Diff near the line:
+
+```diff
+@@ -131,7 +131,7 @@ export class NotesController {
+       if (!noteMediaDeletionDto.keepMedia) {
+         await this.mediaService.deleteFile(mediaUpload);
+       } else {
+-        await this.mediaService.removeNoteFromMediaUpload(mediaUpload);
++        await this.mediaService.removeNoteFromMediaUpload(mediaUpload, noteId);
+       }
+     }
+     this.logger.debug(`Deleting note: ${noteId}`, 'deleteNote');
+
+```
+
+## 17. warehouse: `CG-SEC-103` (edited)
+
+- Commit: [7320d9052b](https://github.com/pypi/warehouse/commit/7320d9052b59a7e3b1c2122034396f5d339cd3e0), file `tests/frontend/filter_list_controller_test.js`
+- Truth: **known (edited)**, old line 39, new line 101
+- Schemes that disagree with the truth: `codeguard` (false_new), `github` (false_new), `line_text` (false_new), `sonar` (false_new)
+
+Before:
+
+```
+    35    describe("is initialized as expected", () => {
+    36      describe("makes expected elements visible", () => {
+    37        let application;
+    38        beforeEach(() => {
+>   39          document.body.innerHTML = `
+    40        <div id="controller" data-controller="filter-list">
+    41          ${testFixtureHTMLVisibilityToggle}
+    42        </div>
+    43        `;
+```
+After:
+
+```
+    97      expect(Array.from(filterMyAttr.options).map(option => [option.value, option.selected])).toEqual(values);
+    98    };
+    99    const appStart = async function () {
+   100      const div = document.createElement("div");
+>  101      div.innerHTML = `
+   102        <div id="controller" data-controller="filter-list">
+   103          ${testFixtureHTMLVisibilityToggle}
+   104          ${testFixtureHTMLShowing}
+   105          ${testFixtureHTMLFilters}
+```
+
+Diff near the line:
+
+```diff
+@@ -5,226 +5,424 @@
+
+ import {Application} from "@hotwired/stimulus";
+ import FilterListController from "../../warehouse/static/js/warehouse/controllers/filter_list_controller";
++import {delay} from "./utils";
+
+
+ const testFixtureHTMLVisibilityToggle = `
+-<p id="initial-toggle-visibility-shown" class="hidden initial-toggle-visibility">Initially hidden, should end up shown.</p>
+-<p id="initial-toggle-visibility-hidden" class="initial-toggle-visibility">Initially shown, should end up hidden.</p>
++<p id="initial-toggle-visibility-shown" class="hidden initial-toggle-visibility">
++    Initially hidden, should end up shown.
++</p>
++<p id="initial-toggle-visibility-hidden" class="initial-toggle-visibility">
++    Initially shown, should end up hidden.
++</p>
+ `;
+ const testFixtureHTMLShowing = `
+ <p id="shown-and-total" data-filter-list-target="summary"></p>
+ `;
+ const testFixtureHTMLFilters = `
+-<input id="filter-input" type="text" data-action="filter-list#filter" data-filter-list-target="filter" data-filtered-source="contentType">
+-        <select id="filter-select"  data-action="filter-list#filter" data-filter-list-target="filter" data-filtered-source="myattr">
+-          <option selected value="">My Attrs</option>
+-          <option value="myattr1">myattr 1</option>
+-          <option value="myattr2">myattr 2</option>
+-          <option value="myattr3">myattr 3</option>
+-        </select>
++<input id="filter-input-description" type="text" data-action="filter-list#filter"
++    data-filter-list-target="filter" data-filtered-source="description" data-comparison-type="includes"
++    data-auto-update-url-querystring="false">
++<select id="filter-select-myattr" data-action="filter-list#filter"
++    data-filter-list-target="filter" data-filtered-source="myattr" data-comparison-type="exact"
++    data-auto-update-url-querystring="true">
++  <option value="" selected>My Attrs</option>
++  <option value="myattr1">myattr 1</option>
++  <option value="myattr2">myattr 2</option>
++  <option value="myattr3">myattr 3</option>
++</select>
++<select id="filter-select-contentType" data-action="filter-list#filter"
+... (557 more lines)
+```
+
+## 18. pgadmin: `CG-QUAL-101` (edited)
+
+- Commit: [5f56805162](https://github.com/pgadmin-org/pgadmin4/commit/5f56805162c117ac1de17368ef8fdc0b07221e2c), file `web/pgadmin/tools/sqleditor/static/js/components/QueryToolComponent.jsx`
+- Truth: **known (edited)**, old line 813, new line 872
+- Schemes that disagree with the truth: `codeguard` (false_new), `github` (false_new), `line_text` (false_new), `sonar` (false_new)
+
+Before:
+
+```
+   809            let existIdx = _.findIndex(qtState.connection_list, (conn)=>{
+   810              conn.role= conn.role == ''? null :conn.role;
+   811              return(
+   812                conn.sid == connectionData.sid  && conn.database_name == connectionData.database_name
+>  813                && conn.user == connectionData.user && conn.role == connectionData.role
+   814              );
+   815            });
+   816            if(existIdx > -1) {
+   817              reject(new Error(gettext('Connection with this configuration already present.')));
+```
+After:
+
+```
+   868
+   869            let existIdx = _.findIndex(qtState.connection_list, (conn)=>{
+   870              return(
+   871                conn.sid == connectionData.sid  && conn.database_name == connectionData.database_name
+>  872                && conn.user == connectionData.user && (conn.role || null) == (connectionData.role || null)
+   873              );
+   874            });
+   875            if(existIdx > -1) {
+   876              reject(new Error(gettext('Connection with this configuration already present.')));
+```
+
+Diff near the line:
+
+```diff
+@@ -807,10 +867,9 @@ export default function QueryToolComponent({params, pgWindow, pgAdmin, selectedN
+           };
+
+           let existIdx = _.findIndex(qtState.connection_list, (conn)=>{
+-            conn.role= conn.role == ''? null :conn.role;
+             return(
+               conn.sid == connectionData.sid  && conn.database_name == connectionData.database_name
+-              && conn.user == connectionData.user && conn.role == connectionData.role
++              && conn.user == connectionData.user && (conn.role || null) == (connectionData.role || null)
+             );
+           });
+           if(existIdx > -1) {
+@@ -818,11 +877,12 @@ export default function QueryToolComponent({params, pgWindow, pgAdmin, selectedN
+             return;
+           }
+           updateQueryToolConnection(connectionData, true)
+-            .catch((err)=>{
+-              reject(err instanceof Error ? err : Error(gettext('Something went wrong')));
+-            }).then(()=>{
++            .then(()=>{
+               resolve();
+               onClose();
++            })
++            .catch((err)=>{
++              reject(err instanceof Error ? err : Error(gettext('Something went wrong')));
+             });
+         });
+       }}
+```
+
+## 19. indico: `CG-QUAL-003` (edited)
+
+- Commit: [4c706171e6](https://github.com/indico/indico/commit/4c706171e684907abb2a5a032d81be1c10f919b0), file `indico/modules/events/registration/util.py`
+- Truth: **known (edited)**, old line 596, new line 596
+- Schemes that disagree with the truth: `codeguard` (false_new), `github` (false_new), `line_text` (false_new), `sonar` (false_new)
+
+Before:
+
+```
+   592          for item in regform_items if item.input_type == 'date'
+   593      }
+   594
+   595
+>  596  def generate_spreadsheet_from_registrations(registrations, regform_items, static_items):
+   597      """Generate a spreadsheet data from a given registration list.
+   598
+   599      :param registrations: The list of registrations to include in the file
+   600      :param regform_items: The registration form items to be used as columns
+```
+After:
+
+```
+   592          for item in regform_items if item.input_type == 'date'
+   593      }
+   594
+   595
+>  596  def generate_spreadsheet_from_registrations(registrations, regform_items, static_items, extra_columns=()):
+   597      """Generate a spreadsheet data from a given registration list.
+   598
+   599      :param registrations: The list of registrations to include in the file
+   600      :param regform_items: The registration form items to be used as columns
+```
+
+Diff near the line:
+
+```diff
+@@ -593,12 +593,13 @@ def get_registration_spreadsheet_column_formats(regform_items):
+     }
+
+
+-def generate_spreadsheet_from_registrations(registrations, regform_items, static_items):
++def generate_spreadsheet_from_registrations(registrations, regform_items, static_items, extra_columns=()):
+     """Generate a spreadsheet data from a given registration list.
+
+     :param registrations: The list of registrations to include in the file
+     :param regform_items: The registration form items to be used as columns
+     :param static_items: Registration form information as extra columns
++    :param extra_columns: Custom list items from the `registrant_list_items` signal
+     """
+     field_names = ['ID', 'Name']
+     special_item_mapping = {
+```
+
+## 20. edx-platform: `CG-SEC-013` (edited)
+
+- Commit: [b3f862e61a](https://github.com/openedx/edx-platform/commit/b3f862e61aa84a5f8c027081b7d1a07a8619917d), file `cms/djangoapps/contentstore/api/views/course_import.py`
+- Truth: **known (edited)**, old line 142, new line 145
+- Schemes that disagree with the truth: `line_text` (false_new)
+
+Before:
+
+```
+   138              if not course_dir.isdir():
+   139                  os.mkdir(course_dir)
+   140
+   141              log.debug(f'importing course to {temp_filepath}')
+>  142              with open(temp_filepath, "wb+") as temp_file:
+   143                  for chunk in request.FILES['course_data'].chunks():
+   144                      temp_file.write(chunk)
+   145
+   146              log.info("Course import %s: Upload complete", course_key)
+```
+After:
+
+```
+   141              os.makedirs(course_dir, exist_ok=True)
+   142
+   143              try:
+   144                  log.debug(f'importing course to {temp_filepath}')
+>  145                  with open(temp_filepath, "wb+") as temp_file:
+   146                      for chunk in request.FILES['course_data'].chunks():
+   147                          temp_file.write(chunk)
+   148
+   149                  log.info("Course import %s: Upload complete", course_key)
+```
+
+Diff near the line:
+
+```diff
+@@ -131,22 +134,26 @@ class CourseImportView(CourseImportExportViewMixin, GenericAPIView):
+                     developer_message='Parameter in the wrong format',
+                     error_code='internal_error',
+                 )
+-            course_dir = path(settings.GITHUB_REPO_ROOT) / base64.urlsafe_b64encode(
+-                repr(course_key).encode('utf-8')
+-            ).decode('utf-8')
++            # Staging directory private to this upload, so that a concurrent import of
++            # the same course cannot overwrite this archive or delete it on its way out.
++            course_dir = course_import_working_dir(course_key, f'upload-{uuid4().hex}')
+             temp_filepath = course_dir / filename
+-            if not course_dir.isdir():
+-                os.mkdir(course_dir)
+-
+-            log.debug(f'importing course to {temp_filepath}')
+-            with open(temp_filepath, "wb+") as temp_file:
+-                for chunk in request.FILES['course_data'].chunks():
+-                    temp_file.write(chunk)
+-
+-            log.info("Course import %s: Upload complete", course_key)
+-            with open(temp_filepath, 'rb') as local_file:
+-                django_file = File(local_file)
+-                storage_path = course_import_export_storage.save('olx_import/' + filename, django_file)
++            os.makedirs(course_dir, exist_ok=True)
++
++            try:
++                log.debug(f'importing course to {temp_filepath}')
++                with open(temp_filepath, "wb+") as temp_file:
++                    for chunk in request.FILES['course_data'].chunks():
++                        temp_file.write(chunk)
++
++                log.info("Course import %s: Upload complete", course_key)
++                with open(temp_filepath, 'rb') as local_file:
++                    django_file = File(local_file)
++                    storage_path = course_import_export_storage.save('olx_import/' + filename, django_file)
++            finally:
++                # The archive now lives in storage; the import task downloads it into its
++                # own working directory, so this staging copy is no longer needed.
++                remove_course_import_working_dir(course_dir)
+
+... (3 more lines)
+```
+
+## 21. calcom: `CG-SEC-105` (known_but_new)
+
+- Commit: [ab21c7f805](https://github.com/calcom/cal.com/commit/ab21c7f805a089fa3a11ffd61c4a9aecc349c16c), file `packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts`
+- Truth: **known (equal)**, old line 1370, new line 1704
+- Schemes that disagree with the truth: `codeguard` (false_new), `github` (false_new), `line_text` (mispaired)
+
+Before:
+
+```
+  1366                    {
+  1367                      type: appStoreMetadata.dailyvideo.type,
+  1368                      uid: "MOCK_ID",
+  1369                      meetingId: "MOCK_ID",
+> 1370                      meetingPassword: "MOCK_PASS",
+  1371                      meetingUrl: "http://mock-dailyvideo.example.com",
+  1372                    },
+  1373                    {
+  1374                      type: appStoreMetadata.googlecalendar.type,
+```
+After:
+
+```
+  1700                    {
+  1701                      type: appStoreMetadata.dailyvideo.type,
+  1702                      uid: "MOCK_ID",
+  1703                      meetingId: "MOCK_ID",
+> 1704                      meetingPassword: "MOCK_PASS",
+  1705                      meetingUrl: "http://mock-dailyvideo.example.com",
+  1706                    },
+  1707                    {
+  1708                      type: appStoreMetadata.googlecalendar.type,
+```
+
+## 22. documenso: `CG-SEC-105` (known_but_new)
+
+- Commit: [97835b8dbb](https://github.com/documenso/documenso/commit/97835b8dbb2ca24670c8a410972d949c982c8f61), file `packages/app-tests/e2e/envelope-editor-v2/envelope-fields.spec.ts`
+- Truth: **known (equal)**, old line 1000, new line 1149
+- Schemes that disagree with the truth: `codeguard` (false_new)
+
+Before:
+
+```
+   996    test('place and configure all 10 field types', async ({ page }) => {
+   997      const surface = await openEmbeddedEnvelopeEditor(page, {
+   998        envelopeType: 'TEMPLATE',
+   999        mode: 'edit',
+> 1000        tokenNamePrefix: 'e2e-embed-all-fields',
+  1001      });
+  1002      const result = await runAllFieldTypesFlow(surface);
+  1003
+  1004      await persistEmbeddedEnvelope(surface);
+```
+After:
+
+```
+  1145    test('place and configure all 10 field types', async ({ page }) => {
+  1146      const surface = await openEmbeddedEnvelopeEditor(page, {
+  1147        envelopeType: 'TEMPLATE',
+  1148        mode: 'edit',
+> 1149        tokenNamePrefix: 'e2e-embed-all-fields',
+  1150      });
+  1151      const result = await runAllFieldTypesFlow(surface);
+  1152
+  1153      await persistEmbeddedEnvelope(surface);
+```
+
+## 23. calcom: `CG-SEC-105` (known_but_new)
+
+- Commit: [ab21c7f805](https://github.com/calcom/cal.com/commit/ab21c7f805a089fa3a11ffd61c4a9aecc349c16c), file `packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts`
+- Truth: **known (equal)**, old line 2486, new line 3172
+- Schemes that disagree with the truth: `codeguard` (false_new), `line_text` (false_new)
+
+Before:
+
+```
+  2482                    {
+  2483                      type: appStoreMetadata.dailyvideo.type,
+  2484                      uid: "MOCK_ID",
+  2485                      meetingId: "MOCK_ID",
+> 2486                      meetingPassword: "MOCK_PASS",
+  2487                      meetingUrl: "http://mock-dailyvideo.example.com",
+  2488                      credentialId: null,
+  2489                    },
+  2490                    {
+```
+After:
+
+```
+  3168                    {
+  3169                      type: appStoreMetadata.dailyvideo.type,
+  3170                      uid: "MOCK_ID",
+  3171                      meetingId: "MOCK_ID",
+> 3172                      meetingPassword: "MOCK_PASS",
+  3173                      meetingUrl: "http://mock-dailyvideo.example.com",
+  3174                      credentialId: null,
+  3175                    },
+  3176                    {
+```
+
+## 24. calcom: `CG-SEC-105` (known_but_new)
+
+- Commit: [ab21c7f805](https://github.com/calcom/cal.com/commit/ab21c7f805a089fa3a11ffd61c4a9aecc349c16c), file `packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts`
+- Truth: **known (equal)**, old line 1260, new line 1594
+- Schemes that disagree with the truth: `codeguard` (false_new), `github` (false_new)
+
+Before:
+
+```
+  1256                        {
+  1257                          type: appStoreMetadata.dailyvideo.type,
+  1258                          uid: "MOCK_ID",
+  1259                          meetingId: "MOCK_ID",
+> 1260                          meetingPassword: "MOCK_PASS",
+  1261                          meetingUrl: "http://mock-dailyvideo.example.com",
+  1262                        },
+  1263                        {
+  1264                          type: appStoreMetadata.googlecalendar.type,
+```
+After:
+
+```
+  1590                        {
+  1591                          type: appStoreMetadata.dailyvideo.type,
+  1592                          uid: "MOCK_ID",
+  1593                          meetingId: "MOCK_ID",
+> 1594                          meetingPassword: "MOCK_PASS",
+  1595                          meetingUrl: "http://mock-dailyvideo.example.com",
+  1596                        },
+  1597                        {
+  1598                          type: appStoreMetadata.googlecalendar.type,
+```
+
+## 25. openlibrary: `CG-SEC-001` (known_but_new)
+
+- Commit: [f5aff19fb7](https://github.com/internetarchive/openlibrary/commit/f5aff19fb7d0c27f3bb91f08db81a8750bae604a), file `openlibrary/tests/core/test_bookshelves_events_async.py`
+- Truth: **known (equal)**, old line 48, new line 136
+- Schemes that disagree with the truth: `codeguard` (false_new)
+
+Before:
+
+```
+    44                      "VALUES (%(u)s, %(w)s, %(e)s, %(t)s, %(d)s)",
+    45                      {"u": "alice", "w": work_id, "e": 1, "t": BookshelfEvent.FINISH, "d": "2026-05-01"},
+    46                  )
+    47              # Duplicate on 101 stays distinct. START and 2025 rows must not count.
+>   48              await conn.execute(
+    49                  f"INSERT INTO {BookshelvesEvents.TABLENAME} (username, work_id, edition_id, event_type, event_date) VALUES (%(u)s, %(w)s, %(e)s, %(t)s, %(d)s)",
+    50                  {"u": "alice", "w": 101, "e": 1, "t": BookshelfEvent.FINISH, "d": "2026-06-01"},
+    51              )
+    52              await conn.execute(
+```
+After:
+
+```
+   132                      "VALUES (%(u)s, %(w)s, %(e)s, %(t)s, %(d)s)",
+   133                      {"u": "alice", "w": work_id, "e": 1, "t": BookshelfEvent.FINISH, "d": "2026-05-01"},
+   134                  )
+   135              # Duplicate on 101 stays distinct. START and 2025 rows must not count.
+>  136              await conn.execute(
+   137                  f"INSERT INTO {BookshelvesEvents.TABLENAME} (username, work_id, edition_id, event_type, event_date) VALUES (%(u)s, %(w)s, %(e)s, %(t)s, %(d)s)",
+   138                  {"u": "alice", "w": 101, "e": 1, "t": BookshelfEvent.FINISH, "d": "2026-06-01"},
+   139              )
+   140              await conn.execute(
+```
+
+## 26. calcom: `CG-SEC-105` (known_but_new)
+
+- Commit: [ab21c7f805](https://github.com/calcom/cal.com/commit/ab21c7f805a089fa3a11ffd61c4a9aecc349c16c), file `packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts`
+- Truth: **known (equal)**, old line 1395, new line 1728
+- Schemes that disagree with the truth: `codeguard` (false_new), `line_text` (false_new)
+
+Before:
+
+```
+  1391                bookingRef: {
+  1392                  type: appStoreMetadata.dailyvideo.type,
+  1393                  uid: "MOCK_ID",
+  1394                  meetingId: "MOCK_ID",
+> 1395                  meetingPassword: "MOCK_PASS",
+  1396                  meetingUrl: "http://mock-dailyvideo.example.com",
+  1397                },
+  1398              });
+  1399
+```
+After:
+
+```
+  1724                bookingRef: {
+  1725                  type: appStoreMetadata.dailyvideo.type,
+  1726                  uid: "MOCK_ID",
+  1727                  meetingId: "MOCK_ID",
+> 1728                  meetingPassword: "MOCK_PASS",
+  1729                  meetingUrl: "http://mock-dailyvideo.example.com",
+  1730                },
+  1731              });
+  1732
+```
+
+## 27. kitsune: `CG-QUAL-104` (known_but_new)
+
+- Commit: [59b6937db5](https://github.com/mozilla/kitsune/commit/59b6937db573505c764bec9c87bd786981848487), file `kitsune/sumo/static/sumo/js/markup.js`
+- Truth: **known (equal)**, old line 965, new line 969
+- Schemes that disagree with the truth: `codeguard` (false_new)
+
+Before:
+
+```
+   961        });
+   962      }
+   963
+   964      function loadCannedResponses() {
+>  965        var siteLanguage = window.location.pathname.split("/")[1];
+   966        var targetUrl = "/" + siteLanguage + cannedResponsesUrl;
+   967
+   968        apiFetch(targetUrl, { method: "GET", dataType: "html" })
+   969          .then(function (responseHtml) {
+```
+After:
+
+```
+   965        });
+   966      }
+   967
+   968      function loadCannedResponses() {
+>  969        var siteLanguage = window.location.pathname.split("/")[1];
+   970        var targetUrl = "/" + siteLanguage + cannedResponsesUrl;
+   971
+   972        apiFetch(targetUrl, { method: "GET", dataType: "html" })
+   973          .then(function (responseHtml) {
+```
+
+## 28. erpnext: `CG-PERF-002` (known_but_new)
+
+- Commit: [750bf9d9b3](https://github.com/frappe/erpnext/commit/750bf9d9b378fb92eab68733ae727214f3961c0a), file `erpnext/stock/utils.py`
+- Truth: **known (equal)**, old line 159, new line 185
+- Schemes that disagree with the truth: `codeguard` (false_new)
+
+Before:
+
+```
+   155  						frappe.bold(field), frappe.bold("Inventory Dimension")
+   156  					)
+   157  				)
+   158  			args[field] = value
+>  159  			extra_cond += f" and {field} = %({field})s"
+   160
+   161  	last_entry = get_previous_sle(args, extra_cond=extra_cond)
+   162
+   163  	if with_valuation_rate:
+```
+After:
+
+```
+   181  						frappe.bold(field), frappe.bold("Inventory Dimension")
+   182  					)
+   183  				)
+   184  			args[field] = value
+>  185  			extra_cond += f" and {field} = %({field})s"
+   186
+   187  	last_entry = get_previous_sle(args, extra_cond=extra_cond)
+   188
+   189  	if with_valuation_rate:
+```
+
+## 29. openlibrary: `CG-SEC-001` (known_but_new)
+
+- Commit: [f5aff19fb7](https://github.com/internetarchive/openlibrary/commit/f5aff19fb7d0c27f3bb91f08db81a8750bae604a), file `openlibrary/tests/core/test_bookshelves_events_async.py`
+- Truth: **known (equal)**, old line 52, new line 140
+- Schemes that disagree with the truth: `codeguard` (false_new)
+
+Before:
+
+```
+    48              await conn.execute(
+    49                  f"INSERT INTO {BookshelvesEvents.TABLENAME} (username, work_id, edition_id, event_type, event_date) VALUES (%(u)s, %(w)s, %(e)s, %(t)s, %(d)s)",
+    50                  {"u": "alice", "w": 101, "e": 1, "t": BookshelfEvent.FINISH, "d": "2026-06-01"},
+    51              )
+>   52              await conn.execute(
+    53                  f"INSERT INTO {BookshelvesEvents.TABLENAME} (username, work_id, edition_id, event_type, event_date) VALUES (%(u)s, %(w)s, %(e)s, %(t)s, %(d)s)",
+    54                  {"u": "alice", "w": 104, "e": 1, "t": BookshelfEvent.START, "d": "2026-05-01"},
+    55              )
+    56              await conn.execute(
+```
+After:
+
+```
+   136              await conn.execute(
+   137                  f"INSERT INTO {BookshelvesEvents.TABLENAME} (username, work_id, edition_id, event_type, event_date) VALUES (%(u)s, %(w)s, %(e)s, %(t)s, %(d)s)",
+   138                  {"u": "alice", "w": 101, "e": 1, "t": BookshelfEvent.FINISH, "d": "2026-06-01"},
+   139              )
+>  140              await conn.execute(
+   141                  f"INSERT INTO {BookshelvesEvents.TABLENAME} (username, work_id, edition_id, event_type, event_date) VALUES (%(u)s, %(w)s, %(e)s, %(t)s, %(d)s)",
+   142                  {"u": "alice", "w": 104, "e": 1, "t": BookshelfEvent.START, "d": "2026-05-01"},
+   143              )
+   144              await conn.execute(
+```
+
+## 30. calcom: `CG-SEC-105` (known_but_new)
+
+- Commit: [ab21c7f805](https://github.com/calcom/cal.com/commit/ab21c7f805a089fa3a11ffd61c4a9aecc349c16c), file `packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts`
+- Truth: **known (equal)**, old line 2622, new line 3308
+- Schemes that disagree with the truth: `codeguard` (false_new), `line_text` (false_new)
+
+Before:
+
+```
+  2618                    getMockBookingReference({
+  2619                      type: "google_calendar",
+  2620                      uid: "MOCK_ID",
+  2621                      meetingId: "MOCK_ID",
+> 2622                      meetingPassword: "MOCK_PASS",
+  2623                      meetingUrl: "http://mock-google-meet.example.com",
+  2624                      externalCalendarId: "MOCK_EXTERNAL_CALENDAR_ID",
+  2625                      credentialId: 1,
+  2626                    }),
+```
+After:
+
+```
+  3304                    getMockBookingReference({
+  3305                      type: "google_calendar",
+  3306                      uid: "MOCK_ID",
+  3307                      meetingId: "MOCK_ID",
+> 3308                      meetingPassword: "MOCK_PASS",
+  3309                      meetingUrl: "http://mock-google-meet.example.com",
+  3310                      externalCalendarId: "MOCK_EXTERNAL_CALENDAR_ID",
+  3311                      credentialId: 1,
+  3312                    }),
+```
+
+## 31. nodebb: `CG-SEC-105` (known_but_new)
+
+- Commit: [9d122948cf](https://github.com/NodeBB/NodeBB/commit/9d122948cf783fc72c8c01c7aab0f42b2561b3c3), file `test/user.js`
+- Truth: **known (equal)**, old line 2384, new line 2415
+- Schemes that disagree with the truth: `codeguard` (false_new)
+
+Before:
+
+```
+  2380  				const token = await db.get(`invitation:uid:${inviterUid}:invited:${email}`);
+  2381
+  2382  				const { body } = await helpers.registerUser({
+  2383  					username: 'invite5',
+> 2384  					password: '123456',
+  2385  					'password-confirm': '123456',
+  2386  					email: email,
+  2387  					gdpr_consent: true,
+  2388  					token: token,
+```
+After:
+
+```
+  2411  				const token = await db.get(`invitation:uid:${inviterUid}:invited:${email}`);
+  2412
+  2413  				const { body } = await helpers.registerUser({
+  2414  					username: 'invite5',
+> 2415  					password: '123456',
+  2416  					'password-confirm': '123456',
+  2417  					email: email,
+  2418  					gdpr_consent: true,
+  2419  					token: token,
+```
+
+## 32. lnbits: `CG-QUAL-102` (known_but_new)
+
+- Commit: [f5989201d9](https://github.com/lnbits/lnbits/commit/f5989201d9c21a4690334f91bbbb421214c989e7), file `lnbits/static/js/wasm-extension-component.js`
+- Truth: **known (equal)**, old line 904, new line 1126
+- Schemes that disagree with the truth: `codeguard` (false_new)
+
+Before:
+
+```
+   900        socket.addEventListener('message', event => {
+   901          let data = event.data
+   902          try {
+   903            data = JSON.parse(event.data)
+>  904          } catch (_error) {}
+   905
+   906          this.sendBridgeEvent({
+   907            event: 'payment.update',
+   908            subscriptionId,
+```
+After:
+
+```
+  1122        socket.addEventListener('message', event => {
+  1123          let data = event.data
+  1124          try {
+  1125            data = JSON.parse(event.data)
+> 1126          } catch (_error) {}
+  1127
+  1128          this.sendBridgeEvent({
+  1129            event: 'payment.update',
+  1130            subscriptionId,
+```
+
+## 33. erpnext: `CG-QUAL-101` (known_but_new)
+
+- Commit: [ddc764b360](https://github.com/frappe/erpnext/commit/ddc764b3608610fa659dd722da44e115850cc4da), file `erpnext/stock/doctype/material_request/material_request.js`
+- Truth: **known (equal)**, old line 810, new line 809
+- Schemes that disagree with the truth: `codeguard` (false_new)
+
+Before:
+
+```
+   806  				doc.material_request_type == "Purchase" ||
+   807  				doc.material_request_type == "Subcontracting"
+   808  			) {
+   809  				filters = { is_purchase_item: 1 };
+>  810  			} else if (doc.material_request_type == "Manufacture") {
+   811  				filters.include_item_in_manufacturing = 1;
+   812  			}
+   813
+   814  			return {
+```
+After:
+
+```
+   805  			} else if (doc.material_request_type == "Purchase") {
+   806  				filters = { is_purchase_item: 1 };
+   807  			} else if (doc.material_request_type == "Subcontracting") {
+   808  				filters = { is_stock_item: 1, is_sub_contracted_item: 1 };
+>  809  			} else if (doc.material_request_type == "Manufacture") {
+   810  				filters.include_item_in_manufacturing = 1;
+   811  			}
+   812
+   813  			return {
+```
+
+## 34. calcom: `CG-SEC-105` (known_but_new)
+
+- Commit: [ab21c7f805](https://github.com/calcom/cal.com/commit/ab21c7f805a089fa3a11ffd61c4a9aecc349c16c), file `packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts`
+- Truth: **known (equal)**, old line 2494, new line 3180
+- Schemes that disagree with the truth: `codeguard` (false_new), `github` (false_new), `line_text` (false_new)
+
+Before:
+
+```
+  2490                    {
+  2491                      type: appStoreMetadata.googlecalendar.type,
+  2492                      uid: "MOCK_ID",
+  2493                      meetingId: "MOCK_ID",
+> 2494                      meetingPassword: "MOCK_PASSWORD",
+  2495                      meetingUrl: "https://UNUSED_URL",
+  2496                      externalCalendarId: "MOCK_EXTERNAL_CALENDAR_ID",
+  2497                      credentialId: undefined,
+  2498                    },
+```
+After:
+
+```
+  3176                    {
+  3177                      type: appStoreMetadata.googlecalendar.type,
+  3178                      uid: "MOCK_ID",
+  3179                      meetingId: "MOCK_ID",
+> 3180                      meetingPassword: "MOCK_PASSWORD",
+  3181                      meetingUrl: "https://UNUSED_URL",
+  3182                      externalCalendarId: "MOCK_EXTERNAL_CALENDAR_ID",
+  3183                      credentialId: undefined,
+  3184                    },
+```
+
+## 35. arches: `CG-QUAL-104` (known_but_new)
+
+- Commit: [2e02ce6e61](https://github.com/archesproject/arches/commit/2e02ce6e61999d93c10b05d853ae08f1912fa294), file `arches/app/media/js/views/graph/permission-manager/permission-settings-form.js`
+- Truth: **known (equal)**, old line 128, new line 210
+- Schemes that disagree with the truth: `codeguard` (false_new), `github` (false_new), `line_text` (false_new)
+
+Before:
+
+```
+   124          });
+   125      },
+   126
+   127      revert: function() {
+>  128          var self = this;
+   129          var postData = {
+   130              'selectedIdentities': this.selectedIdentities(),
+   131              'selectedCards': this.selectedCards()
+   132          };
+```
+After:
+
+```
+   206              });
+   207      },
+   208
+   209      revert: function() {
+>  210          var self = this;
+   211          if (!this.canSubmit()) {
+   212              return;
+   213          }
+   214          var confirm = arches.translations.graphDesignerPermissionsResetConfirm;
+```
+
+## 36. nodebb: `CG-SEC-105` (known_but_new)
+
+- Commit: [9d122948cf](https://github.com/NodeBB/NodeBB/commit/9d122948cf783fc72c8c01c7aab0f42b2561b3c3), file `test/user.js`
+- Truth: **known (equal)**, old line 1999, new line 2030
+- Schemes that disagree with the truth: `codeguard` (mispaired), `line_text` (mispaired), `sonar` (false_new)
+
+Before:
+
+```
+  1995
+  1996  		it('should fail to add user to queue if username is taken', async () => {
+  1997  			const { body } = await helpers.registerUser({
+  1998  				username: 'rejectme',
+> 1999  				password: '123456',
+  2000  				'password-confirm': '123456',
+  2001  				email: '<script>alert("ok")<script>reject@me.com',
+  2002  				gdpr_consent: true,
+  2003  			});
+```
+After:
+
+```
+  2026
+  2027  		it('should fail to add user to queue if username is taken', async () => {
+  2028  			const { body } = await helpers.registerUser({
+  2029  				username: 'rejectme',
+> 2030  				password: '123456',
+  2031  				'password-confirm': '123456',
+  2032  				email: '<script>alert("ok")<script>reject@me.com',
+  2033  				gdpr_consent: true,
+  2034  			});
+```
+
+## 37. calcom: `CG-SEC-105` (known_but_new)
+
+- Commit: [ab21c7f805](https://github.com/calcom/cal.com/commit/ab21c7f805a089fa3a11ffd61c4a9aecc349c16c), file `packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts`
+- Truth: **known (equal)**, old line 1267, new line 1601
+- Schemes that disagree with the truth: `codeguard` (false_new)
+
+Before:
+
+```
+  1263                        {
+  1264                          type: appStoreMetadata.googlecalendar.type,
+  1265                          uid: "MOCK_ID",
+  1266                          meetingId: "MOCK_ID",
+> 1267                          meetingPassword: "MOCK_PASSWORD",
+  1268                          meetingUrl: "https://UNUSED_URL",
+  1269                          externalCalendarId: "existing-event-type@example.com",
+  1270                          credentialId: undefined,
+  1271                        },
+```
+After:
+
+```
+  1597                        {
+  1598                          type: appStoreMetadata.googlecalendar.type,
+  1599                          uid: "MOCK_ID",
+  1600                          meetingId: "MOCK_ID",
+> 1601                          meetingPassword: "MOCK_PASSWORD",
+  1602                          meetingUrl: "https://UNUSED_URL",
+  1603                          externalCalendarId: "existing-event-type@example.com",
+  1604                          credentialId: undefined,
+  1605                        },
+```
+
+## 38. nodebb: `CG-SEC-105` (known_but_new)
+
+- Commit: [b8d9cf9d1e](https://github.com/NodeBB/NodeBB/commit/b8d9cf9d1ee03115d28b3548911e9076a275311a), file `test/user.js`
+- Truth: **known (equal)**, old line 2318, new line 2335
+- Schemes that disagree with the truth: `codeguard` (false_new)
+
+Before:
+
+```
+  2314  				const token = await db.get(`invitation:uid:${inviterUid}:invited:${email}`);
+  2315
+  2316  				const { body } = await helpers.registerUser({
+  2317  					username: 'invite5',
+> 2318  					password: '123456',
+  2319  					'password-confirm': '123456',
+  2320  					email: email,
+  2321  					gdpr_consent: true,
+  2322  					token: token,
+```
+After:
+
+```
+  2331  				const token = await db.get(`invitation:uid:${inviterUid}:invited:${email}`);
+  2332
+  2333  				const { body } = await helpers.registerUser({
+  2334  					username: 'invite5',
+> 2335  					password: '123456',
+  2336  					'password-confirm': '123456',
+  2337  					email: email,
+  2338  					gdpr_consent: true,
+  2339  					token: token,
+```
+
+## 39. nodebb: `CG-SEC-105` (known_but_new)
+
+- Commit: [331599fe89](https://github.com/NodeBB/NodeBB/commit/331599fe89bed8c8ae80199efafeee9e81f72dbf), file `test/topics/crossposts.js`
+- Truth: **known (equal)**, old line 660, new line 678
+- Schemes that disagree with the truth: `codeguard` (false_new), `github` (false_new), `line_text` (false_new)
+
+Before:
+
+```
+   656  			});
+   657
+   658  			it('should send an Announce to the topic author when crossposted to a local category', async () => {
+   659  				const username = utils.generateUUID().slice(0, 8);
+>  660  				const crossposter = await user.create({ username, password: '123456' });
+   661  				const login = await helpers.loginUser(username, '123456');
+   662  				activitypub._sent.clear();
+   663
+   664  				const crosspostCid = (await categories.create({ name: utils.generateUUID().slice(0, 8) })).cid;
+```
+After:
+
+```
+   674  			});
+   675
+   676  			it('should send an Announce to the topic author when crossposted to a local category', async () => {
+   677  				const username = utils.generateUUID().slice(0, 8);
+>  678  				const crossposter = await user.create({ username, password: '123456' });
+   679  				const login = await helpers.loginUser(username, '123456');
+   680  				activitypub._sent.clear();
+   681
+   682  				const crosspostCid = (await categories.create({ name: utils.generateUUID().slice(0, 8) })).cid;
+```
+
+## 40. openlibrary: `CG-SEC-001` (known_but_new)
+
+- Commit: [f5aff19fb7](https://github.com/internetarchive/openlibrary/commit/f5aff19fb7d0c27f3bb91f08db81a8750bae604a), file `openlibrary/tests/core/test_bookshelves_events_async.py`
+- Truth: **known (equal)**, old line 56, new line 144
+- Schemes that disagree with the truth: `codeguard` (false_new)
+
+Before:
+
+```
+    52              await conn.execute(
+    53                  f"INSERT INTO {BookshelvesEvents.TABLENAME} (username, work_id, edition_id, event_type, event_date) VALUES (%(u)s, %(w)s, %(e)s, %(t)s, %(d)s)",
+    54                  {"u": "alice", "w": 104, "e": 1, "t": BookshelfEvent.START, "d": "2026-05-01"},
+    55              )
+>   56              await conn.execute(
+    57                  f"INSERT INTO {BookshelvesEvents.TABLENAME} (username, work_id, edition_id, event_type, event_date) VALUES (%(u)s, %(w)s, %(e)s, %(t)s, %(d)s)",
+    58                  {"u": "alice", "w": 105, "e": 1, "t": BookshelfEvent.FINISH, "d": "2025-05-01"},
+    59              )
+    60
+```
+After:
+
+```
+   140              await conn.execute(
+   141                  f"INSERT INTO {BookshelvesEvents.TABLENAME} (username, work_id, edition_id, event_type, event_date) VALUES (%(u)s, %(w)s, %(e)s, %(t)s, %(d)s)",
+   142                  {"u": "alice", "w": 104, "e": 1, "t": BookshelfEvent.START, "d": "2026-05-01"},
+   143              )
+>  144              await conn.execute(
+   145                  f"INSERT INTO {BookshelvesEvents.TABLENAME} (username, work_id, edition_id, event_type, event_date) VALUES (%(u)s, %(w)s, %(e)s, %(t)s, %(d)s)",
+   146                  {"u": "alice", "w": 105, "e": 1, "t": BookshelfEvent.FINISH, "d": "2025-05-01"},
+   147              )
+   148
+```
+
+## 41. hoppscotch: `CG-PERF-101` (new_but_matched)
+
+- Commit: [803e4633a2](https://github.com/hoppscotch/hoppscotch/commit/803e4633a27be10d80e752d62bd0dab09ed2924a), file `packages/hoppscotch-backend/src/team-collection/team-collection.service.ts`
+- Truth: **new**, new line 131
+- Schemes that disagree with the truth: `codeguard` (false_known), `github` (false_known), `line_text` (false_known), `sonar` (false_known)
+
+After:
+
+```
+   127        },
+   128      });
+   129
+   130      for (const coll of childrenCollection) {
+>  131        const result = await this.exportCollectionToJSONObject(teamID, coll.id);
+   132        if (E.isLeft(result)) return E.left(result.left);
+   133
+   134        childrenCollectionObjects.push(result.right);
+   135      }
+```
+
+Diff near the line:
+
+```diff
+@@ -106,35 +106,32 @@ export class TeamCollectionService {
+    *
+    * @param teamID The Team ID
+    * @param collectionID The Collection ID
+-   * @param withChildren Whether to include child collections and their requests
+    * @returns A JSON string containing all the contents of a collection
+    */
+   async exportCollectionToJSONObject(
+     teamID: string,
+     collectionID: string,
+-    withChildren: boolean = true,
+   ): Promise<E.Right<CollectionFolder> | E.Left<string>> {
+     const collection = await this.getCollection(collectionID);
+     if (E.isLeft(collection)) return E.left(TEAM_INVALID_COLL_ID);
+
+     const childrenCollectionObjects = [];
+-    if (withChildren) {
+-      const childrenCollection = await this.prisma.teamCollection.findMany({
+-        where: {
+-          teamID,
+-          parentID: collectionID,
+-        },
+-        orderBy: {
+-          orderIndex: 'asc',
+-        },
+-      });
+
+-      for (const coll of childrenCollection) {
+-        const result = await this.exportCollectionToJSONObject(teamID, coll.id);
+-        if (E.isLeft(result)) return E.left(result.left);
++    const childrenCollection = await this.prisma.teamCollection.findMany({
++      where: {
++        teamID,
++        parentID: collectionID,
++      },
++      orderBy: {
++        orderIndex: 'asc',
++      },
++    });
+
+... (11 more lines)
+```
+
+## 42. ckan: `CG-QUAL-104` (new_but_matched)
+
+- Commit: [7a60264189](https://github.com/ckan/ckan/commit/7a60264189f543fba04043d2193b09f545a6ef32), file `ckan/public-midnight-blue/base/javascript/modules/data-viewer.js`
+- Truth: **new**, new line 27
+- Schemes that disagree with the truth: `sonar` (false_known)
+
+After:
+
+```
+    23      },
+    24
+    25      _onLoad: function() {
+    26        var self = this;
+>   27        var loc = document.head.querySelector(['meta[name=site-root]'])?.content;
+    28        // see if page is in part of the same domain
+    29        if (this.el.attr('src').substring(0, loc.length) === loc) {
+    30          this._recalibrate();
+    31          setTimeout(function() {
+```
+
+Diff near the line:
+
+```diff
+@@ -24,7 +24,7 @@ this.ckan.module('data-viewer', function (jQuery) {
+
+     _onLoad: function() {
+       var self = this;
+-      var loc = $('body').data('site-root');
++      var loc = document.head.querySelector(['meta[name=site-root]'])?.content;
+       // see if page is in part of the same domain
+       if (this.el.attr('src').substring(0, loc.length) === loc) {
+         this._recalibrate();
+
+```
+
+## 43. pgadmin: `CG-QUAL-101` (new_but_matched)
+
+- Commit: [a4bdcff7dc](https://github.com/pgadmin-org/pgadmin4/commit/a4bdcff7dc65e1b667b981574a7c7263bc84afd2), file `web/pgadmin/misc/cloud/static/js/cloud_components.jsx`
+- Truth: **new**, new line 58
+- Schemes that disagree with the truth: `codeguard` (false_known)
+
+After:
+
+```
+    54  export function FinalSummary(props) {
+    55    let summary = [],
+    56      summaryHeader = ['Cloud Details', 'Version and Instance Details', 'Storage Details', 'Database Details'];
+    57
+>   58    if(props.cloudProvider == 'starfleet') {
+    59      summaryHeader = ['Cloud Details', 'Network Connectivity'];
+    60      summary = getStarfleetSummary(props.cloudProvider, props.instanceData, props.databaseData);
+    61    }else if(props.cloudProvider == 'azure') {
+    62      summaryHeader.push('Network Connectivity','Availability');
+```
+
+Diff near the line:
+
+```diff
+@@ -54,7 +55,10 @@ export function FinalSummary(props) {
+   let summary = [],
+     summaryHeader = ['Cloud Details', 'Version and Instance Details', 'Storage Details', 'Database Details'];
+
+-  if(props.cloudProvider == 'azure') {
++  if(props.cloudProvider == 'starfleet') {
++    summaryHeader = ['Cloud Details', 'Network Connectivity'];
++    summary = getStarfleetSummary(props.cloudProvider, props.instanceData, props.databaseData);
++  }else if(props.cloudProvider == 'azure') {
+     summaryHeader.push('Network Connectivity','Availability');
+     summary = getAzureSummary(props.cloudProvider, props.instanceData, props.databaseData);
+   }else if(props.cloudProvider == 'google') {
+
+```
+
+## 44. intelowl: `CG-SEC-105` (new_but_matched)
+
+- Commit: [80107d6f05](https://github.com/intelowlproject/IntelOwl/commit/80107d6f05e8c1ca1e9ca1d0a937e5df400b7fe0), file `frontend/src/components/auth/utils/validator.jsx`
+- Truth: **new**, new line 24
+- Schemes that disagree with the truth: `sonar` (false_known)
+
+After:
+
+```
+    20      errors.password = "Required";
+    21    } else if (password.length < 12) {
+    22      errors.password = "Must be 12 characters or more";
+    23    } else if (!PASSWORD_REGEX.test(password)) {
+>   24      errors.password = "The password cannot be entirely numeric";
+    25    }
+    26    return errors;
+    27  }
+    28
+```
+
+Diff near the line:
+
+```diff
+@@ -21,8 +21,7 @@ export function PasswordValidator(password) {
+   } else if (password.length < 12) {
+     errors.password = "Must be 12 characters or more";
+   } else if (!PASSWORD_REGEX.test(password)) {
+-    errors.password =
+-      "The password is entirely numeric or contains special characters";
++    errors.password = "The password cannot be entirely numeric";
+   }
+   return errors;
+ }
+
+```
+
+## 45. intelowl: `CG-SEC-105` (new_but_matched)
+
+- Commit: [80107d6f05](https://github.com/intelowlproject/IntelOwl/commit/80107d6f05e8c1ca1e9ca1d0a937e5df400b7fe0), file `frontend/tests/components/auth/utils/validator.test.jsx`
+- Truth: **new**, new line 45
+- Schemes that disagree with the truth: `sonar` (false_known)
+
+After:
+
+```
+    41    });
+    42    test("Invalid password", () => {
+    43      const numericPassword = "123456123456";
+    44      expect(PasswordValidator(numericPassword)).toEqual({
+>   45        password: "The password cannot be entirely numeric",
+    46      });
+    47    });
+    48    test("Password with special characters is valid", () => {
+    49      const password = "intelowlpassword$";
+```
+
+Diff near the line:
+
+```diff
+@@ -42,14 +42,12 @@ describe("Password", () => {
+   test("Invalid password", () => {
+     const numericPassword = "123456123456";
+     expect(PasswordValidator(numericPassword)).toEqual({
+-      password:
+-        "The password is entirely numeric or contains special characters",
++      password: "The password cannot be entirely numeric",
+     });
++  });
++  test("Password with special characters is valid", () => {
+     const password = "intelowlpassword$";
+-    expect(PasswordValidator(password)).toEqual({
+-      password:
+-        "The password is entirely numeric or contains special characters",
+-    });
++    expect(PasswordValidator(password)).toEqual({});
+   });
+ });
+
+
+```
+
+## 46. arches: `CG-QUAL-104` (new_but_matched)
+
+- Commit: [2e02ce6e61](https://github.com/archesproject/arches/commit/2e02ce6e61999d93c10b05d853ae08f1912fa294), file `arches/app/media/js/views/graph/permission-designer.js`
+- Truth: **new**, new line 148
+- Schemes that disagree with the truth: `codeguard` (false_known), `github` (false_known), `sonar` (false_known)
+
+After:
+
+```
+   144                  .done(function(res) {
+   145                      var byNodegroup = {};
+   146                      res.forEach(function(nodegroup) {
+   147                          byNodegroup[nodegroup.nodegroup_id] = nodegroup;
+>  148                          var card = _.find(self.cardList, function(card) {
+   149                              return card.model.nodegroup_id() === nodegroup.nodegroup_id;
+   150                          });
+   151                          if (!card) {
+   152                              return;
+```
+
+Diff near the line:
+
+```diff
+@@ -70,62 +99,82 @@ import PermissionSettingsForm from 'views/graph/permission-manager/permission-se
+                         self.updatePermissions();
+                     });
+                 })
+-                .fail(function(err) {
+-                    console.log(err);
++                .fail(function(response) {
++                    showError(response.responseJSON, arches.translations.graphDesignerPermissionsLoadError);
++                })
++                .always(function() {
++                    self.loading(false);
+                 });
+         };
+
++        var setCardPerms = function(card, perms, literal) {
++            card.perms(perms);
++            card.permsLiteral(literal);
++            if (card.type === 'card' && card.children && card.children.length > 0) {
++                card.children.forEach(function(child) {
++                    if (child.type === 'node' && child.perms) {
++                        child.perms(perms);
++                    }
++                });
++            }
++        };
++
+         this.updatePermissions = function() {
+-            var item = self.identityList.selectedItems()[0];
+-            var nodegroupIds = [];
++            var identity = self.identityList.selectedItems()[0];
+
+-            if (item) {
+-                self.cardList.forEach(function(item) {
+-                    nodegroupIds.push(item.model.nodegroup_id());
++            if (!identity || !self.cardList) {
++                self.permissionsByNodegroup({});
++                (self.cardList || []).forEach(function(card) {
++                    setCardPerms(card, [], '');
+                 });
+-                $.ajax({
+... (91 more lines)
+```
+
+## 47. geonode: `CG-SEC-002` (new_but_matched)
+
+- Commit: [6f00ca5b66](https://github.com/GeoNode/geonode/commit/6f00ca5b66b2459cf3a6556434d476810cabe0d4), file `geonode/geoserver/gwc.py`
+- Truth: **new**, new line 50
+- Schemes that disagree with the truth: `line_text` (false_known)
+
+After:
+
+```
+    46          else:
+    47              logger.debug(f"{r.request.method} response: code:{r.status_code} --> {len(r.text)} bytes")
+    48
+    49      def _get(self, urlpath):
+>   50          _user, _password = ogc_server_settings.credentials
+    51
+    52          url = f"{self.base_url}{urlpath}"
+    53          r = requests.get(url=url, auth=HTTPBasicAuth(_user, _password), timeout=30)
+    54          self.__log_response(r)
+```
+
+Diff near the line:
+
+```diff
+@@ -36,15 +36,40 @@ class GWCClient:
+     A GeoWebCache REST client for interacting with the GWC API.
+     """
+
+-    def __init__(self) -> None:
++    def __init__(self, **kwargs) -> None:
+         self.base_url = f"{ogc_server_settings.LOCATION}gwc/rest/"
++        self.debug = kwargs.get("debug", False)
++
++    def __log_response(self, r):
++        if self.debug:
++            logger.debug(f'{r.request.method} response: code:{r.status_code} --> "{r.text}"')
++        else:
++            logger.debug(f"{r.request.method} response: code:{r.status_code} --> {len(r.text)} bytes")
++
++    def _get(self, urlpath):
++        _user, _password = ogc_server_settings.credentials
++
++        url = f"{self.base_url}{urlpath}"
++        r = requests.get(url=url, auth=HTTPBasicAuth(_user, _password), timeout=30)
++        self.__log_response(r)
++        return r
+
+     def _post(self, urlpath, data):
+         _user, _password = ogc_server_settings.credentials
+
+         url = f"{self.base_url}{urlpath}"
+         r = requests.post(url=url, data=data, auth=HTTPBasicAuth(_user, _password), timeout=30)
+-        logger.debug(f'POST response: code:{r.status_code} --> "{r.text}"')
++        self.__log_response(r)
++        return r
++
++    def _put(self, urlpath, data):
++        _user, _password = ogc_server_settings.credentials
++
++        url = f"{self.base_url}{urlpath}"
++        r = requests.put(
++            url=url, data=data, headers={"Content-Type": "text/xml"}, auth=HTTPBasicAuth(_user, _password), timeout=30
++        )
++        self.__log_response(r)
+... (3 more lines)
+```
+
+## 48. hoppscotch: `CG-QUAL-101` (new_but_matched)
+
+- Commit: [342d0cbdf0](https://github.com/hoppscotch/hoppscotch/commit/342d0cbdf0c5435b715dc9f1917b851e413e08e3), file `packages/hoppscotch-common/src/lib/sync/collections/index.ts`
+- Truth: **new**, new line 384
+- Schemes that disagree with the truth: `codeguard` (false_known), `line_text` (false_known)
+
+After:
+
+```
+   380          ) as HoppCollection
+   381      )
+   382
+   383      const localCollections =
+>  384        collectionType == "REST"
+   385          ? restCollectionStore.value.state
+   386          : graphqlCollectionStore.value.state
+   387
+   388      const mergedCollections = mergeCollections(localCollections, fetchedCollections)
+```
+
+Diff near the line:
+
+```diff
+@@ -269,26 +371,26 @@ async function loadUserCollections(collectionType: "REST" | "GQL") {
+         ExportedUserCollectionGQL | ExportedUserCollectionREST
+       >
+     ).map((collection) => ({ v: 1, ...collection }))
++
++    const fetchedCollections = exportedCollections.map(
++      (collection) =>
++        exportedCollectionToHoppCollection(
++          collection,
++          collectionType
++        ) as HoppCollection
++    )
++
++    const localCollections =
++      collectionType == "REST"
++        ? restCollectionStore.value.state
++        : graphqlCollectionStore.value.state
++
++    const mergedCollections = mergeCollections(localCollections, fetchedCollections)
++
+     runDispatchWithOutSyncing(() => {
+       collectionType == "REST"
+-        ? setRESTCollections(
+-            exportedCollections.map(
+-              (collection) =>
+-                exportedCollectionToHoppCollection(
+-                  collection,
+-                  "REST"
+-                ) as HoppCollection
+-            )
+-          )
+-        : setGraphqlCollections(
+-            exportedCollections.map(
+-              (collection) =>
+-                exportedCollectionToHoppCollection(
+-                  collection,
+-                  "GQL"
+-                ) as HoppCollection
+-            )
+-          )
+... (6 more lines)
+```
+
+## 49. ghost: `CG-PERF-101` (new_but_matched)
+
+- Commit: [0f623f3f5d](https://github.com/TryGhost/Ghost/commit/0f623f3f5daf914e9896e29cfe28bfbce0f0a8e3), file `tools/scripts/test/public-apps.test.ts`
+- Truth: **new**, new line 67
+- Schemes that disagree with the truth: `sonar` (false_known)
+
+After:
+
+```
+    63    it('holds for every public app in the repo right now', async () => {
+    64      const defaults = (await readDefaults()) as Record<string, { version: string }>;
+    65
+    66      for (const app of PUBLIC_APPS) {
+>   67        const { version } = await readJson<{ version: string }>(
+    68          join(ROOT_DIR, app.path, 'package.json'),
+    69        );
+    70
+    71        assert.strictEqual(
+```
+
+Diff near the line:
+
+```diff
+@@ -61,15 +61,17 @@ describe('the major.minor invariant', () => {
+   // If the repo ever violates it, one of those two is broken — or someone
+   // hand-edited a version without running "pnpm ship".
+   it('holds for every public app in the repo right now', async () => {
+-    const defaults = await readDefaults();
++    const defaults = (await readDefaults()) as Record<string, { version: string }>;
+
+     for (const app of PUBLIC_APPS) {
+-      const { version } = await readJson(join(ROOT_DIR, app.path, 'package.json'));
++      const { version } = await readJson<{ version: string }>(
++        join(ROOT_DIR, app.path, 'package.json'),
++      );
+
+       assert.strictEqual(
+-        defaults[app.configKey].version,
++        defaults[app.configKey]?.version,
+         majorMinor(version),
+-        `${app.packageName}: package.json is ${version}, defaults.json says ${defaults[app.configKey].version}`,
++        `${app.packageName}: package.json is ${version}, defaults.json says ${defaults[app.configKey]?.version}`,
+       );
+     }
+   });
+
+```
+
+## 50. immich: `CG-PERF-101` (new_but_matched)
+
+- Commit: [e66f2c7615](https://github.com/immich-app/immich/commit/e66f2c7615bacbe6a9b156e300fc182e4d1a4fa3), file `server/src/services/person.service.ts`
+- Truth: **new**, new line 162
+- Schemes that disagree with the truth: `codeguard` (false_known), `github` (false_known), `sonar` (false_known)
+
+After:
+
+```
+   158        if (!assetFace) {
+   159          continue;
+   160        }
+   161
+>  162        await this.personRepository.update({ ownerId, personGroupId, faceAssetId: assetFace.id });
+   163        jobs.push({ name: JobName.PersonGenerateThumbnail, data: { ownerId, personGroupId } });
+   164      }
+   165
+   166      await this.jobRepository.queueAll(jobs);
+```
+
+Diff near the line:
+
+```diff
+@@ -155,10 +155,12 @@ export class PersonService extends BaseService {
+     for (const { ownerId, personGroupId } of changeFeaturePhoto) {
+       const assetFace = await this.personRepository.getRandomFace(personGroupId);
+
+-      if (assetFace) {
+-        await this.personRepository.update({ ownerId, personGroupId, faceAssetId: assetFace.id });
+-        jobs.push({ name: JobName.PersonGenerateThumbnail, data: { ownerId, personGroupId } });
++      if (!assetFace) {
++        continue;
+       }
++
++      await this.personRepository.update({ ownerId, personGroupId, faceAssetId: assetFace.id });
++      jobs.push({ name: JobName.PersonGenerateThumbnail, data: { ownerId, personGroupId } });
+     }
+
+     await this.jobRepository.queueAll(jobs);
+
+```
+
+## 51. arches: `CG-QUAL-104` (new_but_matched)
+
+- Commit: [2e02ce6e61](https://github.com/archesproject/arches/commit/2e02ce6e61999d93c10b05d853ae08f1912fa294), file `arches/app/media/js/views/graph/permission-manager/permission-settings-form.js`
+- Truth: **new**, new line 30
+- Schemes that disagree with the truth: `codeguard` (false_known), `line_text` (false_known)
+
+After:
+
+```
+    26      * @memberof PermissionSettingsForm.prototype
+    27      * @param {boolean} options.selection - the selected item, either a {@link CardModel} or a {@link NodeModel}
+    28      */
+    29      initialize: function(options) {
+>   30          var self = this;
+    31          this.selectedIdentities = options.selectedIdentities;
+    32          this.identityList = options.identityList;
+    33          this.selectedCards = options.selectedCards;
+    34          this.permissionsByNodegroup = options.permissionsByNodegroup || ko.observable({});
+```
+
+Diff near the line:
+
+```diff
+@@ -19,9 +27,13 @@ var PermissionSettingsForm = Backbone.View.extend({
+     * @param {boolean} options.selection - the selected item, either a {@link CardModel} or a {@link NodeModel}
+     */
+     initialize: function(options) {
++        var self = this;
+         this.selectedIdentities = options.selectedIdentities;
+         this.identityList = options.identityList;
+         this.selectedCards = options.selectedCards;
++        this.permissionsByNodegroup = options.permissionsByNodegroup || ko.observable({});
++        this.loading = options.loading || ko.observable(false);
++        this.alert = options.alert || ko.observable();
+         this.noAccessPerm = undefined;
+         this.whiteListPerms = [];
+         this.groupedNodeList = options.groupedNodeList;
+```
+
+## 52. readthedocs: `CG-SEC-002` (new_but_matched)
+
+- Commit: [857138d4d9](https://github.com/readthedocs/readthedocs.org/commit/857138d4d9659a62ce46f52a358f535b6ffeef75), file `readthedocs/rtd_tests/tests/test_api.py`
+- Truth: **new**, new line 331
+- Schemes that disagree with the truth: `github` (false_known), `line_text` (false_known)
+
+After:
+
+```
+   327          )
+   328          assert not project.has_feature(Feature.USE_BUILD_ISOLATED)
+   329
+   330          client = APIClient()
+>  331          _, build_api_key = BuildAPIKey.objects.create_key(project)
+   332          client.credentials(HTTP_AUTHORIZATION=f"Token {build_api_key}")
+   333
+   334          resp = client.patch(
+   335              "/api/v2/build/{}/".format(build.pk),
+```
+
+Diff near the line:
+
+```diff
+@@ -315,6 +315,30 @@ class APIBuildTests(TestCase):
+             Build.objects.get(pk=build_two.pk).readthedocs_yaml_config.pk,
+         )
+
++    @mock.patch("readthedocs.api.v2.views.model_views.run_post_build_tasks")
++    def test_finishing_uploaded_build_runs_post_build_tasks(self, run_post_build_tasks):
++        project = Project.objects.get(pk=1)
++        version = project.versions.first()
++        build = Build.objects.create(
++            project=project,
++            version=version,
++            state=BUILD_STATE_TRIGGERED,
++            is_uploaded=True,
++        )
++        assert not project.has_feature(Feature.USE_BUILD_ISOLATED)
++
++        client = APIClient()
++        _, build_api_key = BuildAPIKey.objects.create_key(project)
++        client.credentials(HTTP_AUTHORIZATION=f"Token {build_api_key}")
++
++        resp = client.patch(
++            "/api/v2/build/{}/".format(build.pk),
++            {"state": BUILD_STATE_FINISHED},
++            format="json",
++        )
++        assert resp.status_code == status.HTTP_200_OK
++        run_post_build_tasks.delay.assert_called_once_with(build_pk=build.pk)
++
+     def test_response_building(self):
+         """The ``view docs`` attr should return a link to the dashboard."""
+         client = APIClient()
+
+```
+
+## 53. openlibrary: `CG-QUAL-104` (new_but_matched)
+
+- Commit: [53015559eb](https://github.com/internetarchive/openlibrary/commit/53015559ebcd126850e7b07792ebc7bcfa847919), file `openlibrary/plugins/openlibrary/js/graphs/plot.js`
+- Truth: **new**, new line 20
+- Schemes that disagree with the truth: `sonar` (false_known)
+
+After:
+
+```
+    16   * - http://localhost:8080/subjects/fantasy#sort=date_published&ebooks=true
+    17   * - http://localhost:8080/publishers/Barnes_&_Noble
+    18   */
+    19  export function loadEditionsGraph() {
+>   20      var data, options, placeholder, plot, dateFrom, dateTo, previousPoint;
+    21      data = [{ data: JSON.parse(document.getElementById('graph-json-chartPubHistory').textContent) }];
+    22      options = {
+    23          series: {
+    24              bars: {
+```
+
+Diff near the line:
+
+```diff
+@@ -17,9 +17,8 @@ import 'flot/jquery.flot.time.js';
+  * - http://localhost:8080/publishers/Barnes_&_Noble
+  */
+ export function loadEditionsGraph() {
+-    var data, options, placeholder,
+-        plot, dateFrom, dateTo, previousPoint;
+-    data = [{data: JSON.parse(document.getElementById('graph-json-chartPubHistory').textContent)}];
++    var data, options, placeholder, plot, dateFrom, dateTo, previousPoint;
++    data = [{ data: JSON.parse(document.getElementById('graph-json-chartPubHistory').textContent) }];
+     options = {
+         series: {
+             bars: {
+```
+
+## 54. calcom: `CG-SEC-105` (new_but_matched)
+
+- Commit: [ab21c7f805](https://github.com/calcom/cal.com/commit/ab21c7f805a089fa3a11ffd61c4a9aecc349c16c), file `packages/features/bookings/lib/handleNewBooking/test/reschedule.test.ts`
+- Truth: **new**, new line 806
+- Schemes that disagree with the truth: `codeguard` (false_known), `github` (false_known), `line_text` (false_known)
+
+After:
+
+```
+   802                    {
+   803                      type: appStoreMetadata.dailyvideo.type,
+   804                      uid: "MOCK_ID",
+   805                      meetingId: "MOCK_ID",
+>  806                      meetingPassword: "MOCK_PASS",
+   807                      meetingUrl: "http://mock-dailyvideo.example.com",
+   808                    },
+   809                    {
+   810                      type: appStoreMetadata.googlecalendar.type,
+```
+
+Diff near the line:
+
+```diff
+@@ -690,8 +660,201 @@ describe("handleNewBooking", () => {
+       );
+
+       describe("Event Type that requires confirmation", () => {
+-        // NOTE: Tests for BOOKING_REQUESTED webhook have been moved to the new webhook architecture test suite
+-        // See packages/features/webhooks/lib/__tests__/ for tests using the producer/consumer pattern
++        test(
++          `should reschedule a booking that requires confirmation in PENDING state - When a booker(who is not the organizer himself) is doing the reschedule
++          1. Should cancel the existing booking
++          2. Should delete existing calendar invite and Video meeting
++          2. Should create a new booking in the database in PENDING state
++          3. Should send BOOKING Requested scenario emails to the booker as well as organizer
++          4. Should trigger BOOKING_REQUESTED webhook instead of BOOKING_RESCHEDULED
++    `,
++          async ({ emails }) => {
++            const handleNewBooking = getNewBookingHandler();
++            const subscriberUrl = "http://my-webhook.example.com";
++            const booker = getBooker({
++              email: "booker@example.com",
++              name: "Booker",
++            });
++
++            const organizer = getOrganizer({
++              name: "Organizer",
++              email: "organizer@example.com",
++              id: 101,
++              schedules: [TestData.schedules.IstWorkHours],
++              credentials: [getGoogleCalendarCredential()],
++              selectedCalendars: [TestData.selectedCalendars.google],
++            });
++            const { dateString: plus1DateString } = getDate({ dateIncrement: 1 });
++            const uidOfBookingToBeRescheduled = "n5Wv3eHgconAED2j4gcVhP";
++
++            const scenarioData = getScenarioData({
++              webhooks: [
++                {
++                  userId: organizer.id,
++                  eventTriggers: ["BOOKING_CREATED"],
++                  subscriberUrl,
++                  active: true,
+... (164 more lines)
+```
+
+## 55. ckan: `CG-QUAL-104` (new_but_matched)
+
+- Commit: [7a60264189](https://github.com/ckan/ckan/commit/7a60264189f543fba04043d2193b09f545a6ef32), file `ckan/public/base/javascript/modules/data-viewer.js`
+- Truth: **new**, new line 27
+- Schemes that disagree with the truth: `sonar` (false_known)
+
+After:
+
+```
+    23      },
+    24
+    25      _onLoad: function() {
+    26        var self = this;
+>   27        var loc = document.head.querySelector(['meta[name=site-root]'])?.content;
+    28        // see if page is in part of the same domain
+    29        if (this.el.attr('src').substring(0, loc.length) === loc) {
+    30          this._recalibrate();
+    31          setTimeout(function() {
+```
+
+Diff near the line:
+
+```diff
+@@ -24,7 +24,7 @@ this.ckan.module('data-viewer', function (jQuery) {
+
+     _onLoad: function() {
+       var self = this;
+-      var loc = $('body').data('site-root');
++      var loc = document.head.querySelector(['meta[name=site-root]'])?.content;
+       // see if page is in part of the same domain
+       if (this.el.attr('src').substring(0, loc.length) === loc) {
+         this._recalibrate();
+
+```
+
+## 56. calcom: `CG-SEC-105` (new_but_matched)
+
+- Commit: [1660adeb53](https://github.com/calcom/cal.com/commit/1660adeb537a3524290c6885c6b9feca63cf675b), file `scripts/seed.ts`
+- Truth: **new**, new line 1008
+- Schemes that disagree with the truth: `codeguard` (false_known), `github` (false_known), `line_text` (false_known), `sonar` (false_known)
+
+After:
+
+```
+  1004    const admin = await createUserAndEventType({
+  1005      user: {
+  1006        email: "admin@example.com",
+  1007        /** To comply with admin password requirements  */
+> 1008        password: "ADMINadmin2022!",
+  1009        username: "admin",
+  1010        name: "Admin Example",
+  1011        role: "ADMIN",
+  1012      },
+```
+
+Diff near the line:
+
+```diff
+@@ -1248,6 +1001,32 @@ async function main() {
+     },
+   });
+
++  const admin = await createUserAndEventType({
++    user: {
++      email: "admin@example.com",
++      /** To comply with admin password requirements  */
++      password: "ADMINadmin2022!",
++      username: "admin",
++      name: "Admin Example",
++      role: "ADMIN",
++    },
++  });
++
++  const clientId = process.env.SEED_OAUTH2_CLIENT_ID;
++  const clientSecret = process.env.SEED_OAUTH2_CLIENT_SECRET_HASHED;
++
++  if (clientId && clientSecret) {
++    await createOAuthClientForUser(admin.id, {
++      clientId,
++      clientSecret,
++      name: "atoms examples app oauth 2 client",
++      purpose: "test atoms examples app with oauth 2",
++      redirectUri: "http://localhost:4321",
++      websiteUrl: "http://localhost:4321",
++      enablePkce: false,
++    });
++  }
++
+   if (process.env.E2E_TEST_CALCOM_QA_EMAIL && process.env.E2E_TEST_CALCOM_QA_PASSWORD) {
+     await createUserAndEventType({
+       user: {
+
+```
+
+## 57. hoppscotch: `CG-QUAL-101` (new_but_matched)
+
+- Commit: [863b1b29a8](https://github.com/hoppscotch/hoppscotch/commit/863b1b29a803f6c456b04dd82d19a53c7afc9102), file `packages/hoppscotch-common/src/lib/sync/collections/index.ts` (was `packages/hoppscotch-selfhost-web/src/platform/collections/desktop/index.ts`)
+- Truth: **new**, new line 511
+- Schemes that disagree with the truth: `sonar` (false_known)
+
+After:
+
+```
+   507            collectionType == "REST"
+   508              ? editRESTFolder(updatedCollectionLocalPath, partialUpdate)
+   509              : editGraphqlFolder(updatedCollectionLocalPath, partialUpdate)
+   510          } else {
+>  511            collectionType == "REST"
+   512              ? editRESTCollection(
+   513                  parseInt(updatedCollectionLocalPath),
+   514                  partialUpdate
+   515                )
+```
+
+Diff near the line:
+
+```diff
+@@ -458,45 +454,71 @@ function setupUserCollectionUpdatedSubscription() {
+
+   userCollectionUpdated$.subscribe((res) => {
+     if (E.isRight(res)) {
+-      const collectionType = res.right.userCollectionUpdated.type
++      const {
++        id: updatedCollectionBackendID,
++        title,
++        type: collectionType,
++        data,
++      } = res.right.userCollectionUpdated
+
+       const { collectionStore } = getStoreByCollectionType(collectionType)
+
+-      const updatedCollectionBackendID = res.right.userCollectionUpdated.id
+       const updatedCollectionLocalPath = getCollectionPathFromCollectionID(
+         updatedCollectionBackendID,
+         collectionStore.value.state
+       )
+
+-      const isFolder =
+-        updatedCollectionLocalPath &&
+-        updatedCollectionLocalPath.split("/").length > 1
++      if (!updatedCollectionLocalPath) return
+
+-      // updated collection is a folder
+-      if (isFolder) {
+-        runDispatchWithOutSyncing(() => {
+-          collectionType == "REST"
+-            ? editRESTFolder(updatedCollectionLocalPath, {
+-                name: res.right.userCollectionUpdated.title,
+-              })
+-            : editGraphqlFolder(updatedCollectionLocalPath, {
+-                name: res.right.userCollectionUpdated.title,
+-              })
+-        })
++      const isFolder = updatedCollectionLocalPath.split("/").length > 1
++
++      // Carry auth, headers, variables, and scripts from the data payload
++      const {
+... (59 more lines)
+```
+
+## 58. ghost: `CG-PERF-101` (new_but_matched)
+
+- Commit: [7da91e095b](https://github.com/TryGhost/Ghost/commit/7da91e095b2803c62bc67fe70f2c4f0d114846d9), file `tools/scripts/test/ci-path-filters.test.js`
+- Truth: **new**, new line 69
+- Schemes that disagree with the truth: `codeguard` (false_known), `line_text` (false_known)
+
+After:
+
+```
+    65      const docs = await getFilterPatterns('docs');
+    66      assert.ok(docs.some((pattern) => picomatch(pattern, { dot: true })(inventory)));
+    67
+    68      for (const filterName of ['core', 'any-code', 'e2e']) {
+>   69        const patterns = await getFilterPatterns(filterName);
+    70        const positives = patterns.filter((pattern) => !pattern.startsWith('!'));
+    71        const exclusions = patterns.filter((pattern) => pattern.startsWith('!'));
+    72        const matches = (path) =>
+    73          (positives.length === 0 ||
+```
+
+Diff near the line:
+
+```diff
+@@ -56,6 +60,83 @@ describe('CI path filters', () => {
+     assert.ok(e2e.includes('!**/*.mdx'));
+   });
+
++  it('treats the service inventory as docs and keeps code checks for mixed changes', async () => {
++    const inventory = 'ghost/core/server/services/service-inventory.yaml';
++    const docs = await getFilterPatterns('docs');
++    assert.ok(docs.some((pattern) => picomatch(pattern, { dot: true })(inventory)));
++
++    for (const filterName of ['core', 'any-code', 'e2e']) {
++      const patterns = await getFilterPatterns(filterName);
++      const positives = patterns.filter((pattern) => !pattern.startsWith('!'));
++      const exclusions = patterns.filter((pattern) => pattern.startsWith('!'));
++      const matches = (path) =>
++        (positives.length === 0 ||
++          positives.some((pattern) => picomatch(pattern, { dot: true })(path))) &&
++        exclusions.every((pattern) => picomatch(pattern, { dot: true })(path));
++      const metadata = [inventory, 'ghost/core/server/services/README.md'];
++
++      assert.strictEqual(metadata.some(matches), false, filterName);
++      for (const runtime of [
++        'ghost/core/server/services/identity-tokens/index.ts',
++        'ghost/core/server/services/other-metadata.yaml',
++        '.github/workflows/ci.yml',
++      ]) {
++        assert.strictEqual([...metadata, runtime].some(matches), true, `${filterName}: ${runtime}`);
++      }
++    }
++
++    const anyCode = await getFilterPatterns('any-code');
++    assert.ok(
++      anyCode.every((pattern) =>
++        picomatch(pattern, { dot: true })(
++          'ghost/test/unit/server/services/service-inventory.test.ts',
++        ),
++      ),
++      'Changes to the inventory validator must still run code checks',
++    );
++  });
++
+... (45 more lines)
+```
+
+## 59. arches: `CG-QUAL-104` (new_but_matched)
+
+- Commit: [ac6a5ab690](https://github.com/archesproject/arches/commit/ac6a5ab6907f92256a1ebdbc373de7cabb41e3b0), file `arches/app/media/js/views/graph-designer.js`
+- Truth: **new**, new line 793
+- Schemes that disagree with the truth: `sonar` (false_known)
+
+After:
+
+```
+   789              }
+   790          };
+   791
+   792          // only follow the Cards tab when its selection changed, so a multi-selection survives tab switches
+>  793          var lastSyncedCardSelection;
+   794          var updatePermissionCardSelection = function() {
+   795              var cardSelection = viewModel.cardTree.selection();
+   796              if (cardSelection === lastSyncedCardSelection) {
+   797                  return;
+```
+
+Diff near the line:
+
+```diff
+@@ -789,12 +789,19 @@ var GraphDesignerView = BaseManagerView.extend({
+             }
+         };
+
++        // only follow the Cards tab when its selection changed, so a multi-selection survives tab switches
++        var lastSyncedCardSelection;
+         var updatePermissionCardSelection = function() {
+-            var matchingCard = correspondingCard(viewModel.cardTree.selection(), viewModel.permissionTree);
++            var cardSelection = viewModel.cardTree.selection();
++            if (cardSelection === lastSyncedCardSelection) {
++                return;
++            }
++            lastSyncedCardSelection = cardSelection;
++            var matchingCard = correspondingCard(cardSelection, viewModel.permissionTree);
+             if (matchingCard) {
+                 viewModel.permissionTree.expandToRoot(matchingCard);
+                 viewModel.permissionTree.selection.removeAll();
+-                matchingCard.selectChildCards();
++                matchingCard.selectChildCards(true);
+             }
+         };
+
+
+```
+
+## 60. kitsune: `CG-QUAL-104` (new_but_matched)
+
+- Commit: [59b6937db5](https://github.com/mozilla/kitsune/commit/59b6937db573505c764bec9c87bd786981848487), file `kitsune/sumo/static/sumo/js/markup.js`
+- Truth: **new**, new line 844
+- Schemes that disagree with the truth: `codeguard` (false_known)
+
+After:
+
+```
+   840      var kbox;
+   841
+   842      var cannedResponsesUrl = "/kb/common-forum-responses";
+   843      var previewBtn = document.getElementById("preview");
+>  844      var siteLanguage = window.location.pathname.split("/")[1];
+   845      var previewUrl = previewBtn
+   846        ? previewBtn.dataset.previewUrl
+   847        : "/" + siteLanguage + "/questions/answer-preview-async";
+   848
+```
+
+Diff near the line:
+
+```diff
+@@ -840,7 +840,11 @@ Marky.CannedResponsesButton.prototype = Object.assign({}, Marky.SimpleButton.pro
+     var kbox;
+
+     var cannedResponsesUrl = "/kb/common-forum-responses";
+-    var previewUrl = "answer-preview-async";
++    var previewBtn = document.getElementById("preview");
++    var siteLanguage = window.location.pathname.split("/")[1];
++    var previewUrl = previewBtn
++      ? previewBtn.dataset.previewUrl
++      : "/" + siteLanguage + "/questions/answer-preview-async";
+
+     function updatePreview() {
+       var response = html.querySelector("#response-content").value;
+
+```
+
+## 61. ckan: `CG-QUAL-104` (agree_known)
+
+- Commit: [fd309bc144](https://github.com/ckan/ckan/commit/fd309bc144f08505087d8b8d463aa8da296ba766), file `ckan/public/base/javascript/client.js`
+- Truth: **known (equal)**, old line 227, new line 226
+- Schemes that disagree with the truth: none
+
+Before:
+
+```
+   223        var packages = jQuery.trim(string).split('\n');
+   224        var parsed = [];
+   225
+   226        return jQuery.map(packages, function (pkg) {
+>  227          var parts = pkg.split('|');
+   228          var id    = jQuery.trim(parts.pop() || '');
+   229          var text  = jQuery.trim(parts.join('|') || '');
+   230          return options && options.objects === true ? {id: id, text: text} : id;
+   231        });
+```
+After:
+
+```
+   222        var packages = jQuery.trim(string).split('\n');
+   223        var parsed = [];
+   224
+   225        return jQuery.map(packages, function (pkg) {
+>  226          var parts = pkg.split('|');
+   227          var id    = jQuery.trim(parts.pop() || '');
+   228          var text  = jQuery.trim(parts.join('|') || '');
+   229          return options && options.objects === true ? {id: id, text: text} : id;
+   230        });
+```
+
+## 62. hoppscotch: `CG-QUAL-101` (agree_known)
+
+- Commit: [1855faabbc](https://github.com/hoppscotch/hoppscotch/commit/1855faabbc4ff968d874f54510f6c586a7fdae05), file `packages/hoppscotch-common/src/lib/sync/collections/index.ts`
+- Truth: **known (equal)**, old line 796, new line 799
+- Schemes that disagree with the truth: none
+
+Before:
+
+```
+   792          description,
+   793          preRequestScript,
+   794          testScript,
+   795        } =
+>  796          data && data != "null"
+   797            ? JSON.parse(data)
+   798            : {
+   799                auth: { authType: "inherit", authActive: true },
+   800                headers: [],
+```
+After:
+
+```
+   795          description,
+   796          preRequestScript,
+   797          testScript,
+   798        } =
+>  799          data && data != "null"
+   800            ? JSON.parse(data)
+   801            : {
+   802                auth: { authType: "inherit", authActive: true },
+   803                headers: [],
+```
+
+## 63. indico: `CG-QUAL-003` (agree_known)
+
+- Commit: [1ab29e1359](https://github.com/indico/indico/commit/1ab29e13596cacf234ce75f7c0d4be217010ba6d), file `indico/modules/events/registration/util.py`
+- Truth: **known (equal)**, old line 474, new line 474
+- Schemes that disagree with the truth: none
+
+Before:
+
+```
+   470      return registration
+   471
+   472
+   473  @no_autoflush
+>  474  def modify_registration(registration, data, management=False, notify_user=True):
+   475      from indico.modules.events.registration.tasks import delete_previous_registration_file
+   476
+   477      user = session.user if session else None
+   478      old_data = snapshot_registration_data(registration)
+```
+After:
+
+```
+   470      return registration
+   471
+   472
+   473  @no_autoflush
+>  474  def modify_registration(registration, data, management=False, notify_user=True):
+   475      from indico.modules.events.registration.tasks import delete_previous_registration_file
+   476
+   477      user = session.user if session else None
+   478      old_data = snapshot_registration_data(registration)
+```
+
+## 64. securedrop: `CG-QUAL-003` (agree_known)
+
+- Commit: [871378be59](https://github.com/freedomofpress/securedrop/commit/871378be59567ac2916c1ae5d8f347784288d46f), file `securedrop/tests/test_journalist_api2.py`
+- Truth: **known (equal)**, old line 738, new line 738
+- Schemes that disagree with the truth: none
+
+Before:
+
+```
+   734          )
+   735          assert response.json["events"][stale_event.id] == [200, None]
+   736
+   737
+>  738  def test_api2_source_deleted(
+   739      journalist_app,
+   740      journalist_api_token,
+   741      test_files,
+   742  ):
+```
+After:
+
+```
+   734          )
+   735          assert response.json["events"][stale_event.id] == [200, None]
+   736
+   737
+>  738  def test_api2_source_deleted(
+   739      journalist_app,
+   740      journalist_api_token,
+   741      test_files,
+   742  ):
+```
+
+## 65. weblate: `CG-QUAL-004` (agree_known)
+
+- Commit: [f4e6cc3fe0](https://github.com/WeblateOrg/weblate/commit/f4e6cc3fe00e4ea1c0dd849af897442246f14191), file `weblate/trans/tests/test_autotranslate.py`
+- Truth: **known (equal)**, old line 1621, new line 1639
+- Schemes that disagree with the truth: none
+
+Before:
+
+```
+  1617          translation = self.component3.translation_set.get(language_code="cs")
+  1618          translation.invalidate_cache()
+  1619          self.assertEqual(translation.stats.translated, expected)
+  1620
+> 1621      def test_component_help_matches_scope_and_accepted_inputs(self) -> None:
+  1622          workspace = Workspace.objects.create(name="Automatic translation workspace")
+  1623          self.project.workspace = workspace
+  1624          self.project.save(update_fields=["workspace"])
+  1625          original_values_list = ComponentQuerySet.values_list
+```
+After:
+
+```
+  1635          translation = self.component3.translation_set.get(language_code="cs")
+  1636          translation.invalidate_cache()
+  1637          self.assertEqual(translation.stats.translated, expected)
+  1638
+> 1639      def test_component_help_matches_scope_and_accepted_inputs(self) -> None:
+  1640          workspace = Workspace.objects.create(name="Automatic translation workspace")
+  1641          self.project.workspace = workspace
+  1642          self.project.save(update_fields=["workspace"])
+  1643          original_values_list = ComponentQuerySet.values_list
+```
+
+## 66. securedrop: `CG-SEC-002` (agree_known)
+
+- Commit: [db86920ded](https://github.com/freedomofpress/securedrop/commit/db86920ded3273f0fec3f7cb7287817bf5167000), file `securedrop/tests/test_journalist.py`
+- Truth: **known (equal)**, old line 1339, new line 1338
+- Schemes that disagree with the truth: none
+
+Before:
+
+```
+  1335
+  1336
+  1337  def test_user_resets_hotp(journalist_app, test_journo):
+  1338      old_secret = test_journo["otp_secret"]
+> 1339      new_secret = "0123456789ABCDEF0123456789ABCDEF01234567"
+  1340
+  1341      # Precondition
+  1342      assert new_secret != old_secret
+  1343
+```
+After:
+
+```
+  1334
+  1335
+  1336  def test_user_resets_hotp(journalist_app, test_journo):
+  1337      old_secret = test_journo["otp_secret"]
+> 1338      new_secret = "0123456789ABCDEF0123456789ABCDEF01234567"
+  1339
+  1340      # Precondition
+  1341      assert new_secret != old_secret
+  1342
+```
+
+## 67. arches: `CG-QUAL-003` (agree_known)
+
+- Commit: [ef3a5efc29](https://github.com/archesproject/arches/commit/ef3a5efc290afac95e3a6b5e3c8edabd51a9ddab), file `arches/app/permissions/arches_default_deny.py`
+- Truth: **known (equal)**, old line 230, new line 264
+- Schemes that disagree with the truth: none
+
+Before:
+
+```
+   226          should_access.should(principal_user_term_filter)
+   227          has_access.filter(should_access)
+   228          return has_access
+   229
+>  230      def get_search_ui_permissions(
+   231          self, user: User, search_result: dict, groups: list[str]
+   232      ) -> dict:
+   233          result = {}
+   234
+```
+After:
+
+```
+   260          should_access.should(principal_user_term_filter)
+   261          has_access.filter(should_access)
+   262          return has_access
+   263
+>  264      def get_search_ui_permissions(
+   265          self, user: User, search_result: dict, groups: list[str]
+   266      ) -> dict:
+   267          result = {}
+   268
+```
+
+## 68. habitica: `CG-SEC-111` (agree_known)
+
+- Commit: [78c62a5aec](https://github.com/HabitRPG/habitica/commit/78c62a5aec6f6270ff432de6fdb6efb0e120526d), file `website/server/controllers/api-v3/tasks.js`
+- Truth: **known (equal)**, old line 1017, new line 1018
+- Schemes that disagree with the truth: none
+
+Before:
+
+```
+  1013
+  1014      const item = find(task.checklist, { id: req.params.itemId });
+  1015      if (!item) throw new NotFound(res.t('checklistItemNotFound'));
+  1016
+> 1017      merge(item, Tasks.Task.sanitizeChecklist(req.body));
+  1018      const savedTask = await task.save();
+  1019
+  1020      res.respond(200, savedTask);
+  1021      if (challenge) challenge.updateTask(savedTask);
+```
+After:
+
+```
+  1014
+  1015      const item = find(task.checklist, { id: req.params.itemId });
+  1016      if (!item) throw new NotFound(res.t('checklistItemNotFound'));
+  1017
+> 1018      merge(item, Tasks.Task.sanitizeChecklist(req.body));
+  1019      const savedTask = await task.save();
+  1020
+  1021      res.respond(200, savedTask);
+  1022      if (challenge) challenge.updateTask(savedTask);
+```
+
+## 69. arches: `CG-QUAL-104` (agree_known)
+
+- Commit: [719e7c189d](https://github.com/archesproject/arches/commit/719e7c189df8cc023d756198938d60b280be9c61), file `arches/app/media/js/views/graph-designer.js`
+- Truth: **known (equal)**, old line 775, new line 777
+- Schemes that disagree with the truth: none
+
+Before:
+
+```
+   771          };
+   772
+   773          var updateCardSelection = function() {
+   774              var graphTreeSelection = viewModel.graphTree.selectedItems().length > 0 ? viewModel.graphTree.selectedItems()[0] : null;
+>  775              var matchingCard;
+   776              if (graphTreeSelection) {
+   777                  if (graphTreeSelection.istopnode === true) {
+   778                      viewModel.cardTree.selection(viewModel.cardTree.topCards()[0]);
+   779                  } else {
+```
+After:
+
+```
+   773          };
+   774
+   775          var updateCardSelection = function() {
+   776              var graphTreeSelection = viewModel.graphTree.selectedItems().length > 0 ? viewModel.graphTree.selectedItems()[0] : null;
+>  777              var matchingCard;
+   778              if (graphTreeSelection) {
+   779                  if (graphTreeSelection.istopnode === true) {
+   780                      viewModel.cardTree.selection(viewModel.cardTree.topCards()[0]);
+   781                  } else {
+```
+
+## 70. inventree: `CG-QUAL-003` (agree_known)
+
+- Commit: [5244b8a4f2](https://github.com/inventree/InvenTree/commit/5244b8a4f21436f699ea266eb5a7381f899409f0), file `src/backend/InvenTree/plugin/registry.py`
+- Truth: **known (equal)**, old line 688, new line 689
+- Schemes that disagree with the truth: none
+
+Before:
+
+```
+   684
+   685      # endregion
+   686
+   687      # region general internal loading / activating / deactivating / unloading
+>  688      def _init_plugin(self, plugin, configs: dict):
+   689          """Initialise a single plugin.
+   690
+   691          Args:
+   692              plugin: Plugin module
+```
+After:
+
+```
+   685
+   686      # endregion
+   687
+   688      # region general internal loading / activating / deactivating / unloading
+>  689      def _init_plugin(self, plugin, configs: dict):
+   690          """Initialise a single plugin.
+   691
+   692          Args:
+   693              plugin: Plugin module
+```
+
+## 71. readthedocs: `CG-SEC-002` (agree_known)
+
+- Commit: [6b9919fd28](https://github.com/readthedocs/readthedocs.org/commit/6b9919fd2891a30f9f75a99c81fd71d6f09bb821), file `readthedocs/rtd_tests/tests/test_api.py`
+- Truth: **known (equal)**, old line 762, new line 759
+- Schemes that disagree with the truth: none
+
+Before:
+
+```
+   758
+   759      def test_create_key_for_project_with_long_slug(self):
+   760          user = get(User)
+   761          project = get(Project, users=[user], slug="a" * 60)
+>  762          build_api_key_obj, build_api_key = BuildAPIKey.objects.create_key(project)
+   763          self.assertTrue(BuildAPIKey.objects.is_valid(build_api_key))
+   764          self.assertEqual(build_api_key_obj.name, "a" * 50)
+   765
+   766      def test_revoke_build_api_key(self):
+```
+After:
+
+```
+   755
+   756      def test_create_key_for_project_with_long_slug(self):
+   757          user = get(User)
+   758          project = get(Project, users=[user], slug="a" * 60)
+>  759          build_api_key_obj, build_api_key = BuildAPIKey.objects.create_key(project)
+   760          self.assertTrue(BuildAPIKey.objects.is_valid(build_api_key))
+   761          self.assertEqual(build_api_key_obj.name, "a" * 50)
+   762
+   763      def test_revoke_build_api_key(self):
+```
+
+## 72. arches: `CG-QUAL-104` (agree_known)
+
+- Commit: [fbfb7c9092](https://github.com/archesproject/arches/commit/fbfb7c909265301e0945f9bad49f5c68ae2a76da), file `arches/app/media/js/viewmodels/map-editor.js`
+- Truth: **known (equal)**, old line 358, new line 359
+- Schemes that disagree with the truth: none
+
+Before:
+
+```
+   354          map.jumpTo(camera);
+   355      };
+   356
+   357      this.editGeoJSON = function (features, nodeId) {
+>  358          var geoJSONString = JSON.stringify(
+   359              {
+   360                  type: "FeatureCollection",
+   361                  features: features,
+   362              },
+```
+After:
+
+```
+   355          map.jumpTo(camera);
+   356      };
+   357
+   358      this.editGeoJSON = function (features, nodeId) {
+>  359          var geoJSONString = JSON.stringify(
+   360              {
+   361                  type: "FeatureCollection",
+   362                  features: features,
+   363              },
+```
+
+## 73. defectdojo: `CG-QUAL-104` (agree_known)
+
+- Commit: [7e2af4942c](https://github.com/DefectDojo/django-DefectDojo/commit/7e2af4942cfddf89ecace7bffb35c0d006d76a53), file `dojo/static/dojo/js/metrics.js`
+- Truth: **known (equal)**, old line 836, new line 836
+- Schemes that disagree with the truth: none
+
+Before:
+
+```
+   832      var min = opts.min || 0;
+   833      var range = max - min;
+   834      var pct = range > 0 ? ((value - min) / range) * 100 : 0;
+   835      var remaining = 100 - pct;
+>  836      var title = opts.title || '';
+   837      var label = opts.label || '';
+   838
+   839      // Pick colour based on percentage
+   840      var color;
+```
+After:
+
+```
+   832      var min = opts.min || 0;
+   833      var range = max - min;
+   834      var pct = range > 0 ? ((value - min) / range) * 100 : 0;
+   835      var remaining = 100 - pct;
+>  836      var title = opts.title || '';
+   837      var label = opts.label || '';
+   838
+   839      // Pick colour based on percentage
+   840      var color;
+```
+
+## 74. ckan: `CG-QUAL-003` (agree_known)
+
+- Commit: [ea3c0fd881](https://github.com/ckan/ckan/commit/ea3c0fd8814de0fa83e744bcb4d5ab5a93902a34), file `ckan/logic/action/update.py`
+- Truth: **known (equal)**, old line 474, new line 500
+- Schemes that disagree with the truth: none
+
+Before:
+
+```
+   470
+   471      return pkg_custom
+   472
+   473
+>  474  def package_revise(context: Context, data_dict: DataDict) -> ActionResult.PackageRevise:
+   475      '''Revise a dataset (package) selectively with match, filter and
+   476      update parameters.
+   477
+   478      You must be authorized to edit the dataset and the groups that it belongs
+```
+After:
+
+```
+   496
+   497      return pkg_custom
+   498
+   499
+>  500  def package_revise(context: Context, data_dict: DataDict) -> ActionResult.PackageRevise:
+   501      '''Revise a dataset (package) selectively with match, filter and
+   502      update parameters.
+   503
+   504      You must be authorized to edit the dataset and the groups that it belongs
+```
+
+## 75. geonode: `CG-SEC-002` (agree_known)
+
+- Commit: [e653caf78f](https://github.com/GeoNode/geonode/commit/e653caf78f3567996934967448a7e959db44236e), file `geonode/utils.py`
+- Truth: **known (equal)**, old line 1061, new line 1061
+- Schemes that disagree with the truth: none
+
+Before:
+
+```
+  1057          self.backoff_factor = 0.3
+  1058          self.pool_connections = 10
+  1059          self.status_forcelist = (500, 502, 503, 504)
+  1060          self.username = "admin"
+> 1061          self.password = "admin"
+  1062          if check_ogc_backend(geoserver.BACKEND_PACKAGE):
+  1063              ogc_server_settings = settings.OGC_SERVER["default"]
+  1064              self.timeout = ogc_server_settings.get("TIMEOUT", 5)
+  1065              self.retries = ogc_server_settings.get("MAX_RETRIES", 1)
+```
+After:
+
+```
+  1057          self.backoff_factor = 0.3
+  1058          self.pool_connections = 10
+  1059          self.status_forcelist = (500, 502, 503, 504)
+  1060          self.username = "admin"
+> 1061          self.password = "admin"
+  1062          if check_ogc_backend(geoserver.BACKEND_PACKAGE):
+  1063              ogc_server_settings = settings.OGC_SERVER["default"]
+  1064              self.timeout = ogc_server_settings.get("TIMEOUT", 5)
+  1065              self.retries = ogc_server_settings.get("MAX_RETRIES", 1)
+```
+
+## 76. geonode: `CG-QUAL-002` (agree_known)
+
+- Commit: [e653caf78f](https://github.com/GeoNode/geonode/commit/e653caf78f3567996934967448a7e959db44236e), file `geonode/utils.py`
+- Truth: **known (equal)**, old line 377, new line 377
+- Schemes that disagree with the truth: none
+
+Before:
+
+```
+   373              if ":" in dataset.alternate:
+   374                  _name = dataset.alternate.split(":")[1]
+   375              else:
+   376                  _name = dataset.alternate
+>  377      except Exception:
+   378          pass
+   379      return _name
+   380
+   381
+```
+After:
+
+```
+   373              if ":" in dataset.alternate:
+   374                  _name = dataset.alternate.split(":")[1]
+   375              else:
+   376                  _name = dataset.alternate
+>  377      except Exception:
+   378          pass
+   379      return _name
+   380
+   381
+```
+
+## 77. erpnext: `CG-QUAL-005` (agree_known)
+
+- Commit: [028a9ed1d9](https://github.com/frappe/erpnext/commit/028a9ed1d94ce99702dd65b32ca3aede52b52006), file `erpnext/stock/doctype/pick_list/pick_list.py`
+- Truth: **known (equal)**, old line 1354, new line 1451
+- Schemes that disagree with the truth: none
+
+Before:
+
+```
+  1350  	item_location_map[item_doc.item_code] = available_locations
+  1351  	return locations
+  1352
+  1353
+> 1354  def get_available_item_locations(
+  1355  	item_code,
+  1356  	from_warehouses,
+  1357  	required_qty,
+  1358  	company,
+```
+After:
+
+```
+  1447  	item_location_map[item_doc.item_code] = available_locations
+  1448  	return locations
+  1449
+  1450
+> 1451  def get_available_item_locations(
+  1452  	item_code,
+  1453  	from_warehouses,
+  1454  	required_qty,
+  1455  	company,
+```
+
+## 78. kitsune: `CG-QUAL-104` (agree_known)
+
+- Commit: [7558489f48](https://github.com/mozilla/kitsune/commit/7558489f48358f1f90ab0dfd5e4cc1a285240693), file `kitsune/sumo/static/sumo/js/markup.js`
+- Truth: **known (equal)**, old line 421, new line 568
+- Schemes that disagree with the truth: none
+
+Before:
+
+```
+   417          '</ol><div class="submit sumo-button-wrap align-full reverse-on-desktop"><button type="button" class="sumo-button primary-button"></button>' +
+   418          '<a href="#cancel" class="kbox-cancel sumo-button secondary-button">' + gettext("Cancel") +
+   419          "</a></div></section>"
+   420      );
+>  421      var selectedText = me.getSelectedText();
+   422      var kbox;
+   423
+   424      html.querySelectorAll('li input[type="text"]').forEach(function (input) {
+   425        input.addEventListener("focus", function () {
+```
+After:
+
+```
+   564          '</ol><div class="submit sumo-button-wrap align-full reverse-on-desktop"><button type="button" class="sumo-button primary-button"></button>' +
+   565          '<a href="#cancel" class="kbox-cancel sumo-button secondary-button">' + gettext("Cancel") +
+   566          "</a></div></section>"
+   567      );
+>  568      var selectedText = me.getSelectedText();
+   569      var kbox;
+   570
+   571      html.querySelectorAll('li input[type="text"]').forEach(function (input) {
+   572        input.addEventListener("focus", function () {
+```
+
+## 79. inventree: `CG-QUAL-101` (agree_known)
+
+- Commit: [02da01dfec](https://github.com/inventree/InvenTree/commit/02da01dfec309ac410e846a57d329d0e96b90e21), file `src/frontend/src/pages/stock/TransferOrderDetail.tsx`
+- Truth: **known (equal)**, old line 160, new line 166
+- Schemes that disagree with the truth: none
+
+Before:
+
+```
+   156            order.status != toStatus.COMPLETE
+   157              ? t`Allocated Stock`
+   158              : t`Transferred Stock`,
+   159          icon:
+>  160            order.status != toStatus.COMPLETE ? (
+   161              <IconBookmark />
+   162            ) : (
+   163              <IconListCheck />
+   164            ),
+```
+After:
+
+```
+   162            order.status != toStatus.COMPLETE
+   163              ? t`Allocated Stock`
+   164              : t`Transferred Stock`,
+   165          icon:
+>  166            order.status != toStatus.COMPLETE ? (
+   167              <IconBookmark />
+   168            ) : (
+   169              <IconListCheck />
+   170            ),
+```
+
+## 80. kitsune: `CG-QUAL-104` (agree_known)
+
+- Commit: [59b6937db5](https://github.com/mozilla/kitsune/commit/59b6937db573505c764bec9c87bd786981848487), file `kitsune/sumo/static/sumo/js/markup.js`
+- Truth: **known (equal)**, old line 633, new line 633
+- Schemes that disagree with the truth: none
+
+Before:
+
+```
+   629      this.closeTag = "";
+   630      this.defaultText = "";
+   631    },
+   632    openModal: function (ev) {
+>  633      var me = this;
+   634      var editorEl = me.textarea.closest(".editor");
+   635      var mediaSearchUrl = editorEl ? editorEl.dataset.mediaSearchUrl : undefined;
+   636      var galleryUrl = editorEl ? editorEl.dataset.mediaGalleryUrl : "";
+   637      var html = parseHTML(
+```
+After:
+
+```
+   629      this.closeTag = "";
+   630      this.defaultText = "";
+   631    },
+   632    openModal: function (ev) {
+>  633      var me = this;
+   634      var editorEl = me.textarea.closest(".editor");
+   635      var mediaSearchUrl = editorEl ? editorEl.dataset.mediaSearchUrl : undefined;
+   636      var galleryUrl = editorEl ? editorEl.dataset.mediaGalleryUrl : "";
+   637      var html = parseHTML(
+```
+
+## 81. ckan: `CG-QUAL-104` (agree_new)
+
+- Commit: [9c010ae0a9](https://github.com/ckan/ckan/commit/9c010ae0a9dca9967292563ad856ca99079b891f), file `ckan/public/base/javascript/modules/autocomplete.js`
+- Truth: **new**, new line 77
+- Schemes that disagree with the truth: none
+
+After:
+
+```
+    73            settings.multiple = "multiple"
+    74
+    75            // tokenizer is not applied when custom data adapter is used
+    76            if (settings.tokenSeparators != null) {
+>   77              var Tokenizer = $.fn.select2.amd.require('select2/data/tokenizer');
+    78              settings.dataAdapter = Utils.Decorate(settings.dataAdapter, Tokenizer);
+    79            }
+    80          }
+    81
+```
+
+Diff near the line:
+
+```diff
+@@ -50,33 +49,52 @@ this.ckan.module('autocomplete', function (jQuery) {
+     setupAutoComplete: function () {
+       var settings = {
+         width: 'resolve',
+-        formatResult: this.formatResult,
+-        formatNoMatches: this.formatNoMatches,
+-        formatInputTooShort: this.formatInputTooShort,
+-        formatSearching: this.formatSearching,
++        templateResult: this.templateResult,
++        language: {
++          noResults: this.formatNoMatches,
++          inputTooShort: this.formatInputTooShort,
++          searching: this.formatSearching,
++        },
+         dropdownCssClass: this.options.dropdownClass,
+-        containerCssClass: this.options.containerClass,
+         tokenSeparators: this.options.tokensep.split(''),
+-        minimumInputLength: this.options.minimumInputLength
++        minimumInputLength: this.options.minimumInputLength,
++        selectionCssClass: this.options.containerClass
+       };
+
+       // Different keys are required depending on whether the select is
+       // tags or generic completion.
+       if (!this.el.is('select')) {
+-        if (this.options.tags) {
+-          settings.tags = this._onQuery;
+-
+-          // Disable creating new tags
+-          if (!this.options.createtags) {
+-            settings.createSearchChoice = function(params) {
+-              return undefined;
+-            }
++
++        settings.dataAdapter = this.dataAdapter();
++        if ( this.options.tags ){
++          var Utils = $.fn.select2.amd.require('select2/utils');
++          var Tags = $.fn.select2.amd.require('select2/data/tags');
++          settings.dataAdapter = Utils.Decorate(settings.dataAdapter, Tags)
++          settings.multiple = "multiple"
+... (31 more lines)
+```
+
+## 82. lnbits: `CG-SEC-105` (agree_new)
+
+- Commit: [653924a6dc](https://github.com/lnbits/lnbits/commit/653924a6dcb6d821a9dae32cd9aac5d287351c57), file `lnbits/static/i18n/fo.js`
+- Truth: **new**, new line 300
+- Schemes that disagree with the truth: none
+
+After:
+
+```
+   296    notifications_configure: 'Fráboðanaruppsetan',
+   297    notifications_nostr_config: 'Nostr uppsetan',
+   298    notifications_enable_nostr: 'Virkja Nostr fráboðanir',
+   299    notifications_enable_nostr_desc: 'Send fráboðanir umvegis Nostr',
+>  300    notifications_nostr_private_key: 'Nostr privatur lykil',
+   301    notifications_nostr_private_key_desc:
+   302      'Privatur lykil, í sekstandatal ella nsec skapi, at undirrita boð send til Nostr',
+   303    notifications_nostr_identifier: 'Nostr-dátuheiti',
+   304    notifications_nostr_identifier_desc:
+```
+
+Diff near the line:
+
+```diff
+@@ -0,0 +1,901 @@
++window.localisation.fo = {
++  confirm: 'Ja',
++  server: 'Ambætari',
++  theme: 'Snið',
++  site_customisation: 'Vevsíðu tillagingar',
++  funding: 'Fígging',
++  users: 'Brúkarar',
++  audit: 'Slóðfesti',
++  api_watch: 'API nýtsluyvirlit',
++  apps: 'Appir',
++  channels: 'Rásir',
++  transactions: 'Flytingar',
++  dashboard: 'Yvirlitssýni',
++  node: 'Knútur',
++  export_users: 'Tak brúkarar út',
++  no_users: 'Eingin brúkari finst',
++  total_capacity: 'Samlað rásarupphædd',
++  avg_channel_size: 'Miðal rásarupphædd',
++  biggest_channel_size: 'Størsta rásarupphædd',
++  smallest_channel_size: 'Minsta rásarupphædd',
++  number_of_channels: 'Tal av rásum',
++  active_channels: 'Virknar rásir',
++  connect_peer: 'Sambind við javninga',
++  connect: 'Sambind',
++  reconnect: 'Sambind aftur',
++  open_channel: 'Ger rás',
++  open: 'Lat upp',
++  clear: 'Tómstilla',
++  close_channel: 'Loka rás',
++  close: 'Loka',
++  restart: 'Endurbyrja ambætara',
++  image_library: 'Myndasavn',
++  save: 'Goym',
++  save_tooltip: 'Goym broytingarnar',
++  must_save: 'Tú hevur framt broytingar ið enn ikki eru goymdar.',
++  credit_debit: 'Góðskriva / Skuldskriva',
++  credit_hint:
++    'Trýst á Enter til tess at góðskriva/skuldskriva mappu (negativ viðri eru loyvd)',
++  credit_label: '{denomination} at góðskriva/skuldskriva',
+... (863 more lines)
+```
+
+## 83. openlibrary: `CG-QUAL-003` (agree_new)
+
+- Commit: [ff9577a078](https://github.com/internetarchive/openlibrary/commit/ff9577a078ac1492c1ce4cef0bd53b69e98a692e), file `openlibrary/bookworm/cli.py`
+- Truth: **new**, new line 406
+- Schemes that disagree with the truth: none
+
+After:
+
+```
+   402          return MATCHED_EXPECTED, matched_key, expected
+   403      return MATCHED_OTHER, matched_key, expected
+   404
+   405
+>  406  def preview_command(
+   407      ol_config: str = "/openlibrary/conf/openlibrary.yml",
+   408      provider: str = "",
+   409      limit: int | None = None,
+   410      expect_edition_ids: bool = True,
+```
+
+Diff near the line:
+
+```diff
+@@ -0,0 +1,520 @@
++#!/usr/bin/env python
++"""Command line for the BookWorm feed harvest (#12844).
++
++Three commands, all needing ``--ol-config`` because it supplies both the
++database connection and -- on hosts that egress through a proxy -- the settings
++without which no provider feed is reachable at all::
++
++    python -m openlibrary.bookworm.cli harvest  --ol-config /olsystem/etc/openlibrary.yml
++    python -m openlibrary.bookworm.cli register --ol-config /olsystem/etc/openlibrary.yml --show
++    python -m openlibrary.bookworm.cli preview  --ol-config /olsystem/etc/openlibrary.yml --provider lenny
++
++``harvest`` is the cron entrypoint: one pass over every active feed, then exit,
++so the crontab can see a non-zero status. ``register`` puts the feed list in git
++rather than in hand-typed SQL. ``preview`` reports what the catalog would match
++without writing anything, for diagnosing a feed that looks wrong.
++
++Run ``<command> --help`` for each one's options. The harvest logic itself is in
++``harvest.py``; this module is only the interface to it.
++"""
++
++import datetime
++import logging
++import sys
++import time
++from collections import Counter
++from collections.abc import Callable
++from urllib.parse import urlparse
++
++from infogami import config
++from openlibrary.bookworm import harvest
++from openlibrary.bookworm.registry import (
++    CURSOR_MODIFIED_SINCE,
++    STATUS_ACTIVE,
++    FeedRegistry,
++)
++from openlibrary.catalog.add_book import load
++from openlibrary.config import load_config
++from openlibrary.plugins.upstream.utils import setup_requests
++from scripts.solr_builder.solr_builder.fn_to_cli import FnToCLI
+... (482 more lines)
+```
+
+## 84. inventree: `CG-QUAL-101` (agree_new)
+
+- Commit: [99893f3453](https://github.com/inventree/InvenTree/commit/99893f3453c6a213a331c022e82cbafbde7ebd51), file `src/frontend/src/components/tables/InvenTreeTable.tsx`
+- Truth: **new**, new line 940
+- Schemes that disagree with the truth: none
+
+After:
+
+```
+   936          params: queryParams,
+   937          timeout: 10 * 1000
+   938        })
+   939        .then((response) => {
+>  940          if (generation != nestedGeneration.current) {
+   941            return;
+   942          }
+   943
+   944          let results = response.data?.results ?? response.data ?? [];
+```
+
+Diff near the line:
+
+```diff
+@@ -776,6 +862,170 @@ export function InvenTreeTableInternal<T extends Record<string, any>>({
+     tableState.setRecords(tableData ?? apiData ?? []);
+   }, [tableData, apiData]);
+
++  // Serialized params, so that nested data is not discarded on every render
++  const paramsKey: string = useMemo(
++    () => JSON.stringify(tableProps.params ?? {}),
++    [tableProps.params]
++  );
++
++  // Discard nested data whenever the top-level table data is reloaded,
++  // or the nesting configuration changes (as child rows depend on it)
++  useEffect(() => {
++    nestedGeneration.current += 1;
++    // Keep the existing (empty) state object to avoid a needless re-render
++    setNestedState((state) => (Object.keys(state).length > 0 ? {} : state));
++  }, [
++    props.nestedRows,
++    url,
++    tableData,
++    apiData,
++    paramsKey,
++    pageSize,
++    sortStatus,
++    tableState.page,
++    tableState.searchTerm,
++    tableState.tableKey,
++    tableState.filterSet.activeFilters,
++    tableSearchParams
++  ]);
++
++  // Expand or collapse a nested row, fetching child rows if required
++  toggleNestedRow.current = (record: T) => {
++    const nestedRows = props.nestedRows;
++
++    if (!nestedRows || !url) {
++      return;
++    }
++
++    const key = getRowKey(record);
+... (131 more lines)
+```
+
+## 85. calcom: `CG-QUAL-103` (agree_new)
+
+- Commit: [0d164da8dd](https://github.com/calcom/cal.com/commit/0d164da8ddc68474300dc85677856950ef81ee7e), file `apps/web/playwright/fixtures/users.ts`
+- Truth: **new**, new line 813
+- Schemes that disagree with the truth: none
+
+After:
+
+```
+   809    profileUsername?: string;
+   810  };
+   811
+   812  // creates the actual user in the db.
+>  813  const createUser = (
+   814    workerInfo: WorkerInfo,
+   815    opts?:
+   816      | (CustomUserOpts & {
+   817          organizationId?: number | null;
+```
+
+Diff near the line:
+
+```diff
+(no diff hunk near this line)
+```
+
+## 86. erpnext: `CG-QUAL-104` (agree_new)
+
+- Commit: [8c85cef29b](https://github.com/frappe/erpnext/commit/8c85cef29b0b80a23a499516a94d4319cf45503d), file `erpnext/stock/doctype/landed_cost_voucher/landed_cost_voucher.js`
+- Truth: **new**, new line 119
+- Schemes that disagree with the truth: none
+
+After:
+
+```
+   115  				});
+   116
+   117  				var charge_precision = precision("applicable_charges", items[0]);
+   118  				var total = flt(this.frm.doc.total_taxes_and_charges);
+>  119  				var sign = total < 0 ? -1 : 1;
+   120  				var diff = flt(total - total_charges, charge_precision);
+   121  				for (const item of items.slice().reverse()) {
+   122  					if (!diff) break;
+   123  					var share = flt(item.applicable_charges) * sign;
+```
+
+Diff near the line:
+
+```diff
+@@ -114,9 +114,19 @@ erpnext.stock.LandedCostVoucher = class LandedCostVoucher extends erpnext.stock.
+ 					total_charges += item.applicable_charges;
+ 				});
+
+-				if (total_charges != this.frm.doc.total_taxes_and_charges) {
+-					var diff = this.frm.doc.total_taxes_and_charges - flt(total_charges);
+-					items.slice(-1)[0].applicable_charges += diff;
++				var charge_precision = precision("applicable_charges", items[0]);
++				var total = flt(this.frm.doc.total_taxes_and_charges);
++				var sign = total < 0 ? -1 : 1;
++				var diff = flt(total - total_charges, charge_precision);
++				for (const item of items.slice().reverse()) {
++					if (!diff) break;
++					var share = flt(item.applicable_charges) * sign;
++					var adjustment = diff * sign > 0 ? diff : sign * Math.max(diff * sign, -share);
++					item.applicable_charges = flt(
++						flt(item.applicable_charges) + adjustment,
++						charge_precision
++					);
++					diff = flt(diff - adjustment, charge_precision);
+ 				}
+ 				refresh_field("items");
+ 			}
+
+```
+
+## 87. hoppscotch: `CG-PERF-101` (agree_new)
+
+- Commit: [e633b55a0b](https://github.com/hoppscotch/hoppscotch/commit/e633b55a0b9da30f3d6ddefcc9ab3c393cd52be8), file `packages/hoppscotch-common/src/services/__tests__/ai-chat-ui.spec.ts`
+- Truth: **new**, new line 325
+- Schemes that disagree with the truth: none
+
+After:
+
+```
+   321        ]
+   322
+   323        for (const prompt of prompts) {
+   324          chat.pendingConfirmation.value = null
+>  325          await nextTick()
+   326          i18n.keys.length = 0
+   327          chat.pendingConfirmation.value = {
+   328            name: "A",
+   329            workspace: null,
+```
+
+Diff near the line:
+
+```diff
+@@ -0,0 +1,996 @@
++/* eslint-disable vue/one-component-per-file */
++import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"
++import { TestContainer } from "dioc/testing"
++import { diocPlugin } from "dioc/vue"
++import * as E from "fp-ts/Either"
++import { BehaviorSubject } from "rxjs"
++import { createApp, defineComponent, h, nextTick, ref, type App } from "vue"
++import { createMemoryHistory, createRouter } from "vue-router"
++
++vi.mock("~/modules/i18n", () => ({
++  getI18n: () => (key: string) => key,
++  APP_LANGUAGES: [],
++  changeAppLanguage: () => {},
++}))
++// Records each key; params show as "key(a|b)" so a test can see them.
++const i18n = vi.hoisted(() => ({ keys: [] as string[] }))
++vi.mock("~/composables/i18n", () => ({
++  useI18n: () => (key: string, params?: Record<string, unknown>) => {
++    i18n.keys.push(key)
++    return params ? `${key}(${Object.values(params).join("|")})` : key
++  },
++}))
++
++const ai = vi.hoisted(() => ({
++  enableAIExperiments: true,
++  chat: undefined as unknown,
++  getChatAvailability: undefined as unknown,
++  generateRequestName: undefined as unknown,
++}))
++// A fresh stream per test, so services from earlier tests stop listening.
++const auth = vi.hoisted(() => ({
++  user$: null as null | { value: unknown; next(v: unknown): void },
++}))
++vi.mock("~/platform", () => ({
++  platform: {
++    experiments: { aiExperiments: ai },
++    auth: {
++      getCurrentUser: () => auth.user$!.value,
++      getCurrentUserStream: () => auth.user$,
+... (958 more lines)
+```
+
+## 88. lnbits: `CG-QUAL-003` (agree_new)
+
+- Commit: [7eb9965205](https://github.com/lnbits/lnbits/commit/7eb996520584b3da9ed865c944e11ddbd2095998), file `tests/api/test_admin_api.py`
+- Truth: **new**, new line 151
+- Schemes that disagree with the truth: none
+
+After:
+
+```
+   147      server_restart.clear()
+   148
+   149
+   150  @pytest.mark.anyio
+>  151  async def test_admin_delete_settings_requires_superuser(
+   152      client: AsyncClient, superuser_token: str
+   153  ):
+   154      await set_settings_field("lnbits_site_title", "Reset me")
+   155      await set_settings_field("lnbits_backend_wallet_class", "BoltzWallet")
+```
+
+Diff near the line:
+
+```diff
+@@ -150,6 +151,15 @@ async def test_admin_partial_reset_restart_and_backup(
+ async def test_admin_delete_settings_requires_superuser(
+     client: AsyncClient, superuser_token: str
+ ):
++    await set_settings_field("lnbits_site_title", "Reset me")
++    await set_settings_field("lnbits_backend_wallet_class", "BoltzWallet")
++    await set_settings_field("boltz_mnemonic", "keep boltz seed")
++    await set_settings_field("boltz_mnemonic_backup_confirmed", True)
++    await set_settings_field("phoenixd_mnemonic", "keep phoenixd seed")
++    await set_settings_field("phoenixd_mnemonic_backup_confirmed", True)
++    await set_settings_field("spark_l2_mnemonic", "keep spark seed")
++    await set_settings_field("spark_l2_mnemonic_backup_confirmed", True)
++
+     server_restart.clear()
+     response = await client.delete(
+         "/admin/api/v1/settings",
+```
+
+## 89. netbox: `CG-SEC-001` (agree_new)
+
+- Commit: [9d96894f4e](https://github.com/netbox-community/netbox/commit/9d96894f4e1c622c25de40ccca5847efa5e15153), file `netbox/utilities/tests/test_ltree.py`
+- Truth: **new**, new line 1184
+- Schemes that disagree with the truth: none
+
+After:
+
+```
+  1180
+  1181      def drop_cascade_trigger(self):
+  1182          """Leave the table as a database restored from a v4.7.0 dump: no cascade trigger."""
+  1183          with connection.cursor() as cursor:
+> 1184              cursor.execute(f'DROP TRIGGER IF EXISTS "{self.TRIGGER}" ON "{self.TABLE}"')
+  1185
+  1186      def install_v470_cascade_trigger(self):
+  1187          """
+  1188          Install the definition v4.7.0 shipped: bare ltree comparisons, which a dump cannot
+```
+
+Diff near the line:
+
+```diff
+@@ -992,3 +996,240 @@ class RestrictedSearchPathBackfillTests(TestCase):
+
+         self.assertEqual(len(plain_rows), 2)
+         self.assertEqual([r[0] for r in plain_rows], [_path(1), _path(1, 2)])
++
++
++class RestoreUnderRestrictedSearchPathTests(TestCase):
++    """
++    The generated trigger DDL must create with the ltree extension's schema off the
++    search_path, because that is how pg_dump replays it: dumps begin with
++    `set_config('search_path', '', false)` and schema-qualify every name they can.
++
++    `IS DISTINCT FROM` cannot be schema-qualified — it expands to the operand type's
++    `=` operator, resolved at CREATE TRIGGER time — so comparing two ltree values in a
++    WHEN clause produced a cascade trigger which silently failed to restore, leaving
++    descendant paths to go stale on the next rename or reparent (#23130). Comparing
++    `path::text` resolves `pg_catalog.text =` instead, which is always available.
++
++    The trigger functions are created with the extension's schema on the path: they
++    legitimately declare `parent_path ltree`, and pg_dump schema-qualifies those
++    declarations, so only the CREATE TRIGGER statements are under test here.
++    """
++
++    def _install_with_extension_off_path(self, schema, table, name_column):
++        with connection.cursor() as cursor:
++            cursor.execute(f'CREATE SCHEMA {schema}')
++            columns = 'id bigint PRIMARY KEY, parent_id bigint, path ltree, name text'
++            if name_column:
++                columns += ', sort_path text'
++            cursor.execute(f'SET LOCAL search_path = {schema}, public')
++            cursor.execute(f'CREATE TABLE {schema}.{table} ({columns})')
++
++            statements = ltree_trigger_sql(table, name_column)
++            functions = [s for s in statements if 'CREATE OR REPLACE FUNCTION' in s]
++            triggers = [s for s in statements if 'CREATE TRIGGER' in s]
++            self.assertEqual(len(functions), 2)
++            self.assertEqual(len(triggers), 2)
++
++            # Pass an empty parameter list, as schema_editor.execute() does during a
++            # migration: the function bodies double their literal percent signs for
+... (202 more lines)
+```
+
+## 90. lnbits: `CG-PERF-101` (agree_new)
+
+- Commit: [c0806ca59c](https://github.com/lnbits/lnbits/commit/c0806ca59c90464e424f881a92efd8033fd9bd2b), file `tests/e2e/extension-helpers.ts`
+- Truth: **new**, new line 540
+- Schemes that disagree with the truth: none
+
+After:
+
+```
+   536    await expect(tab).toBeVisible({timeout: 60_000})
+   537    for (let attempt = 0; attempt < 3; attempt += 1) {
+   538      await tab.click()
+   539      try {
+>  540        await expect(tab).toHaveAttribute('aria-selected', 'true', {
+   541          timeout: 5_000
+   542        })
+   543        return
+   544      } catch (_error) {
+```
+
+Diff near the line:
+
+```diff
+@@ -0,0 +1,658 @@
++import {expect, type Frame, type Locator, type Page} from '@playwright/test'
++
++import {
++  browserJson,
++  delay,
++  isRecord,
++  type LNbitsE2EServer,
++  waitForResult
++} from './fixtures'
++
++const INSTALLABLE_EXTENSION_REFRESH_TASK =
++  'refresh_installable_extensions_cache'
++
++export type ExtensionUnderTest = {
++  extId: string
++  manifestUrl: string
++  name: string
++  permissionTexts?: string[]
++  repository: string
++}
++
++export type E2EWallet = {
++  adminkey: string
++  id: string
++  inkey: string
++  name: string
++}
++
++export async function login(
++  page: Page,
++  server: LNbitsE2EServer
++): Promise<void> {
++  await page.goto('/')
++  await page.locator('input[name="username"]').fill(server.username)
++  await page.locator('input[name="password"]').fill(server.password)
++  await page.getByRole('button', {name: /^login$/i}).click()
++  await expect(page).toHaveURL(/\/wallet\/[^/]+$/)
++  await dismissDisclaimer(page)
++}
+... (620 more lines)
+```
+
+## 91. calcom: `CG-SEC-105` (agree_new)
+
+- Commit: [089a39f59f](https://github.com/calcom/cal.com/commit/089a39f59f39f4cd613ab0064dc23117b080c538), file `apps/api/v2/src/ee/bookings/2024-08-13/controllers/e2e/update-booking-location.e2e-spec.ts`
+- Truth: **new**, new line 529
+- Schemes that disagree with the truth: none
+
+After:
+
+```
+   525
+   526        it("can update location to type integration (office365-video)", async () => {
+   527          const office365Credential = await credentialsRepositoryFixture.create(
+   528            "office365_calendar",
+>  529            { access_token: "mock", refresh_token: "mock", expiry_date: Date.now() + 3600000 },
+   530            testSetup.organizer.id,
+   531            "office365-calendar"
+   532          );
+   533
+```
+
+Diff near the line:
+
+```diff
+@@ -322,6 +387,219 @@ describe("Bookings Endpoints 2024-08-13 update booking location", () => {
+         expect(updatedBooking.location).toEqual(attendeeDefinedLocation);
+       });
+
++      it("can update location to type integration (cal-video)", async () => {
++        const updatedBookingBody: UpdateBookingLocationInput_2024_08_13 = {
++          location: {
++            type: "integration",
++            integration: "cal-video",
++          },
++        };
++
++        const updatedBookingResponse = await request(app.getHttpServer())
++          .patch(`/v2/bookings/${bookingUid}/location`)
++          .send(updatedBookingBody)
++          .set(CAL_API_VERSION_HEADER, VERSION_2024_08_13)
++          .set("Authorization", `Bearer ${testSetup.organizer.accessToken}`)
++          .expect(200);
++
++        const updatedBookingResponseBody: UpdateBookingLocationOutput_2024_08_13 =
++          updatedBookingResponse.body;
++        expect(updatedBookingResponseBody.status).toEqual(SUCCESS_STATUS);
++        if (!responseDataIsBooking(updatedBookingResponseBody.data)) {
++          throw new Error(
++            "Invalid response data - expected booking but received array of possibly recurring bookings"
++          );
++        }
++        const updatedBooking = updatedBookingResponseBody.data as BookingOutput_2024_08_13;
++        expect(updatedBooking).toHaveProperty("id");
++        // cal-video location should be either a Daily video URL or the internal location string
++        expect(
++          updatedBooking.location?.startsWith("http") || updatedBooking.location === "integrations:daily"
++        ).toBe(true);
++      });
++
++      it("can update location to type integration (google-meet)", async () => {
++        const googleCredential = await credentialsRepositoryFixture.create(
++          "google_calendar",
++          { access_token: "mock", refresh_token: "mock", expiry_date: Date.now() + 3600000 },
++          testSetup.organizer.id,
+... (181 more lines)
+```
+
+## 92. edx-platform: `CG-SEC-002` (agree_new)
+
+- Commit: [294f05f57e](https://github.com/openedx/edx-platform/commit/294f05f57e3ba73c59b31394cbc2f2c9d6808c14), file `cms/djangoapps/contentstore/rest_api/v1/views/tests/test_course_index.py`
+- Truth: **new**, new line 279
+- Schemes that disagree with the truth: none
+
+After:
+
+```
+   275
+   276      @override_waffle_flag(core_toggles.AUTHZ_COURSE_AUTHORING_FLAG, active=False)
+   277      def test_reindex_link_absent_for_course_staff_without_global_staff(self):
+   278          """A course-staff member who isn't Global Staff does not see the reindex link."""
+>  279          course_staff_user, password = self.create_non_staff_user()
+   280          CourseStaffRole(self.course.id).add_users(course_staff_user)
+   281
+   282          client = AjaxEnabledTestClient()
+   283          client.login(username=course_staff_user.username, password=password)
+```
+
+Diff near the line:
+
+```diff
+@@ -224,3 +226,72 @@ class CourseIndexAuthzViewTest(CourseAuthoringAuthzTestMixin, CourseTestCase):
+
+         assert response.status_code == status.HTTP_200_OK
+         assert "course_structure" in response.data
++
++
++class CourseIndexViewReindexLinkAuthzTest(CourseAuthoringAuthzTestMixin, CourseTestCase):
++    """
++    Regression tests: with AuthZ course authoring enabled, `reindex_link` (and therefore the
++    Reindex button in the course-authoring MFE) must follow the same access rules as the actual
++    reindex action, not be restricted to Global Staff only.
++    """
++
++    def setUp(self):
++        super().setUp()
++        self.url = reverse("cms.djangoapps.contentstore:v1:course_index", kwargs={"course_id": self.course.id})
++
++    def test_reindex_link_present_for_non_global_staff_with_authz_permission(self):
++        """A non-global-staff user granted the AuthZ course-staff role sees the reindex link."""
++        self.add_user_to_role_in_course(self.authorized_user, COURSE_STAFF.external_key, self.course.id)
++
++        response = self.authorized_client.get(self.url)
++
++        assert response.status_code == status.HTTP_200_OK
++        assert not self.authorized_user.is_staff
++        assert response.data["reindex_link"] == f"/course/{self.course.id}/search_reindex"
++
++    def test_reindex_link_absent_without_reindex_permission(self):
++        """
++        A user with enough AuthZ permission to view the course (COURSE_EDITOR) but without the
++        publish-content permission required to reindex does not see the reindex link.
++        """
++        self.add_user_to_role_in_course(self.authorized_user, COURSE_EDITOR.external_key, self.course.id)
++
++        response = self.authorized_client.get(self.url)
++
++        assert response.status_code == status.HTTP_200_OK
++        assert response.data["reindex_link"] is None
++
++
+... (34 more lines)
+```
+
+## 93. uptime-kuma: `CG-PERF-101` (agree_new)
+
+- Commit: [e62702d868](https://github.com/louislam/uptime-kuma/commit/e62702d868a0b072c6e1870e5278762319637f04), file `server/notification-providers/indigo.js`
+- Truth: **new**, new line 52
+- Schemes that disagree with the truth: none
+
+After:
+
+```
+    48              }
+    49              config = this.getAxiosConfigWithProxy(config);
+    50
+    51              for (const command of commands) {
+>   52                  const result = await axios.post(url, { id: "uptime-kuma", ...command }, config);
+    53                  if (result.data?.error || result.data?.validationErrors) {
+    54                      throw new Error(
+    55                          `Indigo rejected ${command.message}: ${result.data.error || JSON.stringify(result.data.validationErrors)}`
+    56                      );
+```
+
+Diff near the line:
+
+```diff
+@@ -0,0 +1,67 @@
++const NotificationProvider = require("./notification-provider");
++const axios = require("axios");
++const https = require("https");
++
++class Indigo extends NotificationProvider {
++    name = "Indigo";
++
++    /**
++     * @inheritdoc
++     */
++    async send(notification, msg, monitorJSON = null, heartbeatJSON = null) {
++        const okMsg = "Sent Successfully.";
++        const url = `${notification.indigoUrl.trim().replace(/\/*$/, "")}/v2/api/command`;
++        const variableId = parseInt(notification.indigoVariableId);
++        const actionGroupId = parseInt(notification.indigoActionGroupId);
++
++        if (!variableId && !actionGroupId) {
++            throw new Error("Set an Indigo variable ID, an action group ID, or both.");
++        }
++
++        // The variable is written first so the action group can read it.
++        const commands = [];
++        if (variableId) {
++            commands.push({
++                message: "indigo.variable.updateValue",
++                objectId: variableId,
++                parameters: { value: msg },
++            });
++        }
++        if (actionGroupId) {
++            commands.push({
++                message: "indigo.actionGroup.execute",
++                objectId: actionGroupId,
++            });
++        }
++
++        try {
++            let config = {
++                headers: {
+... (29 more lines)
+```
+
+## 94. lnbits: `CG-QUAL-005` (agree_new)
+
+- Commit: [61ed636df0](https://github.com/lnbits/lnbits/commit/61ed636df066ced4c600a5eb55af147e6d13d130), file `lnbits/core/services/extensions.py`
+- Truth: **new**, new line 268
+- Schemes that disagree with the truth: none
+
+After:
+
+```
+   264                  settings.lnbits_wasm_invocation_retention_days
+   265              )
+   266
+   267
+>  268  async def start_wasm_invocation(
+   269      *,
+   270      extension_id: str,
+   271      export_name: str,
+   272      trigger_type: str = "unknown",
+```
+
+Diff near the line:
+
+```diff
+@@ -75,6 +245,394 @@ async def check_extensions_limit(installed_ext: InstallableExtension | None = No
+         raise ValueError("Max amount of extensions have been installed")
+
+
++async def ensure_wasm_invocation_monitoring_ready() -> None:
++    global _wasm_invocations_last_cleanup_at, _wasm_invocations_marked_stale
++
++    async with _wasm_invocation_ready_lock:
++        now = _now()
++        if not _wasm_invocations_marked_stale:
++            await mark_stale_wasm_invocations()
++            _wasm_invocations_marked_stale = True
++
++        if (
++            _wasm_invocations_last_cleanup_at is None
++            or now - _wasm_invocations_last_cleanup_at
++            >= _WASM_INVOCATION_CLEANUP_INTERVAL
++        ):
++            _wasm_invocations_last_cleanup_at = now
++            await delete_old_wasm_invocations(
++                settings.lnbits_wasm_invocation_retention_days
++            )
++
++
++async def start_wasm_invocation(
++    *,
++    extension_id: str,
++    export_name: str,
++    trigger_type: str = "unknown",
++    user_id: str | None = None,
++    wallet_id: str | None = None,
++    request_id: str | None = None,
++    method: str | None = None,
++    path: str | None = None,
++    event_type: str | None = None,
++    payment_hash: str | None = None,
++    checking_id: str | None = None,
++    request_bytes: int | None = None,
++    context: dict | None = None,
++    runtime_limits: dict[str, int] | None = None,
+... (355 more lines)
+```
+
+## 95. netbox: `CG-SEC-001` (agree_new)
+
+- Commit: [8cc4548e1f](https://github.com/netbox-community/netbox/commit/8cc4548e1f51fcd4cb63299339b55e5ef179e28a), file `netbox/utilities/ltree.py`
+- Truth: **new**, new line 287
+- Schemes that disagree with the truth: none
+
+After:
+
+```
+   283              schema_editor.execute(_AFTER_TRIGGER_PATH_ONLY.format(table=self.table_name))
+   284
+   285      def database_backwards(self, app_label, schema_editor, from_state, to_state):
+   286          t = self.table_name
+>  287          schema_editor.execute(f'DROP TRIGGER IF EXISTS "{t}_ltree_cascade_path" ON "{t}";')
+   288          schema_editor.execute(f'DROP TRIGGER IF EXISTS "{t}_ltree_compute_path" ON "{t}";')
+   289          schema_editor.execute(f'DROP FUNCTION IF EXISTS "{t}_ltree_cascade_path_fn"();')
+   290          schema_editor.execute(f'DROP FUNCTION IF EXISTS "{t}_ltree_compute_path_fn"();')
+   291
+```
+
+Diff near the line:
+
+```diff
+@@ -0,0 +1,293 @@
++"""
++Migration support for ltree-based hierarchical models.
++
++This module holds the schema-level machinery that backs `netbox.models.ltree`:
++the PostgreSQL trigger function / trigger SQL and the `InstallLtreeTriggers`
++migration operation that installs them. It is kept separate from the model layer
++(`netbox.models.ltree`) so that migrations depend only on this DB-level code and
++not on the model definitions.
++
++The paths maintained by these triggers are never computed or mutated from Python;
++the model layer only reads `path`/`sort_path` back from the database.
++"""
++from django.db import migrations
++
++__all__ = (
++    'InstallLtreeTriggers',
++)
++
++
++# Path label is the row's PK zero-padded to 19 chars (max bigint width) so that
++# lexicographic ordering of ltree labels matches numeric PK ordering across digit
++# boundaries (e.g. "0...09" sorts before "0...10").
++# Per-tree advisory locking (see _lock_tree_roots_sql / LtreeModel "Concurrency"):
++# every child insert / move / reparent of a node takes a transaction-level
++# advisory lock keyed on the root(s) of the tree(s) it touches, BEFORE reading the
++# parent path. A concurrent reparent of an ancestor takes the same key, so the two
++# serialize and the AFTER cascade can never miss a row inserted concurrently;
++# writes in different trees use different keys and run in parallel. Inserting a new
++# root (parent_id IS NULL) takes no lock at all -- it is a race-free singleton tree
++# -- so a bulk import of many top-level objects does not accumulate one lock per
++# root and cannot exhaust the shared lock table.
++_LOCK_TREE_ROOTS_SQL = '''
++    -- A brand-new root (INSERT with parent_id IS NULL) starts its own singleton
++    -- tree that no concurrent transaction can yet see (MVCC: the uncommitted row
++    -- is invisible) or reference (no other transaction has its PK). For such a
++    -- row this BEFORE function reads no other row (the parent lookup below is
++    -- gated on parent_id) and the AFTER cascade fires only on UPDATE, so the
++    -- insert touches solely its own NEW row -- there is nothing to serialize
++    -- against, and the advisory lock it would otherwise take can never contend.
+... (255 more lines)
+```
+
+## 96. ckan: `CG-SEC-103` (agree_new)
+
+- Commit: [1902693db4](https://github.com/ckan/ckan/commit/1902693db45f27bd6a4b93fb0f16b83bba5f79b8), file `ckan/public/base/javascript/toast.js`
+- Truth: **new**, new line 162
+- Schemes that disagree with the truth: none
+
+After:
+
+```
+   158      wrapper.setAttribute("role", opts.style === "danger" ? "alert" : "status");
+   159      wrapper.setAttribute("aria-live", opts.style === "danger" ? "assertive" : "polite");
+   160      wrapper.setAttribute("aria-atomic", "true");
+   161
+>  162      wrapper.innerHTML = `<div id="${containerID}" class="toast-container position-fixed pb-1 ${positionClasses}"></div>`;
+   163      document.body.appendChild(wrapper);
+   164
+   165      return document.getElementById(containerID);
+   166    };
+```
+
+Diff near the line:
+
+```diff
+@@ -0,0 +1,193 @@
++(function (ckan, $) {
++
++  /**
++   * Displays Bootstrap 5 toast notifications across CKAN
++   *
++   * Usage:
++   *
++   * ckan.toast({
++   *    message: "Operation completed successfully",
++   *    type: "success",
++   *    title: "Done",
++   *    icon: "<i class='fa fa-check-circle me-2'></i>",
++   *    subtitle: "Just now",
++   *    delay: 5000,
++   *    position: "bottom-right"
++   *    stacking: false
++   * });
++   *
++   *
++   * Options:
++   * - message   (string)  [required] The main message body of the toast.
++   * - type      (string)  Optional.  Defines toast style, matches keys from `styles`. Default: "default".
++   * - title     (string)  Optional.  Text shown in the toast header.
++   * - icon      (string)  Optional.  HTML for an icon displayed before the title.
++   * - subtitle  (string)  Optional.  Text shown in the header's small subtitle area.
++   * - delay     (number)  Optional.  Time in milliseconds before auto-hide. Default: 3000.
++   * - position  (string)  Optional.  Position key controlling toast placement. Default: "bottom-right".
++   * - showProgress  (boolean) Optional.  Whether to show a progress bar. Default: false.
++   * - stacking  (boolean) Optional.  Whether to stack toasts on top of each other. Default: true.
++  */
++  var toast = function (options) {
++    if (!options || !options.message) {
++      console.error("Toast: Missing required 'message' option.");
++      return;
++    }
++
++    const opts = {
++      type: "default",
++      title: "",
+... (155 more lines)
+```
+
+## 97. healthchecks: `CG-QUAL-104` (agree_new)
+
+- Commit: [b83e3791d6](https://github.com/healthchecks/healthchecks/commit/b83e3791d6e2c276a13c0b40c2e435c6ec01125c), file `hc/integrations/po/static/js/add_pushover.js`
+- Truth: **new**, new line 7
+- Schemes that disagree with the truth: none
+
+After:
+
+```
+     3          var parts = item.text.split(":");
+     4          return `<div>${parts[0]}. <span class="help">${parts[1]}</span></div>`;
+     5      }
+     6
+>    7      var config = {
+     8          maxItems: 1,
+     9          controlInput: null,
+    10          plugins: ["no_backspace_delete"],
+    11          render: {option: makeOption, item: makeOption},
+```
+
+Diff near the line:
+
+```diff
+@@ -1,8 +1,17 @@
+ $(function() {
+     function makeOption(item, escape) {
+         var parts = item.text.split(":");
+-        return `<div class="option">${parts[0]}. <span class="help">${parts[1]}</span></div>`;
++        return `<div>${parts[0]}. <span class="help">${parts[1]}</span></div>`;
+     }
+
+-    $("select").selectize({render: {option: makeOption, item: makeOption}});
++    var config = {
++        maxItems: 1,
++        controlInput: null,
++        plugins: ["no_backspace_delete"],
++        render: {option: makeOption, item: makeOption},
++    };
++
++    document.querySelectorAll("select").forEach((el) => {
++        new TomSelect(el, config)
++    });
+ });
+\ No newline at end of file
+
+```
+
+## 98. hoppscotch: `CG-PERF-101` (agree_new)
+
+- Commit: [e633b55a0b](https://github.com/hoppscotch/hoppscotch/commit/e633b55a0b9da30f3d6ddefcc9ab3c393cd52be8), file `packages/hoppscotch-common/src/services/ai-chat.service.ts`
+- Truth: **new**, new line 4893
+- Schemes that disagree with the truth: none
+
+After:
+
+```
+  4889          )
+  4890        } else {
+  4891          request._ref_id = generateUniqueRefId("req")
+  4892          delete (request as { id?: string }).id
+> 4893          const res = await createRequestInCollection(found.node.id, {
+  4894            request: JSON.stringify(request),
+  4895            teamID,
+  4896            title: request.name,
+  4897          })()
+```
+
+Diff near the line:
+
+```diff
+@@ -0,0 +1,6825 @@
++import { Service } from "dioc"
++import {
++  computed,
++  nextTick,
++  ref,
++  shallowRef,
++  watch,
++  type ShallowRef,
++} from "vue"
++import * as E from "fp-ts/Either"
++import type {
++  HoppCollection,
++  HoppCollectionVariable,
++  HoppGQLRequest,
++  HoppRESTAuth,
++  HoppRESTHeader,
++  HoppRESTRequest,
++} from "@hoppscotch/data"
++import { populateValuesInInheritedCollectionVars } from "~/helpers/utils/inheritedCollectionVarTransformer"
++import {
++  Environment,
++  EnvironmentSchemaVersion,
++  generateUniqueRefId,
++  isRESTRequest,
++  makeCollection,
++  translateToNewEnvironmentVariables,
++} from "@hoppscotch/data"
++import { pipe } from "fp-ts/function"
++import * as TE from "fp-ts/TaskEither"
++import { TeamCollectionsService } from "~/services/team-collection.service"
++import type { TeamCollection } from "~/helpers/teams/TeamCollection"
++import type { TeamRequest } from "~/helpers/teams/TeamRequest"
++import type { TeamEnvironment } from "~/helpers/teams/TeamEnvironment"
++import type { HoppInheritedProperty } from "~/helpers/types/HoppInheritedProperties"
++import {
++  getCompleteCollectionTree,
++  teamCollToHoppRESTColl,
++} from "~/helpers/backend/helpers"
++import {
+... (6787 more lines)
+```
+
+## 99. arches: `CG-QUAL-104` (agree_new)
+
+- Commit: [2e02ce6e61](https://github.com/archesproject/arches/commit/2e02ce6e61999d93c10b05d853ae08f1912fa294), file `arches/app/media/js/views/graph/permission-designer.js`
+- Truth: **new**, new line 157
+- Schemes that disagree with the truth: none
+
+After:
+
+```
+   153                          }
+   154
+   155                          var inherited = nodegroup.explicit.length === 0;
+   156                          var sourceLabel = describeSource(nodegroup.source);
+>  157                          var perms = nodegroup.effective.map(function(perm) {
+   158                              return {
+   159                                  codename: perm.codename,
+   160                                  name: perm.name,
+   161                                  icon: permIcons[perm.codename],
+```
+
+Diff near the line:
+
+```diff
+@@ -70,62 +99,82 @@ import PermissionSettingsForm from 'views/graph/permission-manager/permission-se
+                         self.updatePermissions();
+                     });
+                 })
+-                .fail(function(err) {
+-                    console.log(err);
++                .fail(function(response) {
++                    showError(response.responseJSON, arches.translations.graphDesignerPermissionsLoadError);
++                })
++                .always(function() {
++                    self.loading(false);
+                 });
+         };
+
++        var setCardPerms = function(card, perms, literal) {
++            card.perms(perms);
++            card.permsLiteral(literal);
++            if (card.type === 'card' && card.children && card.children.length > 0) {
++                card.children.forEach(function(child) {
++                    if (child.type === 'node' && child.perms) {
++                        child.perms(perms);
++                    }
++                });
++            }
++        };
++
+         this.updatePermissions = function() {
+-            var item = self.identityList.selectedItems()[0];
+-            var nodegroupIds = [];
++            var identity = self.identityList.selectedItems()[0];
+
+-            if (item) {
+-                self.cardList.forEach(function(item) {
+-                    nodegroupIds.push(item.model.nodegroup_id());
++            if (!identity || !self.cardList) {
++                self.permissionsByNodegroup({});
++                (self.cardList || []).forEach(function(card) {
++                    setCardPerms(card, [], '');
+                 });
+-                $.ajax({
+... (91 more lines)
+```
+
+## 100. healthchecks: `CG-QUAL-004` (agree_new)
+
+- Commit: [cb1926beda](https://github.com/healthchecks/healthchecks/commit/cb1926bedaeca358a644e3096cd47d80648abfd3), file `hc/integrations/telegram/transport.py`
+- Truth: **new**, new line 30
+- Schemes that disagree with the truth: none
+
+After:
+
+```
+    26          description: str
+    27          parameters: Telegram.MigrationParameters | None = None
+    28
+    29      @classmethod
+>   30      def raise_for_response(cls, response: curl.Response) -> NoReturn:
+    31          message = f"Received status code {response.status_code}"
+    32          try:
+    33              m = Telegram.ErrorModel.model_validate_json(response.content)
+    34          except ValidationError:
+```
+
+Diff near the line:
+
+```diff
+(no diff hunk near this line)
+```
diff --git a/research/finding_identity/paper/numbers.md b/research/finding_identity/paper/numbers.md
new file mode 100644
index 0000000..a58d716
--- /dev/null
+++ b/research/finding_identity/paper/numbers.md
@@ -0,0 +1,191 @@
+# RQ1 numbers
+
+Generated by `research/finding_identity/paper_kit.py`; do not edit by hand. Rates
+in percent: pooled rate, 95% cluster-bootstrap interval over repositories, and
+the median of the per-repository rates.
+
+## CodeGuard findings
+
+Source: `research/finding_identity/results/corpus-v3`. 35 repositories, 7,000 commit pairs, 23,237 persisting and 1,974 introduced findings; 287 persisting findings in renamed files, in 8 repositories.
+
+| scheme | metric | rate | 95% CI | median | n |
+|---|---|---:|---|---:|---:|
+| `line` | false_new | 52.57 | [48.51, 57.62] | 54.43 | 12,215/23,237 |
+| `line` | false_new_same_path | 51.97 | [48.11, 56.75] | 54.36 | 11,928/22,950 |
+| `line` | false_new_renamed | 100.00 | [100.00, 100.00] | 100.00 | 287/287 |
+| `line` | hidden | 1.22 | [0.63, 2.16] | 0.00 | 24/1,974 |
+| `line` | mispair | 2.82 | [1.57, 3.93] | 1.57 | 655/23,237 |
+| `line` | collision | 2.09 | [1.08, 3.51] | 0.32 | 758/36,232 |
+| `line_text` | false_new | 1.89 | [0.80, 3.51] | 0.57 | 440/23,237 |
+| `line_text` | false_new_same_path | 0.67 | [0.48, 0.91] | 0.56 | 153/22,950 |
+| `line_text` | false_new_renamed | 100.00 | [100.00, 100.00] | 100.00 | 287/287 |
+| `line_text` | hidden | 1.17 | [0.52, 2.21] | 0.00 | 23/1,974 |
+| `line_text` | mispair | 0.19 | [0.05, 0.39] | 0.00 | 44/23,237 |
+| `line_text` | collision | 17.44 | [13.99, 21.28] | 14.78 | 6,318/36,232 |
+| `github` | false_new | 3.14 | [1.96, 4.86] | 1.85 | 730/23,237 |
+| `github` | false_new_same_path | 1.93 | [1.62, 2.32] | 1.79 | 443/22,950 |
+| `github` | false_new_renamed | 100.00 | [100.00, 100.00] | 100.00 | 287/287 |
+| `github` | hidden | 0.81 | [0.22, 1.87] | 0.00 | 16/1,974 |
+| `github` | mispair | 0.09 | [0.00, 0.22] | 0.00 | 21/23,237 |
+| `github` | collision | 2.09 | [1.08, 3.51] | 0.32 | 758/36,232 |
+| `codeguard` | false_new | 1.79 | [0.72, 3.39] | 0.48 | 417/23,237 |
+| `codeguard` | false_new_same_path | 0.57 | [0.39, 0.80] | 0.36 | 130/22,950 |
+| `codeguard` | false_new_renamed | 100.00 | [100.00, 100.00] | 100.00 | 287/287 |
+| `codeguard` | hidden | 1.87 | [0.92, 3.50] | 0.00 | 37/1,974 |
+| `codeguard` | mispair | 0.34 | [0.10, 0.68] | 0.00 | 78/23,237 |
+| `codeguard` | collision | 18.56 | [12.91, 24.85] | 11.92 | 6,723/36,232 |
+| `sonar` | false_new | 0.39 | [0.26, 0.57] | 0.22 | 91/23,237 |
+| `sonar` | false_new_same_path | 0.36 | [0.24, 0.53] | 0.21 | 83/22,950 |
+| `sonar` | false_new_renamed | 2.79 | [1.65, 8.33] | 2.06 | 8/287 |
+| `sonar` | hidden | 1.47 | [0.84, 2.37] | 0.00 | 29/1,974 |
+| `sonar` | mispair | 0.17 | [0.06, 0.33] | 0.00 | 39/23,237 |
+| `sonar` | collision | 20.28 | [16.49, 24.37] | 16.84 | 7,349/36,232 |
+| `sonar_branch` | false_new | 0.61 | [0.33, 1.02] | 0.25 | 141/23,237 |
+| `sonar_branch` | false_new_same_path | 0.36 | [0.24, 0.53] | 0.21 | 83/22,950 |
+| `sonar_branch` | false_new_renamed | 20.21 | [4.28, 62.27] | 28.03 | 58/287 |
+| `sonar_branch` | hidden | 1.42 | [0.82, 2.32] | 0.00 | 28/1,974 |
+| `sonar_branch` | mispair | 0.17 | [0.06, 0.33] | 0.00 | 39/23,237 |
+| `sonar_branch` | collision | 20.28 | [16.49, 24.37] | 16.84 | 7,349/36,232 |
+| `bandit` | false_new | 4.39 | [3.06, 6.34] | 3.92 | 1,019/23,237 |
+| `bandit` | false_new_same_path | 3.19 | [2.54, 4.05] | 3.40 | 732/22,950 |
+| `bandit` | false_new_renamed | 100.00 | [100.00, 100.00] | 100.00 | 287/287 |
+| `bandit` | hidden | 19.96 | [14.09, 28.62] | 17.33 | 394/1,974 |
+| `bandit` | mispair | 3.68 | [2.05, 5.61] | 1.06 | 856/23,237 |
+| `bandit` | collision | 54.16 | [44.38, 62.53] | 45.22 | 19,625/36,232 |
+
+Rules with the most persisting findings (share of all; findings in test code):
+
+| rule | persisting | introduced | in test code |
+|---|---:|---:|---:|
+| `CG-QUAL-003` | 3,985 (17.1%) | 274 (13.9%) | 25% |
+| `CG-QUAL-104` | 3,510 (15.1%) | 152 (7.7%) | 0% |
+| `CG-SEC-105` | 3,146 (13.5%) | 347 (17.6%) | 45% |
+| `CG-PERF-101` | 2,461 (10.6%) | 484 (24.5%) | 41% |
+| `CG-QUAL-101` | 1,879 (8.1%) | 55 (2.8%) | 1% |
+
+## Bandit findings
+
+Source: `research/finding_identity/results/corpus-bandit`, without rules B101. 25 repositories, 5,000 commit pairs, 15,718 persisting and 1,097 introduced findings; 4 persisting findings in renamed files, in 1 repository.
+
+| scheme | metric | rate | 95% CI | median | n |
+|---|---|---:|---|---:|---:|
+| `line` | false_new | 54.96 | [49.57, 61.56] | 54.92 | 8,638/15,718 |
+| `line` | false_new_same_path | 54.94 | [49.55, 61.56] | 54.92 | 8,634/15,714 |
+| `line` | false_new_renamed | 100.00 | [100.00, 100.00] | 100.00 | 4/4 |
+| `line` | hidden | 1.91 | [0.40, 4.01] | 0.00 | 21/1,097 |
+| `line` | mispair | 1.93 | [1.27, 2.88] | 1.23 | 304/15,718 |
+| `line` | collision | n/a | n/a | n/a | 0/0 |
+| `line_text` | false_new | 0.78 | [0.52, 1.08] | 0.59 | 122/15,718 |
+| `line_text` | false_new_same_path | 0.75 | [0.49, 1.06] | 0.55 | 118/15,714 |
+| `line_text` | false_new_renamed | 100.00 | [100.00, 100.00] | 100.00 | 4/4 |
+| `line_text` | hidden | 6.02 | [2.57, 10.00] | 1.17 | 66/1,097 |
+| `line_text` | mispair | 1.30 | [0.29, 2.10] | 0.00 | 204/15,718 |
+| `line_text` | collision | n/a | n/a | n/a | 0/0 |
+| `github` | false_new | 1.93 | [1.10, 3.05] | 1.27 | 304/15,718 |
+| `github` | false_new_same_path | 1.91 | [1.07, 3.03] | 1.14 | 300/15,714 |
+| `github` | false_new_renamed | 100.00 | [100.00, 100.00] | 100.00 | 4/4 |
+| `github` | hidden | 3.28 | [1.24, 5.87] | 0.00 | 36/1,097 |
+| `github` | mispair | 0.32 | [0.05, 0.66] | 0.00 | 51/15,718 |
+| `github` | collision | n/a | n/a | n/a | 0/0 |
+| `codeguard` | false_new | 0.42 | [0.23, 0.72] | 0.20 | 66/15,718 |
+| `codeguard` | false_new_same_path | 0.39 | [0.21, 0.69] | 0.17 | 62/15,714 |
+| `codeguard` | false_new_renamed | 100.00 | [100.00, 100.00] | 100.00 | 4/4 |
+| `codeguard` | hidden | 2.46 | [1.14, 4.15] | 0.00 | 27/1,097 |
+| `codeguard` | mispair | 0.03 | [0.00, 0.06] | 0.00 | 4/15,718 |
+| `codeguard` | collision | n/a | n/a | n/a | 0/0 |
+| `sonar` | false_new | 0.27 | [0.11, 0.52] | 0.02 | 43/15,718 |
+| `sonar` | false_new_same_path | 0.27 | [0.11, 0.52] | 0.02 | 43/15,714 |
+| `sonar` | false_new_renamed | 0.00 | [0.00, 0.00] | 0.00 | 0/4 |
+| `sonar` | hidden | 4.47 | [1.56, 8.38] | 0.00 | 49/1,097 |
+| `sonar` | mispair | 0.61 | [0.30, 0.95] | 0.00 | 96/15,718 |
+| `sonar` | collision | n/a | n/a | n/a | 0/0 |
+| `sonar_branch` | false_new | 0.27 | [0.11, 0.52] | 0.02 | 43/15,718 |
+| `sonar_branch` | false_new_same_path | 0.27 | [0.11, 0.52] | 0.02 | 43/15,714 |
+| `sonar_branch` | false_new_renamed | 0.00 | [0.00, 0.00] | 0.00 | 0/4 |
+| `sonar_branch` | hidden | 4.47 | [1.56, 8.38] | 0.00 | 49/1,097 |
+| `sonar_branch` | mispair | 0.61 | [0.30, 0.95] | 0.00 | 96/15,718 |
+| `sonar_branch` | collision | n/a | n/a | n/a | 0/0 |
+| `bandit` | false_new | 0.06 | [0.01, 0.13] | 0.00 | 9/15,718 |
+| `bandit` | false_new_same_path | 0.03 | [0.00, 0.07] | 0.00 | 5/15,714 |
+| `bandit` | false_new_renamed | 100.00 | [100.00, 100.00] | 100.00 | 4/4 |
+| `bandit` | hidden | 29.17 | [20.11, 40.89] | 34.67 | 320/1,097 |
+| `bandit` | mispair | 3.61 | [1.53, 5.62] | 0.88 | 567/15,718 |
+| `bandit` | collision | n/a | n/a | n/a | 0/0 |
+
+Rules with the most persisting findings (share of all; findings in test code):
+
+| rule | persisting | introduced | in test code |
+|---|---:|---:|---:|
+| `B105` | 5,646 (35.9%) | 467 (42.6%) | 76% |
+| `B106` | 4,872 (31.0%) | 208 (19.0%) | 99% |
+| `B324` | 649 (4.1%) | 10 (0.9%) | 66% |
+| `B311` | 648 (4.1%) | 18 (1.6%) | 62% |
+| `B608` | 618 (3.9%) | 137 (12.5%) | 28% |
+
+## Bandit (all rules) findings
+
+Source: `research/finding_identity/results/corpus-bandit`. 25 repositories, 5,000 commit pairs, 174,853 persisting and 13,024 introduced findings; 70 persisting findings in renamed files, in 3 repositories.
+
+| scheme | metric | rate | 95% CI | median | n |
+|---|---|---:|---|---:|---:|
+| `line` | false_new | 48.94 | [43.72, 56.69] | 54.91 | 85,570/174,853 |
+| `line` | false_new_same_path | 48.92 | [43.70, 56.68] | 54.91 | 85,500/174,783 |
+| `line` | false_new_renamed | 100.00 | [100.00, 100.00] | 100.00 | 70/70 |
+| `line` | hidden | 3.49 | [2.54, 5.31] | 2.45 | 454/13,024 |
+| `line` | mispair | 11.44 | [8.36, 13.64] | 5.48 | 20,008/174,853 |
+| `line` | collision | 0.05 | [0.03, 0.09] | 0.02 | 117/252,744 |
+| `line_text` | false_new | 0.73 | [0.46, 1.13] | 0.72 | 1,270/174,853 |
+| `line_text` | false_new_same_path | 0.69 | [0.44, 1.09] | 0.56 | 1,200/174,783 |
+| `line_text` | false_new_renamed | 100.00 | [100.00, 100.00] | 100.00 | 70/70 |
+| `line_text` | hidden | 3.89 | [2.55, 6.48] | 4.37 | 506/13,024 |
+| `line_text` | mispair | 1.55 | [0.88, 2.42] | 0.45 | 2,709/174,853 |
+| `line_text` | collision | 59.33 | [49.12, 64.12] | 46.72 | 149,946/252,744 |
+| `github` | false_new | 1.81 | [0.99, 3.07] | 1.35 | 3,165/174,853 |
+| `github` | false_new_same_path | 1.77 | [0.97, 3.03] | 1.29 | 3,095/174,783 |
+| `github` | false_new_renamed | 100.00 | [100.00, 100.00] | 100.00 | 70/70 |
+| `github` | hidden | 0.83 | [0.58, 1.34] | 0.49 | 108/13,024 |
+| `github` | mispair | 0.16 | [0.05, 0.33] | 0.01 | 272/174,853 |
+| `github` | collision | 0.05 | [0.03, 0.09] | 0.02 | 117/252,744 |
+| `codeguard` | false_new | 0.54 | [0.28, 0.94] | 0.22 | 944/174,853 |
+| `codeguard` | false_new_same_path | 0.50 | [0.26, 0.90] | 0.21 | 874/174,783 |
+| `codeguard` | false_new_renamed | 100.00 | [100.00, 100.00] | 100.00 | 70/70 |
+| `codeguard` | hidden | 0.69 | [0.41, 1.28] | 0.34 | 90/13,024 |
+| `codeguard` | mispair | 0.04 | [0.02, 0.06] | 0.00 | 63/174,853 |
+| `codeguard` | collision | 20.34 | [14.20, 26.56] | 23.67 | 51,411/252,744 |
+| `sonar` | false_new | 0.33 | [0.14, 0.67] | 0.13 | 570/174,853 |
+| `sonar` | false_new_same_path | 0.33 | [0.14, 0.67] | 0.13 | 570/174,783 |
+| `sonar` | false_new_renamed | 0.00 | [0.00, 0.00] | 0.00 | 0/70 |
+| `sonar` | hidden | 1.42 | [0.75, 2.94] | 0.61 | 185/13,024 |
+| `sonar` | mispair | 0.73 | [0.54, 0.89] | 0.58 | 1,284/174,853 |
+| `sonar` | collision | 60.75 | [51.23, 65.26] | 50.86 | 153,531/252,744 |
+| `sonar_branch` | false_new | 0.33 | [0.14, 0.67] | 0.13 | 570/174,853 |
+| `sonar_branch` | false_new_same_path | 0.33 | [0.14, 0.67] | 0.13 | 570/174,783 |
+| `sonar_branch` | false_new_renamed | 0.00 | [0.00, 0.00] | 0.00 | 0/70 |
+| `sonar_branch` | hidden | 1.42 | [0.75, 2.94] | 0.61 | 185/13,024 |
+| `sonar_branch` | mispair | 0.73 | [0.54, 0.89] | 0.58 | 1,284/174,853 |
+| `sonar_branch` | collision | 60.75 | [51.23, 65.26] | 50.86 | 153,531/252,744 |
+| `bandit` | false_new | 0.04 | [0.00, 0.14] | 0.00 | 75/174,853 |
+| `bandit` | false_new_same_path | 0.00 | [0.00, 0.01] | 0.00 | 5/174,783 |
+| `bandit` | false_new_renamed | 100.00 | [100.00, 100.00] | 100.00 | 70/70 |
+| `bandit` | hidden | 51.21 | [42.46, 65.18] | 53.96 | 6,670/13,024 |
+| `bandit` | mispair | 23.48 | [18.83, 28.87] | 11.73 | 41,064/174,853 |
+| `bandit` | collision | 97.66 | [94.98, 98.66] | 92.79 | 246,840/252,744 |
+
+Rules with the most persisting findings (share of all; findings in test code):
+
+| rule | persisting | introduced | in test code |
+|---|---:|---:|---:|
+| `B101` | 159,135 (91.0%) | 11,927 (91.6%) | 98% |
+| `B105` | 5,646 (3.2%) | 467 (3.6%) | 76% |
+| `B106` | 4,872 (2.8%) | 208 (1.6%) | 99% |
+| `B324` | 649 (0.4%) | 10 (0.1%) | 66% |
+| `B311` | 648 (0.4%) | 18 (0.1%) | 62% |
+
+Metrics:
+
+- `false_new`: persisting findings reported as new.
+- `false_new_same_path`: of those in files that kept their path.
+- `false_new_renamed`: of those in renamed files.
+- `hidden`: introduced findings matched to an old one.
+- `mispair`: persisting findings matched to the wrong old one.
+- `collision`: findings sharing a key with another in the same file version.
diff --git a/research/finding_identity/paper/outline.md b/research/finding_identity/paper/outline.md
new file mode 100644
index 0000000..3753aa5
--- /dev/null
+++ b/research/finding_identity/paper/outline.md
@@ -0,0 +1,232 @@
+# Paper outline: finding identity across code changes
+
+Material for a 6-page IEEE conference paper (two columns, 10 pt). This file plans the
+paper; the prose is written by the author. Every number the paper states is listed in
+[claims.md](claims.md) with the file it comes from, and the tables and figures are
+generated into this directory (see [Regenerating](#regenerating)).
+
+Working title: *Same Finding, New Commit? Measuring How Static Analysis Tools Track
+Findings Across Code Changes*
+
+## Page budget
+
+| Section | Pages | Holds |
+|---|---:|---|
+| Abstract | — | about 150 words |
+| I. Introduction | 0.75 | problem, gap, RQs, contributions |
+| II. Identity schemes | 0.6 | Table I (schemes) |
+| III. Method | 1.2 | ground truth, metrics, corpus, ports and their checks, transformations |
+| IV. RQ1: real histories | 1.1 | Table II (rates with CIs), the rename split, SonarQube's two modes |
+| V. RQ2: controlled changes | 0.8 | Fig. 1 (invariance matrix heatmap) |
+| VI. Implications | 0.4 | guidance for tool builders |
+| VII. Threats to validity | 0.35 | |
+| VIII. Related work | 0.35 | |
+| IX. Conclusion | 0.15 | data and code availability |
+| References | 0.3 | about 12 entries |
+
+Two tables and one figure fit; a second figure (per-repository spread) only if Table I
+shrinks. Drift (long spans) and Semgrep get one sentence each in VII or IX, or are left
+for a longer version: their samples are small (one anchor per repository; Semgrep on two
+repositories).
+
+## Research questions
+
+- **RQ1.** How often do the identity schemes of real tools report a persisting finding
+  as new, or hide a new finding, over real commit histories?
+- **RQ2.** Which kinds of code change break which schemes?
+
+## I. Introduction
+
+1. Baselines, suppressions, "fail only on new findings" CI gates and alert
+   de-duplication all assume a tool can tell that a finding in version *n+1* is the one
+   it reported in version *n*. When it cannot, old findings come back as new (noise,
+   broken baselines) or new findings are taken for old ones (**hidden**, the costly
+   error for a security gate).
+2. Every tool solves this differently (line numbers, line hashes, multi-pass trackers,
+   fingerprints of the matched code, set membership), and the choice is rarely
+   documented or measured.
+3. Gap: earlier work built trackers for one tool or used tracking to study developers;
+   no study compares the methods shipped tools use, on the same findings, against an
+   independent ground truth.
+4. Contributions:
+   - a replay harness that scores identity schemes against a diff-based ground truth;
+   - faithful ports of the identity methods of SonarQube, Bandit, Semgrep and GitHub
+     code scanning, each checked against the original tool;
+   - RQ1 on 35 web applications (7,000 commit pairs), RQ2 with ten controlled
+     transformations;
+   - the finding that ⟨headline, see claims C1–C4⟩;
+   - the data and code (Apache-2.0).
+
+## II. Identity schemes (Table I)
+
+One row per scheme: what the identity is built from, whether it includes the path,
+pairing rule (key equality in line order, multi-pass, set membership), source.
+
+- `line`: rule, path, line number (the naive baseline).
+- `line_text`: rule, path, exact line text.
+- `github`: GitHub code scanning's `primaryLocationLineHash` (rolling hash over 100
+  non-blank characters from the line start) plus an occurrence index.
+- `codeguard`: enclosing scope plus the normalized statement (literals masked, comments
+  and whitespace removed). Ablations `cg_no_scope`, `cg_no_mask`, `cg_raw` go in the
+  text or a footnote, not the table, unless space allows.
+- `sonar` / `sonar_branch`: SonarQube's six-pass tracker (line, line hash, message,
+  11-line block hashes for code moves). The two modes differ only across renamed files:
+  pull-request analyses take renames from the SCM; branch analyses accept a rename only
+  if their own file move detection does (line counts within 0.84–1.18×, line-hash
+  similarity ≥ 85).
+- `bandit`: `bandit -b baseline.json`: same text, severity, CWE, confidence, file and
+  test; no location; set membership (one baselined issue hides any number of equal new
+  ones).
+- `semgrep`: `match_based_id` (rule patterns with metavariable bindings, path, rule,
+  ordinal). One sentence; measured on two repositories only.
+
+## III. Method
+
+- **Ground truth.** Per changed file, a line diff maps old lines to new: unchanged lines
+  map exactly ("moved"), lines in a replaced block pair when similarity ≥ 0.6
+  ("edited"). An old and a new finding are the same when they have the same rule and the
+  old line maps to the new line. Renames follow `git diff -M`.
+- **Outcomes.** known_ok, mispaired, false_new, false_known (hidden), new_ok. Metrics:
+  false-new rate (over persisting findings), hidden rate (over introduced findings),
+  mispair rate, collision rate.
+- **Corpus.** 35 open-source web applications (25 Python: Django 16, Flask 4, FastAPI 2,
+  Pyramid, web.py, Frappe; 10 JavaScript/TypeScript: Express 5, NestJS 3, Next.js 2),
+  pinned commits, selected by written criteria (≥ 200 first-parent commits in two years,
+  OSI licence, ≥ 100 analysable back-end files, no committed build output). The last
+  200 first-parent commit pairs of each.
+- **Findings.** CodeGuard 2.2.0 (security, performance, quality rules) on all 35;
+  Bandit 1.9.4 on the 25 Python repositories, so each tool's method is also measured on
+  its own tool's findings.
+- **Ports and their checks** (the reviewers' first question):
+  - SonarQube tracker: the unmodified Java sources at the pinned tag, compiled into a
+    harness; 20,000 generated cases, 0 mismatches.
+  - Semgrep: all 716 IDs Semgrep emitted during the replays reproduced.
+  - Bandit: live `bandit -b` runs agree with the port.
+  - GitHub: port of `fingerprints.ts`; its tests compare against hashes produced by
+    running the original `fingerprints.ts` on two reference inputs (duplicates, CRLF,
+    CR-only and blank lines).
+- **Statistics.** Pooled rates with cluster-bootstrap 95% CIs over repositories (10,000
+  resamples): findings within a repository are correlated, so Wilson intervals are too
+  narrow (show one example in a footnote). Medians and IQR per repository.
+- **RQ2 transformations.** Ten edits with known effect on identity, applied one at a time
+  to one target finding: reformat, insert_top, insert_below, rename_local,
+  rename_function, move_function, change_literal, extract_helper, duplicate_above,
+  duplicate_below. Each returns an exact line map (the ground truth by construction).
+  Applied with libcst only where safe (rules listed in the README).
+
+## IV. RQ1 results (Table II)
+
+Table II: per scheme, false-new rate (all; same path; renamed), hidden rate, collision
+rate, each with its bootstrap CI. Then three findings, in this order:
+
+1. Line numbers lose about half of all persisting findings; every content-based scheme
+   loses about 1–3% (C1).
+2. **The path inside the key is the largest single cause of false-new reports** for
+   content-based schemes: renamed files hold ⟨C2⟩% of persisting findings but ⟨C2⟩% of
+   their false-new reports (C2). SonarQube keeps them in pull-request mode and loses
+   ⟨C3⟩ in branch mode.
+3. **Set membership hides new findings**: Bandit's baseline hides ⟨C4⟩% of genuinely new
+   findings on its own findings (⟨C4⟩% on CodeGuard's), because equality ignores location
+   and multiplicity (C4).
+
+One sentence on the trade-off: schemes that survive more edits collide more
+(`codeguard` ⟨C5⟩% collisions against `github` ⟨C5⟩%).
+
+## V. RQ2 results (Fig. 1)
+
+Fig. 1: heatmap, transformations × schemes, false-new rate (and hidden rate for the two
+duplicate transformations). Read it as "each scheme has a blind spot":
+
+- `line` breaks on every move; `github` on edits *below* the line (it reads forward);
+  scoped schemes on renames of the enclosing function and on extraction; text schemes on
+  changed literals unless they mask them.
+- Duplicates: schemes pair equal keys in line order, so a copy *above* a finding is
+  taken for it (hidden) and the original reported as new; GitHub's forward-reading hash
+  fails the other way.
+
+## VI. Implications
+
+For tool builders: keep the path out of the key or make it rename-aware; pair
+one-to-one, never by set membership; prefer a multi-pass matcher with a fallback on code
+moves to a single key; mask literals; report collisions. For users: a "new findings
+only" gate built on set membership can hide new vulnerabilities.
+
+## VII. Threats to validity
+
+- Ground truth is a line diff: a finding whose line is rewritten beyond the similarity
+  threshold counts as removed plus introduced. Mitigation: a manual check of a stratified
+  sample (to do, see claims.md).
+- Findings come mostly from one analyzer; Bandit's own findings replicate the key
+  results for Python.
+- Ports, not the tools: each checked against the original (Section III), but SonarQube's
+  file move detection is modelled only for pairs git already detects as renames.
+- Bandit's scheme applied to CodeGuard findings fills Bandit's fields with CodeGuard's
+  closest equivalents; its primary result is on Bandit's own findings.
+- Consecutive commits are an easy case; real baselines span many commits (drift mode
+  exists but is not part of this paper).
+- Web applications in Python and JavaScript/TypeScript only.
+
+## VIII. Related work
+
+Candidates (verify each before citing; see claims.md for what to cite them for):
+
+- Spacco, Hovemeyer and Pugh, "Tracking defect warnings across versions", MSR 2006.
+- Avgustinov et al., "Tracking static analysis violations over time to capture developer
+  characteristics", ICSE 2015.
+- Kim and Ernst, "Which warnings should I fix first?", ESEC/FSE 2007.
+- Heckman and Williams, "A systematic literature review of actionable alert
+  identification techniques for automated static code analysis", IST 2011.
+- Johnson et al., "Why don't software developers use static analysis tools to find
+  bugs?", ICSE 2013.
+- Sadowski et al., "Tricorder: Building a program analysis ecosystem", ICSE 2015, and
+  "Lessons from building static analysis tools at Google", CACM 2018.
+- OASIS SARIF 2.1.0 (fingerprints and `partialFingerprints`).
+
+Still to search: recent work on warning matching or "issue tracking" across revisions
+(2016 onwards), and on baseline-based CI gates.
+
+## IX. Conclusion
+
+Availability: harness, ports, corpus, results and scripts in the repository
+(`research/finding_identity/`), Apache-2.0.
+
+## Regenerating
+
+Everything in this directory comes from four runs over the pinned corpus and two
+generators. From the repository root, with `pip install -e .` and
+`pip install -r research/finding_identity/requirements.txt` (about 40 minutes on 4 cores):
+
+```bash
+P=research/finding_identity
+
+# RQ1: replays with CodeGuard (35 repositories) and Bandit (25 Python repositories)
+python -m research.finding_identity batch $P/corpus.csv --commits 200 --jobs 4 --details \
+    --out $P/results/corpus-v3
+python -m research.finding_identity batch $P/corpus.csv --commits 200 --jobs 4 --details \
+    --analyzer bandit --out $P/results/corpus-bandit
+
+# RQ2: the transformation experiment on each Python repository at its pinned commit
+python - <<'PY' | xargs -P 4 -L 1 sh -c \
+    'python -m research.finding_identity transform $0 --ref $1 --label $2 --samples 40 \
+         --out research/finding_identity/results/transform/transform-$2'
+import csv
+for r in csv.DictReader(open("research/finding_identity/corpus.csv")):
+    if r["language"] == "python":
+        print(f"research/finding_identity/.repos/{r['label']} {r['sha']} {r['label']}")
+PY
+
+# Table II, numbers.md, rq1.csv, rq2.csv, Fig. 1
+python -m research.finding_identity.paper_kit --codeguard $P/results/corpus-v3 \
+    --bandit $P/results/corpus-bandit --bandit-exclude B101 \
+    --transform $P/results/transform --corpus $P/corpus.csv --out $P/paper
+
+# tables.md, pooled.csv, per_repo.*, repos.csv, the per-repository box plot
+python -m research.finding_identity stats $P/results/corpus-v3 --corpus $P/corpus.csv \
+    --out $P/paper --plot
+
+# The ground-truth sample for the manual check (paper/ground_truth_check/)
+python -m research.finding_identity.gt_sample $P/results/corpus-v3
+```
+
+The bootstrap seed (20261014), the transformation seed (0) and the sample seed
+(20261017) are the defaults, so the commands reproduce the committed files.
diff --git a/research/finding_identity/paper/per_repo.csv b/research/finding_identity/paper/per_repo.csv
index c6649cf..c965ebd 100644
--- a/research/finding_identity/paper/per_repo.csv
+++ b/research/finding_identity/paper/per_repo.csv
@@ -1469,6 +1469,636 @@ all,etherpad,cg_raw,collision,23,190,0.121053
 all,uptime-kuma,cg_raw,collision,36,930,0.038710
 all,habitica,cg_raw,collision,95,329,0.288754
 all,hedgedoc,cg_raw,collision,8,95,0.084211
+all,defectdojo,sonar,false_new,4,420,0.009524
+all,saleor,sonar,false_new,0,610,0.000000
+all,netbox,sonar,false_new,0,367,0.000000
+all,zulip,sonar,false_new,2,785,0.002548
+all,healthchecks,sonar,false_new,0,414,0.000000
+all,inventree,sonar,false_new,1,911,0.001098
+all,addons-server,sonar,false_new,1,554,0.001805
+all,kitsune,sonar,false_new,2,910,0.002198
+all,readthedocs,sonar,false_new,0,302,0.000000
+all,weblate,sonar,false_new,1,241,0.004149
+all,mealie,sonar,false_new,0,118,0.000000
+all,lnbits,sonar,false_new,2,2230,0.000897
+all,jumpserver,sonar,false_new,2,355,0.005634
+all,warehouse,sonar,false_new,1,167,0.005988
+all,openlibrary,sonar,false_new,5,663,0.007541
+all,ckan,sonar,false_new,2,742,0.002695
+all,indico,sonar,false_new,4,284,0.014085
+all,securedrop,sonar,false_new,0,225,0.000000
+all,kiwi,sonar,false_new,0,56,0.000000
+all,pgadmin,sonar,false_new,10,920,0.010870
+all,erpnext,sonar,false_new,1,1355,0.000738
+all,edx-platform,sonar,false_new,1,599,0.001669
+all,intelowl,sonar,false_new,0,117,0.000000
+all,arches,sonar,false_new,6,2635,0.002277
+all,geonode,sonar,false_new,3,922,0.003254
+all,ghost,sonar,false_new,7,687,0.010189
+all,nodebb,sonar,false_new,2,964,0.002075
+all,calcom,sonar,false_new,10,1183,0.008453
+all,documenso,sonar,false_new,10,643,0.015552
+all,hoppscotch,sonar,false_new,2,1246,0.001605
+all,immich,sonar,false_new,0,445,0.000000
+all,etherpad,sonar,false_new,0,91,0.000000
+all,uptime-kuma,sonar,false_new,5,792,0.006313
+all,habitica,sonar,false_new,6,236,0.025424
+all,hedgedoc,sonar,false_new,1,48,0.020833
+all,defectdojo,sonar,false_new_moved,0,416,0.000000
+all,saleor,sonar,false_new_moved,0,610,0.000000
+all,netbox,sonar,false_new_moved,0,367,0.000000
+all,zulip,sonar,false_new_moved,0,783,0.000000
+all,healthchecks,sonar,false_new_moved,0,411,0.000000
+all,inventree,sonar,false_new_moved,0,909,0.000000
+all,addons-server,sonar,false_new_moved,0,552,0.000000
+all,kitsune,sonar,false_new_moved,0,908,0.000000
+all,readthedocs,sonar,false_new_moved,0,302,0.000000
+all,weblate,sonar,false_new_moved,0,240,0.000000
+all,mealie,sonar,false_new_moved,0,118,0.000000
+all,lnbits,sonar,false_new_moved,0,2226,0.000000
+all,jumpserver,sonar,false_new_moved,0,353,0.000000
+all,warehouse,sonar,false_new_moved,0,166,0.000000
+all,openlibrary,sonar,false_new_moved,0,650,0.000000
+all,ckan,sonar,false_new_moved,0,737,0.000000
+all,indico,sonar,false_new_moved,0,280,0.000000
+all,securedrop,sonar,false_new_moved,0,225,0.000000
+all,kiwi,sonar,false_new_moved,0,55,0.000000
+all,pgadmin,sonar,false_new_moved,0,909,0.000000
+all,erpnext,sonar,false_new_moved,0,1350,0.000000
+all,edx-platform,sonar,false_new_moved,0,595,0.000000
+all,intelowl,sonar,false_new_moved,0,115,0.000000
+all,arches,sonar,false_new_moved,0,2624,0.000000
+all,geonode,sonar,false_new_moved,0,919,0.000000
+all,ghost,sonar,false_new_moved,0,679,0.000000
+all,nodebb,sonar,false_new_moved,1,962,0.001040
+all,calcom,sonar,false_new_moved,0,1169,0.000000
+all,documenso,sonar,false_new_moved,0,630,0.000000
+all,hoppscotch,sonar,false_new_moved,0,1240,0.000000
+all,immich,sonar,false_new_moved,0,443,0.000000
+all,etherpad,sonar,false_new_moved,0,91,0.000000
+all,uptime-kuma,sonar,false_new_moved,0,787,0.000000
+all,habitica,sonar,false_new_moved,0,229,0.000000
+all,hedgedoc,sonar,false_new_moved,0,45,0.000000
+all,defectdojo,sonar,false_new_edited,4,4,1.000000
+all,saleor,sonar,false_new_edited,0,0,
+all,netbox,sonar,false_new_edited,0,0,
+all,zulip,sonar,false_new_edited,2,2,1.000000
+all,healthchecks,sonar,false_new_edited,0,3,0.000000
+all,inventree,sonar,false_new_edited,1,2,0.500000
+all,addons-server,sonar,false_new_edited,1,2,0.500000
+all,kitsune,sonar,false_new_edited,2,2,1.000000
+all,readthedocs,sonar,false_new_edited,0,0,
+all,weblate,sonar,false_new_edited,1,1,1.000000
+all,mealie,sonar,false_new_edited,0,0,
+all,lnbits,sonar,false_new_edited,2,4,0.500000
+all,jumpserver,sonar,false_new_edited,2,2,1.000000
+all,warehouse,sonar,false_new_edited,1,1,1.000000
+all,openlibrary,sonar,false_new_edited,5,13,0.384615
+all,ckan,sonar,false_new_edited,2,5,0.400000
+all,indico,sonar,false_new_edited,4,4,1.000000
+all,securedrop,sonar,false_new_edited,0,0,
+all,kiwi,sonar,false_new_edited,0,1,0.000000
+all,pgadmin,sonar,false_new_edited,10,11,0.909091
+all,erpnext,sonar,false_new_edited,1,5,0.200000
+all,edx-platform,sonar,false_new_edited,1,4,0.250000
+all,intelowl,sonar,false_new_edited,0,2,0.000000
+all,arches,sonar,false_new_edited,6,11,0.545455
+all,geonode,sonar,false_new_edited,3,3,1.000000
+all,ghost,sonar,false_new_edited,7,8,0.875000
+all,nodebb,sonar,false_new_edited,1,2,0.500000
+all,calcom,sonar,false_new_edited,10,14,0.714286
+all,documenso,sonar,false_new_edited,10,13,0.769231
+all,hoppscotch,sonar,false_new_edited,2,6,0.333333
+all,immich,sonar,false_new_edited,0,2,0.000000
+all,etherpad,sonar,false_new_edited,0,0,
+all,uptime-kuma,sonar,false_new_edited,5,5,1.000000
+all,habitica,sonar,false_new_edited,6,7,0.857143
+all,hedgedoc,sonar,false_new_edited,1,3,0.333333
+all,defectdojo,sonar,hidden,0,21,0.000000
+all,saleor,sonar,hidden,0,40,0.000000
+all,netbox,sonar,hidden,0,67,0.000000
+all,zulip,sonar,hidden,0,16,0.000000
+all,healthchecks,sonar,hidden,0,13,0.000000
+all,inventree,sonar,hidden,0,41,0.000000
+all,addons-server,sonar,hidden,0,1,0.000000
+all,kitsune,sonar,hidden,1,56,0.017857
+all,readthedocs,sonar,hidden,1,6,0.166667
+all,weblate,sonar,hidden,0,16,0.000000
+all,mealie,sonar,hidden,0,7,0.000000
+all,lnbits,sonar,hidden,1,352,0.002841
+all,jumpserver,sonar,hidden,1,50,0.020000
+all,warehouse,sonar,hidden,0,12,0.000000
+all,openlibrary,sonar,hidden,2,71,0.028169
+all,ckan,sonar,hidden,2,66,0.030303
+all,indico,sonar,hidden,0,5,0.000000
+all,securedrop,sonar,hidden,0,11,0.000000
+all,kiwi,sonar,hidden,0,3,0.000000
+all,pgadmin,sonar,hidden,0,152,0.000000
+all,erpnext,sonar,hidden,3,23,0.130435
+all,edx-platform,sonar,hidden,0,12,0.000000
+all,intelowl,sonar,hidden,2,25,0.080000
+all,arches,sonar,hidden,3,107,0.028037
+all,geonode,sonar,hidden,0,8,0.000000
+all,ghost,sonar,hidden,1,77,0.012987
+all,nodebb,sonar,hidden,1,24,0.041667
+all,calcom,sonar,hidden,4,104,0.038462
+all,documenso,sonar,hidden,1,225,0.004444
+all,hoppscotch,sonar,hidden,4,222,0.018018
+all,immich,sonar,hidden,2,27,0.074074
+all,etherpad,sonar,hidden,0,29,0.000000
+all,uptime-kuma,sonar,hidden,0,68,0.000000
+all,habitica,sonar,hidden,0,6,0.000000
+all,hedgedoc,sonar,hidden,0,11,0.000000
+all,defectdojo,sonar,mispair,0,420,0.000000
+all,saleor,sonar,mispair,0,610,0.000000
+all,netbox,sonar,mispair,2,367,0.005450
+all,zulip,sonar,mispair,0,785,0.000000
+all,healthchecks,sonar,mispair,4,414,0.009662
+all,inventree,sonar,mispair,0,911,0.000000
+all,addons-server,sonar,mispair,0,554,0.000000
+all,kitsune,sonar,mispair,2,910,0.002198
+all,readthedocs,sonar,mispair,0,302,0.000000
+all,weblate,sonar,mispair,0,241,0.000000
+all,mealie,sonar,mispair,0,118,0.000000
+all,lnbits,sonar,mispair,2,2230,0.000897
+all,jumpserver,sonar,mispair,0,355,0.000000
+all,warehouse,sonar,mispair,0,167,0.000000
+all,openlibrary,sonar,mispair,3,663,0.004525
+all,ckan,sonar,mispair,0,742,0.000000
+all,indico,sonar,mispair,0,284,0.000000
+all,securedrop,sonar,mispair,0,225,0.000000
+all,kiwi,sonar,mispair,0,56,0.000000
+all,pgadmin,sonar,mispair,0,920,0.000000
+all,erpnext,sonar,mispair,0,1355,0.000000
+all,edx-platform,sonar,mispair,0,599,0.000000
+all,intelowl,sonar,mispair,0,117,0.000000
+all,arches,sonar,mispair,4,2635,0.001518
+all,geonode,sonar,mispair,0,922,0.000000
+all,ghost,sonar,mispair,0,687,0.000000
+all,nodebb,sonar,mispair,16,964,0.016598
+all,calcom,sonar,mispair,1,1183,0.000845
+all,documenso,sonar,mispair,1,643,0.001555
+all,hoppscotch,sonar,mispair,4,1246,0.003210
+all,immich,sonar,mispair,0,445,0.000000
+all,etherpad,sonar,mispair,0,91,0.000000
+all,uptime-kuma,sonar,mispair,0,792,0.000000
+all,habitica,sonar,mispair,0,236,0.000000
+all,hedgedoc,sonar,mispair,0,48,0.000000
+all,defectdojo,sonar,collision,62,700,0.088571
+all,saleor,sonar,collision,100,1066,0.093809
+all,netbox,sonar,collision,93,553,0.168174
+all,zulip,sonar,collision,200,1298,0.154083
+all,healthchecks,sonar,collision,137,615,0.222764
+all,inventree,sonar,collision,314,1352,0.232249
+all,addons-server,sonar,collision,24,776,0.030928
+all,kitsune,sonar,collision,166,1396,0.118911
+all,readthedocs,sonar,collision,216,383,0.563969
+all,weblate,sonar,collision,21,393,0.053435
+all,mealie,sonar,collision,0,186,0.000000
+all,lnbits,sonar,collision,526,2969,0.177164
+all,jumpserver,sonar,collision,52,497,0.104628
+all,warehouse,sonar,collision,37,230,0.160870
+all,openlibrary,sonar,collision,120,973,0.123330
+all,ckan,sonar,collision,201,1605,0.125234
+all,indico,sonar,collision,36,406,0.088670
+all,securedrop,sonar,collision,76,323,0.235294
+all,kiwi,sonar,collision,26,79,0.329114
+all,pgadmin,sonar,collision,379,1532,0.247389
+all,erpnext,sonar,collision,425,2141,0.198505
+all,edx-platform,sonar,collision,90,934,0.096360
+all,intelowl,sonar,collision,39,224,0.174107
+all,arches,sonar,collision,730,4023,0.181457
+all,geonode,sonar,collision,273,1229,0.222132
+all,ghost,sonar,collision,103,1063,0.096896
+all,nodebb,sonar,collision,301,1276,0.235893
+all,calcom,sonar,collision,1029,2661,0.386697
+all,documenso,sonar,collision,555,1269,0.437352
+all,hoppscotch,sonar,collision,586,1894,0.309398
+all,immich,sonar,collision,187,642,0.291277
+all,etherpad,sonar,collision,31,190,0.163158
+all,uptime-kuma,sonar,collision,101,930,0.108602
+all,habitica,sonar,collision,97,329,0.294833
+all,hedgedoc,sonar,collision,16,95,0.168421
+all,defectdojo,sonar_branch,false_new,4,420,0.009524
+all,saleor,sonar_branch,false_new,0,610,0.000000
+all,netbox,sonar_branch,false_new,0,367,0.000000
+all,zulip,sonar_branch,false_new,2,785,0.002548
+all,healthchecks,sonar_branch,false_new,0,414,0.000000
+all,inventree,sonar_branch,false_new,1,911,0.001098
+all,addons-server,sonar_branch,false_new,1,554,0.001805
+all,kitsune,sonar_branch,false_new,2,910,0.002198
+all,readthedocs,sonar_branch,false_new,0,302,0.000000
+all,weblate,sonar_branch,false_new,1,241,0.004149
+all,mealie,sonar_branch,false_new,0,118,0.000000
+all,lnbits,sonar_branch,false_new,2,2230,0.000897
+all,jumpserver,sonar_branch,false_new,2,355,0.005634
+all,warehouse,sonar_branch,false_new,1,167,0.005988
+all,openlibrary,sonar_branch,false_new,5,663,0.007541
+all,ckan,sonar_branch,false_new,2,742,0.002695
+all,indico,sonar_branch,false_new,4,284,0.014085
+all,securedrop,sonar_branch,false_new,0,225,0.000000
+all,kiwi,sonar_branch,false_new,0,56,0.000000
+all,pgadmin,sonar_branch,false_new,10,920,0.010870
+all,erpnext,sonar_branch,false_new,1,1355,0.000738
+all,edx-platform,sonar_branch,false_new,1,599,0.001669
+all,intelowl,sonar_branch,false_new,0,117,0.000000
+all,arches,sonar_branch,false_new,9,2635,0.003416
+all,geonode,sonar_branch,false_new,3,922,0.003254
+all,ghost,sonar_branch,false_new,12,687,0.017467
+all,nodebb,sonar_branch,false_new,2,964,0.002075
+all,calcom,sonar_branch,false_new,11,1183,0.009298
+all,documenso,sonar_branch,false_new,10,643,0.015552
+all,hoppscotch,sonar_branch,false_new,43,1246,0.034510
+all,immich,sonar_branch,false_new,0,445,0.000000
+all,etherpad,sonar_branch,false_new,0,91,0.000000
+all,uptime-kuma,sonar_branch,false_new,5,792,0.006313
+all,habitica,sonar_branch,false_new,6,236,0.025424
+all,hedgedoc,sonar_branch,false_new,1,48,0.020833
+all,defectdojo,sonar_branch,false_new_moved,0,416,0.000000
+all,saleor,sonar_branch,false_new_moved,0,610,0.000000
+all,netbox,sonar_branch,false_new_moved,0,367,0.000000
+all,zulip,sonar_branch,false_new_moved,0,783,0.000000
+all,healthchecks,sonar_branch,false_new_moved,0,411,0.000000
+all,inventree,sonar_branch,false_new_moved,0,909,0.000000
+all,addons-server,sonar_branch,false_new_moved,0,552,0.000000
+all,kitsune,sonar_branch,false_new_moved,0,908,0.000000
+all,readthedocs,sonar_branch,false_new_moved,0,302,0.000000
+all,weblate,sonar_branch,false_new_moved,0,240,0.000000
+all,mealie,sonar_branch,false_new_moved,0,118,0.000000
+all,lnbits,sonar_branch,false_new_moved,0,2226,0.000000
+all,jumpserver,sonar_branch,false_new_moved,0,353,0.000000
+all,warehouse,sonar_branch,false_new_moved,0,166,0.000000
+all,openlibrary,sonar_branch,false_new_moved,0,650,0.000000
+all,ckan,sonar_branch,false_new_moved,0,737,0.000000
+all,indico,sonar_branch,false_new_moved,0,280,0.000000
+all,securedrop,sonar_branch,false_new_moved,0,225,0.000000
+all,kiwi,sonar_branch,false_new_moved,0,55,0.000000
+all,pgadmin,sonar_branch,false_new_moved,0,909,0.000000
+all,erpnext,sonar_branch,false_new_moved,0,1350,0.000000
+all,edx-platform,sonar_branch,false_new_moved,0,595,0.000000
+all,intelowl,sonar_branch,false_new_moved,0,115,0.000000
+all,arches,sonar_branch,false_new_moved,3,2624,0.001143
+all,geonode,sonar_branch,false_new_moved,0,919,0.000000
+all,ghost,sonar_branch,false_new_moved,5,679,0.007364
+all,nodebb,sonar_branch,false_new_moved,1,962,0.001040
+all,calcom,sonar_branch,false_new_moved,1,1169,0.000855
+all,documenso,sonar_branch,false_new_moved,0,630,0.000000
+all,hoppscotch,sonar_branch,false_new_moved,41,1240,0.033065
+all,immich,sonar_branch,false_new_moved,0,443,0.000000
+all,etherpad,sonar_branch,false_new_moved,0,91,0.000000
+all,uptime-kuma,sonar_branch,false_new_moved,0,787,0.000000
+all,habitica,sonar_branch,false_new_moved,0,229,0.000000
+all,hedgedoc,sonar_branch,false_new_moved,0,45,0.000000
+all,defectdojo,sonar_branch,false_new_edited,4,4,1.000000
+all,saleor,sonar_branch,false_new_edited,0,0,
+all,netbox,sonar_branch,false_new_edited,0,0,
+all,zulip,sonar_branch,false_new_edited,2,2,1.000000
+all,healthchecks,sonar_branch,false_new_edited,0,3,0.000000
+all,inventree,sonar_branch,false_new_edited,1,2,0.500000
+all,addons-server,sonar_branch,false_new_edited,1,2,0.500000
+all,kitsune,sonar_branch,false_new_edited,2,2,1.000000
+all,readthedocs,sonar_branch,false_new_edited,0,0,
+all,weblate,sonar_branch,false_new_edited,1,1,1.000000
+all,mealie,sonar_branch,false_new_edited,0,0,
+all,lnbits,sonar_branch,false_new_edited,2,4,0.500000
+all,jumpserver,sonar_branch,false_new_edited,2,2,1.000000
+all,warehouse,sonar_branch,false_new_edited,1,1,1.000000
+all,openlibrary,sonar_branch,false_new_edited,5,13,0.384615
+all,ckan,sonar_branch,false_new_edited,2,5,0.400000
+all,indico,sonar_branch,false_new_edited,4,4,1.000000
+all,securedrop,sonar_branch,false_new_edited,0,0,
+all,kiwi,sonar_branch,false_new_edited,0,1,0.000000
+all,pgadmin,sonar_branch,false_new_edited,10,11,0.909091
+all,erpnext,sonar_branch,false_new_edited,1,5,0.200000
+all,edx-platform,sonar_branch,false_new_edited,1,4,0.250000
+all,intelowl,sonar_branch,false_new_edited,0,2,0.000000
+all,arches,sonar_branch,false_new_edited,6,11,0.545455
+all,geonode,sonar_branch,false_new_edited,3,3,1.000000
+all,ghost,sonar_branch,false_new_edited,7,8,0.875000
+all,nodebb,sonar_branch,false_new_edited,1,2,0.500000
+all,calcom,sonar_branch,false_new_edited,10,14,0.714286
+all,documenso,sonar_branch,false_new_edited,10,13,0.769231
+all,hoppscotch,sonar_branch,false_new_edited,2,6,0.333333
+all,immich,sonar_branch,false_new_edited,0,2,0.000000
+all,etherpad,sonar_branch,false_new_edited,0,0,
+all,uptime-kuma,sonar_branch,false_new_edited,5,5,1.000000
+all,habitica,sonar_branch,false_new_edited,6,7,0.857143
+all,hedgedoc,sonar_branch,false_new_edited,1,3,0.333333
+all,defectdojo,sonar_branch,hidden,0,21,0.000000
+all,saleor,sonar_branch,hidden,0,40,0.000000
+all,netbox,sonar_branch,hidden,0,67,0.000000
+all,zulip,sonar_branch,hidden,0,16,0.000000
+all,healthchecks,sonar_branch,hidden,0,13,0.000000
+all,inventree,sonar_branch,hidden,0,41,0.000000
+all,addons-server,sonar_branch,hidden,0,1,0.000000
+all,kitsune,sonar_branch,hidden,1,56,0.017857
+all,readthedocs,sonar_branch,hidden,1,6,0.166667
+all,weblate,sonar_branch,hidden,0,16,0.000000
+all,mealie,sonar_branch,hidden,0,7,0.000000
+all,lnbits,sonar_branch,hidden,1,352,0.002841
+all,jumpserver,sonar_branch,hidden,1,50,0.020000
+all,warehouse,sonar_branch,hidden,0,12,0.000000
+all,openlibrary,sonar_branch,hidden,2,71,0.028169
+all,ckan,sonar_branch,hidden,2,66,0.030303
+all,indico,sonar_branch,hidden,0,5,0.000000
+all,securedrop,sonar_branch,hidden,0,11,0.000000
+all,kiwi,sonar_branch,hidden,0,3,0.000000
+all,pgadmin,sonar_branch,hidden,0,152,0.000000
+all,erpnext,sonar_branch,hidden,3,23,0.130435
+all,edx-platform,sonar_branch,hidden,0,12,0.000000
+all,intelowl,sonar_branch,hidden,2,25,0.080000
+all,arches,sonar_branch,hidden,3,107,0.028037
+all,geonode,sonar_branch,hidden,0,8,0.000000
+all,ghost,sonar_branch,hidden,1,77,0.012987
+all,nodebb,sonar_branch,hidden,1,24,0.041667
+all,calcom,sonar_branch,hidden,4,104,0.038462
+all,documenso,sonar_branch,hidden,1,225,0.004444
+all,hoppscotch,sonar_branch,hidden,3,222,0.013514
+all,immich,sonar_branch,hidden,2,27,0.074074
+all,etherpad,sonar_branch,hidden,0,29,0.000000
+all,uptime-kuma,sonar_branch,hidden,0,68,0.000000
+all,habitica,sonar_branch,hidden,0,6,0.000000
+all,hedgedoc,sonar_branch,hidden,0,11,0.000000
+all,defectdojo,sonar_branch,mispair,0,420,0.000000
+all,saleor,sonar_branch,mispair,0,610,0.000000
+all,netbox,sonar_branch,mispair,2,367,0.005450
+all,zulip,sonar_branch,mispair,0,785,0.000000
+all,healthchecks,sonar_branch,mispair,4,414,0.009662
+all,inventree,sonar_branch,mispair,0,911,0.000000
+all,addons-server,sonar_branch,mispair,0,554,0.000000
+all,kitsune,sonar_branch,mispair,2,910,0.002198
+all,readthedocs,sonar_branch,mispair,0,302,0.000000
+all,weblate,sonar_branch,mispair,0,241,0.000000
+all,mealie,sonar_branch,mispair,0,118,0.000000
+all,lnbits,sonar_branch,mispair,2,2230,0.000897
+all,jumpserver,sonar_branch,mispair,0,355,0.000000
+all,warehouse,sonar_branch,mispair,0,167,0.000000
+all,openlibrary,sonar_branch,mispair,3,663,0.004525
+all,ckan,sonar_branch,mispair,0,742,0.000000
+all,indico,sonar_branch,mispair,0,284,0.000000
+all,securedrop,sonar_branch,mispair,0,225,0.000000
+all,kiwi,sonar_branch,mispair,0,56,0.000000
+all,pgadmin,sonar_branch,mispair,0,920,0.000000
+all,erpnext,sonar_branch,mispair,0,1355,0.000000
+all,edx-platform,sonar_branch,mispair,0,599,0.000000
+all,intelowl,sonar_branch,mispair,0,117,0.000000
+all,arches,sonar_branch,mispair,4,2635,0.001518
+all,geonode,sonar_branch,mispair,0,922,0.000000
+all,ghost,sonar_branch,mispair,0,687,0.000000
+all,nodebb,sonar_branch,mispair,16,964,0.016598
+all,calcom,sonar_branch,mispair,1,1183,0.000845
+all,documenso,sonar_branch,mispair,1,643,0.001555
+all,hoppscotch,sonar_branch,mispair,4,1246,0.003210
+all,immich,sonar_branch,mispair,0,445,0.000000
+all,etherpad,sonar_branch,mispair,0,91,0.000000
+all,uptime-kuma,sonar_branch,mispair,0,792,0.000000
+all,habitica,sonar_branch,mispair,0,236,0.000000
+all,hedgedoc,sonar_branch,mispair,0,48,0.000000
+all,defectdojo,sonar_branch,collision,62,700,0.088571
+all,saleor,sonar_branch,collision,100,1066,0.093809
+all,netbox,sonar_branch,collision,93,553,0.168174
+all,zulip,sonar_branch,collision,200,1298,0.154083
+all,healthchecks,sonar_branch,collision,137,615,0.222764
+all,inventree,sonar_branch,collision,314,1352,0.232249
+all,addons-server,sonar_branch,collision,24,776,0.030928
+all,kitsune,sonar_branch,collision,166,1396,0.118911
+all,readthedocs,sonar_branch,collision,216,383,0.563969
+all,weblate,sonar_branch,collision,21,393,0.053435
+all,mealie,sonar_branch,collision,0,186,0.000000
+all,lnbits,sonar_branch,collision,526,2969,0.177164
+all,jumpserver,sonar_branch,collision,52,497,0.104628
+all,warehouse,sonar_branch,collision,37,230,0.160870
+all,openlibrary,sonar_branch,collision,120,973,0.123330
+all,ckan,sonar_branch,collision,201,1605,0.125234
+all,indico,sonar_branch,collision,36,406,0.088670
+all,securedrop,sonar_branch,collision,76,323,0.235294
+all,kiwi,sonar_branch,collision,26,79,0.329114
+all,pgadmin,sonar_branch,collision,379,1532,0.247389
+all,erpnext,sonar_branch,collision,425,2141,0.198505
+all,edx-platform,sonar_branch,collision,90,934,0.096360
+all,intelowl,sonar_branch,collision,39,224,0.174107
+all,arches,sonar_branch,collision,730,4023,0.181457
+all,geonode,sonar_branch,collision,273,1229,0.222132
+all,ghost,sonar_branch,collision,103,1063,0.096896
+all,nodebb,sonar_branch,collision,301,1276,0.235893
+all,calcom,sonar_branch,collision,1029,2661,0.386697
+all,documenso,sonar_branch,collision,555,1269,0.437352
+all,hoppscotch,sonar_branch,collision,586,1894,0.309398
+all,immich,sonar_branch,collision,187,642,0.291277
+all,etherpad,sonar_branch,collision,31,190,0.163158
+all,uptime-kuma,sonar_branch,collision,101,930,0.108602
+all,habitica,sonar_branch,collision,97,329,0.294833
+all,hedgedoc,sonar_branch,collision,16,95,0.168421
+all,defectdojo,bandit,false_new,18,420,0.042857
+all,saleor,bandit,false_new,11,610,0.018033
+all,netbox,bandit,false_new,41,367,0.111717
+all,zulip,bandit,false_new,32,785,0.040764
+all,healthchecks,bandit,false_new,4,414,0.009662
+all,inventree,bandit,false_new,31,911,0.034029
+all,addons-server,bandit,false_new,24,554,0.043321
+all,kitsune,bandit,false_new,28,910,0.030769
+all,readthedocs,bandit,false_new,3,302,0.009934
+all,weblate,bandit,false_new,12,241,0.049793
+all,mealie,bandit,false_new,7,118,0.059322
+all,lnbits,bandit,false_new,22,2230,0.009865
+all,jumpserver,bandit,false_new,20,355,0.056338
+all,warehouse,bandit,false_new,10,167,0.059880
+all,openlibrary,bandit,false_new,26,663,0.039216
+all,ckan,bandit,false_new,19,742,0.025606
+all,indico,bandit,false_new,18,284,0.063380
+all,securedrop,bandit,false_new,4,225,0.017778
+all,kiwi,bandit,false_new,6,56,0.107143
+all,pgadmin,bandit,false_new,33,920,0.035870
+all,erpnext,bandit,false_new,35,1355,0.025830
+all,edx-platform,bandit,false_new,16,599,0.026711
+all,intelowl,bandit,false_new,3,117,0.025641
+all,arches,bandit,false_new,58,2635,0.022011
+all,geonode,bandit,false_new,29,922,0.031453
+all,ghost,bandit,false_new,166,687,0.241630
+all,nodebb,bandit,false_new,18,964,0.018672
+all,calcom,bandit,false_new,125,1183,0.105664
+all,documenso,bandit,false_new,33,643,0.051322
+all,hoppscotch,bandit,false_new,91,1246,0.073034
+all,immich,bandit,false_new,7,445,0.015730
+all,etherpad,bandit,false_new,4,91,0.043956
+all,uptime-kuma,bandit,false_new,35,792,0.044192
+all,habitica,bandit,false_new,29,236,0.122881
+all,hedgedoc,bandit,false_new,1,48,0.020833
+all,defectdojo,bandit,false_new_moved,16,416,0.038462
+all,saleor,bandit,false_new_moved,11,610,0.018033
+all,netbox,bandit,false_new_moved,41,367,0.111717
+all,zulip,bandit,false_new_moved,32,783,0.040868
+all,healthchecks,bandit,false_new_moved,4,411,0.009732
+all,inventree,bandit,false_new_moved,31,909,0.034103
+all,addons-server,bandit,false_new_moved,24,552,0.043478
+all,kitsune,bandit,false_new_moved,27,908,0.029736
+all,readthedocs,bandit,false_new_moved,3,302,0.009934
+all,weblate,bandit,false_new_moved,11,240,0.045833
+all,mealie,bandit,false_new_moved,7,118,0.059322
+all,lnbits,bandit,false_new_moved,22,2226,0.009883
+all,jumpserver,bandit,false_new_moved,18,353,0.050992
+all,warehouse,bandit,false_new_moved,10,166,0.060241
+all,openlibrary,bandit,false_new_moved,23,650,0.035385
+all,ckan,bandit,false_new_moved,19,737,0.025780
+all,indico,bandit,false_new_moved,14,280,0.050000
+all,securedrop,bandit,false_new_moved,4,225,0.017778
+all,kiwi,bandit,false_new_moved,6,55,0.109091
+all,pgadmin,bandit,false_new_moved,33,909,0.036304
+all,erpnext,bandit,false_new_moved,35,1350,0.025926
+all,edx-platform,bandit,false_new_moved,14,595,0.023529
+all,intelowl,bandit,false_new_moved,3,115,0.026087
+all,arches,bandit,false_new_moved,56,2624,0.021341
+all,geonode,bandit,false_new_moved,28,919,0.030468
+all,ghost,bandit,false_new_moved,163,679,0.240059
+all,nodebb,bandit,false_new_moved,18,962,0.018711
+all,calcom,bandit,false_new_moved,122,1169,0.104363
+all,documenso,bandit,false_new_moved,30,630,0.047619
+all,hoppscotch,bandit,false_new_moved,90,1240,0.072581
+all,immich,bandit,false_new_moved,7,443,0.015801
+all,etherpad,bandit,false_new_moved,4,91,0.043956
+all,uptime-kuma,bandit,false_new_moved,35,787,0.044473
+all,habitica,bandit,false_new_moved,23,229,0.100437
+all,hedgedoc,bandit,false_new_moved,1,45,0.022222
+all,defectdojo,bandit,false_new_edited,2,4,0.500000
+all,saleor,bandit,false_new_edited,0,0,
+all,netbox,bandit,false_new_edited,0,0,
+all,zulip,bandit,false_new_edited,0,2,0.000000
+all,healthchecks,bandit,false_new_edited,0,3,0.000000
+all,inventree,bandit,false_new_edited,0,2,0.000000
+all,addons-server,bandit,false_new_edited,0,2,0.000000
+all,kitsune,bandit,false_new_edited,1,2,0.500000
+all,readthedocs,bandit,false_new_edited,0,0,
+all,weblate,bandit,false_new_edited,1,1,1.000000
+all,mealie,bandit,false_new_edited,0,0,
+all,lnbits,bandit,false_new_edited,0,4,0.000000
+all,jumpserver,bandit,false_new_edited,2,2,1.000000
+all,warehouse,bandit,false_new_edited,0,1,0.000000
+all,openlibrary,bandit,false_new_edited,3,13,0.230769
+all,ckan,bandit,false_new_edited,0,5,0.000000
+all,indico,bandit,false_new_edited,4,4,1.000000
+all,securedrop,bandit,false_new_edited,0,0,
+all,kiwi,bandit,false_new_edited,0,1,0.000000
+all,pgadmin,bandit,false_new_edited,0,11,0.000000
+all,erpnext,bandit,false_new_edited,0,5,0.000000
+all,edx-platform,bandit,false_new_edited,2,4,0.500000
+all,intelowl,bandit,false_new_edited,0,2,0.000000
+all,arches,bandit,false_new_edited,2,11,0.181818
+all,geonode,bandit,false_new_edited,1,3,0.333333
+all,ghost,bandit,false_new_edited,3,8,0.375000
+all,nodebb,bandit,false_new_edited,0,2,0.000000
+all,calcom,bandit,false_new_edited,3,14,0.214286
+all,documenso,bandit,false_new_edited,3,13,0.230769
+all,hoppscotch,bandit,false_new_edited,1,6,0.166667
+all,immich,bandit,false_new_edited,0,2,0.000000
+all,etherpad,bandit,false_new_edited,0,0,
+all,uptime-kuma,bandit,false_new_edited,0,5,0.000000
+all,habitica,bandit,false_new_edited,6,7,0.857143
+all,hedgedoc,bandit,false_new_edited,0,3,0.000000
+all,defectdojo,bandit,hidden,0,21,0.000000
+all,saleor,bandit,hidden,1,40,0.025000
+all,netbox,bandit,hidden,10,67,0.149254
+all,zulip,bandit,hidden,14,16,0.875000
+all,healthchecks,bandit,hidden,7,13,0.538462
+all,inventree,bandit,hidden,20,41,0.487805
+all,addons-server,bandit,hidden,0,1,0.000000
+all,kitsune,bandit,hidden,24,56,0.428571
+all,readthedocs,bandit,hidden,4,6,0.666667
+all,weblate,bandit,hidden,0,16,0.000000
+all,mealie,bandit,hidden,0,7,0.000000
+all,lnbits,bandit,hidden,27,352,0.076705
+all,jumpserver,bandit,hidden,1,50,0.020000
+all,warehouse,bandit,hidden,0,12,0.000000
+all,openlibrary,bandit,hidden,7,71,0.098592
+all,ckan,bandit,hidden,43,66,0.651515
+all,indico,bandit,hidden,0,5,0.000000
+all,securedrop,bandit,hidden,0,11,0.000000
+all,kiwi,bandit,hidden,0,3,0.000000
+all,pgadmin,bandit,hidden,29,152,0.190789
+all,erpnext,bandit,hidden,12,23,0.521739
+all,edx-platform,bandit,hidden,1,12,0.083333
+all,intelowl,bandit,hidden,7,25,0.280000
+all,arches,bandit,hidden,41,107,0.383178
+all,geonode,bandit,hidden,2,8,0.250000
+all,ghost,bandit,hidden,21,77,0.272727
+all,nodebb,bandit,hidden,11,24,0.458333
+all,calcom,bandit,hidden,28,104,0.269231
+all,documenso,bandit,hidden,39,225,0.173333
+all,hoppscotch,bandit,hidden,17,222,0.076577
+all,immich,bandit,hidden,15,27,0.555556
+all,etherpad,bandit,hidden,8,29,0.275862
+all,uptime-kuma,bandit,hidden,2,68,0.029412
+all,habitica,bandit,hidden,2,6,0.333333
+all,hedgedoc,bandit,hidden,1,11,0.090909
+all,defectdojo,bandit,mispair,0,420,0.000000
+all,saleor,bandit,mispair,1,610,0.001639
+all,netbox,bandit,mispair,6,367,0.016349
+all,zulip,bandit,mispair,31,785,0.039490
+all,healthchecks,bandit,mispair,1,414,0.002415
+all,inventree,bandit,mispair,22,911,0.024149
+all,addons-server,bandit,mispair,0,554,0.000000
+all,kitsune,bandit,mispair,186,910,0.204396
+all,readthedocs,bandit,mispair,20,302,0.066225
+all,weblate,bandit,mispair,1,241,0.004149
+all,mealie,bandit,mispair,0,118,0.000000
+all,lnbits,bandit,mispair,18,2230,0.008072
+all,jumpserver,bandit,mispair,0,355,0.000000
+all,warehouse,bandit,mispair,0,167,0.000000
+all,openlibrary,bandit,mispair,7,663,0.010558
+all,ckan,bandit,mispair,87,742,0.117251
+all,indico,bandit,mispair,12,284,0.042254
+all,securedrop,bandit,mispair,1,225,0.004444
+all,kiwi,bandit,mispair,0,56,0.000000
+all,pgadmin,bandit,mispair,98,920,0.106522
+all,erpnext,bandit,mispair,9,1355,0.006642
+all,edx-platform,bandit,mispair,0,599,0.000000
+all,intelowl,bandit,mispair,0,117,0.000000
+all,arches,bandit,mispair,134,2635,0.050854
+all,geonode,bandit,mispair,3,922,0.003254
+all,ghost,bandit,mispair,27,687,0.039301
+all,nodebb,bandit,mispair,12,964,0.012448
+all,calcom,bandit,mispair,71,1183,0.060017
+all,documenso,bandit,mispair,31,643,0.048212
+all,hoppscotch,bandit,mispair,37,1246,0.029695
+all,immich,bandit,mispair,0,445,0.000000
+all,etherpad,bandit,mispair,1,91,0.010989
+all,uptime-kuma,bandit,mispair,15,792,0.018939
+all,habitica,bandit,mispair,25,236,0.105932
+all,hedgedoc,bandit,mispair,0,48,0.000000
+all,defectdojo,bandit,collision,296,700,0.422857
+all,saleor,bandit,collision,155,1066,0.145403
+all,netbox,bandit,collision,106,553,0.191682
+all,zulip,bandit,collision,504,1298,0.388290
+all,healthchecks,bandit,collision,430,615,0.699187
+all,inventree,bandit,collision,803,1352,0.593935
+all,addons-server,bandit,collision,22,776,0.028351
+all,kitsune,bandit,collision,1153,1396,0.825931
+all,readthedocs,bandit,collision,229,383,0.597911
+all,weblate,bandit,collision,55,393,0.139949
+all,mealie,bandit,collision,0,186,0.000000
+all,lnbits,bandit,collision,810,2969,0.272819
+all,jumpserver,bandit,collision,76,497,0.152918
+all,warehouse,bandit,collision,37,230,0.160870
+all,openlibrary,bandit,collision,440,973,0.452210
+all,ckan,bandit,collision,1116,1605,0.695327
+all,indico,bandit,collision,58,406,0.142857
+all,securedrop,bandit,collision,96,323,0.297214
+all,kiwi,bandit,collision,40,79,0.506329
+all,pgadmin,bandit,collision,1074,1532,0.701044
+all,erpnext,bandit,collision,1125,2141,0.525455
+all,edx-platform,bandit,collision,209,934,0.223769
+all,intelowl,bandit,collision,78,224,0.348214
+all,arches,bandit,collision,3121,4023,0.775789
+all,geonode,bandit,collision,425,1229,0.345810
+all,ghost,bandit,collision,691,1063,0.650047
+all,nodebb,bandit,collision,999,1276,0.782915
+all,calcom,bandit,collision,1777,2661,0.667794
+all,documenso,bandit,collision,973,1269,0.766745
+all,hoppscotch,bandit,collision,1320,1894,0.696938
+all,immich,bandit,collision,476,642,0.741433
+all,etherpad,bandit,collision,137,190,0.721053
+all,uptime-kuma,bandit,collision,648,930,0.696774
+all,habitica,bandit,collision,116,329,0.352584
+all,hedgedoc,bandit,collision,30,95,0.315789
 security,defectdojo,line,false_new,14,19,0.736842
 security,saleor,line,false_new,30,72,0.416667
 security,netbox,line,false_new,31,40,0.775000
@@ -2939,3 +3569,633 @@ security,etherpad,cg_raw,collision,0,65,0.000000
 security,uptime-kuma,cg_raw,collision,16,138,0.115942
 security,habitica,cg_raw,collision,73,142,0.514085
 security,hedgedoc,cg_raw,collision,4,68,0.058824
+security,defectdojo,sonar,false_new,0,19,0.000000
+security,saleor,sonar,false_new,0,72,0.000000
+security,netbox,sonar,false_new,0,40,0.000000
+security,zulip,sonar,false_new,0,120,0.000000
+security,healthchecks,sonar,false_new,0,91,0.000000
+security,inventree,sonar,false_new,0,37,0.000000
+security,addons-server,sonar,false_new,0,41,0.000000
+security,kitsune,sonar,false_new,0,104,0.000000
+security,readthedocs,sonar,false_new,0,204,0.000000
+security,weblate,sonar,false_new,0,42,0.000000
+security,mealie,sonar,false_new,0,26,0.000000
+security,lnbits,sonar,false_new,1,1708,0.000585
+security,jumpserver,sonar,false_new,1,89,0.011236
+security,warehouse,sonar,false_new,1,66,0.015152
+security,openlibrary,sonar,false_new,2,195,0.010256
+security,ckan,sonar,false_new,0,30,0.000000
+security,indico,sonar,false_new,0,10,0.000000
+security,securedrop,sonar,false_new,0,94,0.000000
+security,kiwi,sonar,false_new,0,31,0.000000
+security,pgadmin,sonar,false_new,0,88,0.000000
+security,erpnext,sonar,false_new,0,1,0.000000
+security,edx-platform,sonar,false_new,0,194,0.000000
+security,intelowl,sonar,false_new,0,43,0.000000
+security,arches,sonar,false_new,0,94,0.000000
+security,geonode,sonar,false_new,1,107,0.009346
+security,ghost,sonar,false_new,2,192,0.010417
+security,nodebb,sonar,false_new,1,591,0.001692
+security,calcom,sonar,false_new,3,655,0.004580
+security,documenso,sonar,false_new,1,155,0.006452
+security,hoppscotch,sonar,false_new,0,235,0.000000
+security,immich,sonar,false_new,0,178,0.000000
+security,etherpad,sonar,false_new,0,33,0.000000
+security,uptime-kuma,sonar,false_new,1,95,0.010526
+security,habitica,sonar,false_new,0,78,0.000000
+security,hedgedoc,sonar,false_new,1,36,0.027778
+security,defectdojo,sonar,false_new_moved,0,19,0.000000
+security,saleor,sonar,false_new_moved,0,72,0.000000
+security,netbox,sonar,false_new_moved,0,40,0.000000
+security,zulip,sonar,false_new_moved,0,120,0.000000
+security,healthchecks,sonar,false_new_moved,0,91,0.000000
+security,inventree,sonar,false_new_moved,0,37,0.000000
+security,addons-server,sonar,false_new_moved,0,41,0.000000
+security,kitsune,sonar,false_new_moved,0,104,0.000000
+security,readthedocs,sonar,false_new_moved,0,204,0.000000
+security,weblate,sonar,false_new_moved,0,42,0.000000
+security,mealie,sonar,false_new_moved,0,26,0.000000
+security,lnbits,sonar,false_new_moved,0,1705,0.000000
+security,jumpserver,sonar,false_new_moved,0,88,0.000000
+security,warehouse,sonar,false_new_moved,0,65,0.000000
+security,openlibrary,sonar,false_new_moved,0,192,0.000000
+security,ckan,sonar,false_new_moved,0,30,0.000000
+security,indico,sonar,false_new_moved,0,10,0.000000
+security,securedrop,sonar,false_new_moved,0,94,0.000000
+security,kiwi,sonar,false_new_moved,0,30,0.000000
+security,pgadmin,sonar,false_new_moved,0,87,0.000000
+security,erpnext,sonar,false_new_moved,0,1,0.000000
+security,edx-platform,sonar,false_new_moved,0,192,0.000000
+security,intelowl,sonar,false_new_moved,0,41,0.000000
+security,arches,sonar,false_new_moved,0,93,0.000000
+security,geonode,sonar,false_new_moved,0,106,0.000000
+security,ghost,sonar,false_new_moved,0,189,0.000000
+security,nodebb,sonar,false_new_moved,1,591,0.001692
+security,calcom,sonar,false_new_moved,0,652,0.000000
+security,documenso,sonar,false_new_moved,0,154,0.000000
+security,hoppscotch,sonar,false_new_moved,0,235,0.000000
+security,immich,sonar,false_new_moved,0,178,0.000000
+security,etherpad,sonar,false_new_moved,0,33,0.000000
+security,uptime-kuma,sonar,false_new_moved,0,94,0.000000
+security,habitica,sonar,false_new_moved,0,78,0.000000
+security,hedgedoc,sonar,false_new_moved,0,35,0.000000
+security,defectdojo,sonar,false_new_edited,0,0,
+security,saleor,sonar,false_new_edited,0,0,
+security,netbox,sonar,false_new_edited,0,0,
+security,zulip,sonar,false_new_edited,0,0,
+security,healthchecks,sonar,false_new_edited,0,0,
+security,inventree,sonar,false_new_edited,0,0,
+security,addons-server,sonar,false_new_edited,0,0,
+security,kitsune,sonar,false_new_edited,0,0,
+security,readthedocs,sonar,false_new_edited,0,0,
+security,weblate,sonar,false_new_edited,0,0,
+security,mealie,sonar,false_new_edited,0,0,
+security,lnbits,sonar,false_new_edited,1,3,0.333333
+security,jumpserver,sonar,false_new_edited,1,1,1.000000
+security,warehouse,sonar,false_new_edited,1,1,1.000000
+security,openlibrary,sonar,false_new_edited,2,3,0.666667
+security,ckan,sonar,false_new_edited,0,0,
+security,indico,sonar,false_new_edited,0,0,
+security,securedrop,sonar,false_new_edited,0,0,
+security,kiwi,sonar,false_new_edited,0,1,0.000000
+security,pgadmin,sonar,false_new_edited,0,1,0.000000
+security,erpnext,sonar,false_new_edited,0,0,
+security,edx-platform,sonar,false_new_edited,0,2,0.000000
+security,intelowl,sonar,false_new_edited,0,2,0.000000
+security,arches,sonar,false_new_edited,0,1,0.000000
+security,geonode,sonar,false_new_edited,1,1,1.000000
+security,ghost,sonar,false_new_edited,2,3,0.666667
+security,nodebb,sonar,false_new_edited,0,0,
+security,calcom,sonar,false_new_edited,3,3,1.000000
+security,documenso,sonar,false_new_edited,1,1,1.000000
+security,hoppscotch,sonar,false_new_edited,0,0,
+security,immich,sonar,false_new_edited,0,0,
+security,etherpad,sonar,false_new_edited,0,0,
+security,uptime-kuma,sonar,false_new_edited,1,1,1.000000
+security,habitica,sonar,false_new_edited,0,0,
+security,hedgedoc,sonar,false_new_edited,1,1,1.000000
+security,defectdojo,sonar,hidden,0,11,0.000000
+security,saleor,sonar,hidden,0,3,0.000000
+security,netbox,sonar,hidden,0,34,0.000000
+security,zulip,sonar,hidden,0,4,0.000000
+security,healthchecks,sonar,hidden,0,0,
+security,inventree,sonar,hidden,0,3,0.000000
+security,addons-server,sonar,hidden,0,0,
+security,kitsune,sonar,hidden,0,2,0.000000
+security,readthedocs,sonar,hidden,1,4,0.250000
+security,weblate,sonar,hidden,0,0,
+security,mealie,sonar,hidden,0,2,0.000000
+security,lnbits,sonar,hidden,0,148,0.000000
+security,jumpserver,sonar,hidden,0,13,0.000000
+security,warehouse,sonar,hidden,0,2,0.000000
+security,openlibrary,sonar,hidden,0,19,0.000000
+security,ckan,sonar,hidden,0,4,0.000000
+security,indico,sonar,hidden,0,0,
+security,securedrop,sonar,hidden,0,0,
+security,kiwi,sonar,hidden,0,3,0.000000
+security,pgadmin,sonar,hidden,0,78,0.000000
+security,erpnext,sonar,hidden,0,0,
+security,edx-platform,sonar,hidden,0,7,0.000000
+security,intelowl,sonar,hidden,2,8,0.250000
+security,arches,sonar,hidden,0,3,0.000000
+security,geonode,sonar,hidden,0,3,0.000000
+security,ghost,sonar,hidden,0,43,0.000000
+security,nodebb,sonar,hidden,1,7,0.142857
+security,calcom,sonar,hidden,4,82,0.048780
+security,documenso,sonar,hidden,0,43,0.000000
+security,hoppscotch,sonar,hidden,0,82,0.000000
+security,immich,sonar,hidden,0,3,0.000000
+security,etherpad,sonar,hidden,0,7,0.000000
+security,uptime-kuma,sonar,hidden,0,21,0.000000
+security,habitica,sonar,hidden,0,4,0.000000
+security,hedgedoc,sonar,hidden,0,5,0.000000
+security,defectdojo,sonar,mispair,0,19,0.000000
+security,saleor,sonar,mispair,0,72,0.000000
+security,netbox,sonar,mispair,2,40,0.050000
+security,zulip,sonar,mispair,0,120,0.000000
+security,healthchecks,sonar,mispair,4,91,0.043956
+security,inventree,sonar,mispair,0,37,0.000000
+security,addons-server,sonar,mispair,0,41,0.000000
+security,kitsune,sonar,mispair,0,104,0.000000
+security,readthedocs,sonar,mispair,0,204,0.000000
+security,weblate,sonar,mispair,0,42,0.000000
+security,mealie,sonar,mispair,0,26,0.000000
+security,lnbits,sonar,mispair,2,1708,0.001171
+security,jumpserver,sonar,mispair,0,89,0.000000
+security,warehouse,sonar,mispair,0,66,0.000000
+security,openlibrary,sonar,mispair,3,195,0.015385
+security,ckan,sonar,mispair,0,30,0.000000
+security,indico,sonar,mispair,0,10,0.000000
+security,securedrop,sonar,mispair,0,94,0.000000
+security,kiwi,sonar,mispair,0,31,0.000000
+security,pgadmin,sonar,mispair,0,88,0.000000
+security,erpnext,sonar,mispair,0,1,0.000000
+security,edx-platform,sonar,mispair,0,194,0.000000
+security,intelowl,sonar,mispair,0,43,0.000000
+security,arches,sonar,mispair,0,94,0.000000
+security,geonode,sonar,mispair,0,107,0.000000
+security,ghost,sonar,mispair,0,192,0.000000
+security,nodebb,sonar,mispair,8,591,0.013536
+security,calcom,sonar,mispair,1,655,0.001527
+security,documenso,sonar,mispair,0,155,0.000000
+security,hoppscotch,sonar,mispair,0,235,0.000000
+security,immich,sonar,mispair,0,178,0.000000
+security,etherpad,sonar,mispair,0,33,0.000000
+security,uptime-kuma,sonar,mispair,0,95,0.000000
+security,habitica,sonar,mispair,0,78,0.000000
+security,hedgedoc,sonar,mispair,0,36,0.000000
+security,defectdojo,sonar,collision,18,46,0.391304
+security,saleor,sonar,collision,42,122,0.344262
+security,netbox,sonar,collision,23,83,0.277108
+security,zulip,sonar,collision,82,236,0.347458
+security,healthchecks,sonar,collision,95,97,0.979381
+security,inventree,sonar,collision,16,78,0.205128
+security,addons-server,sonar,collision,0,55,0.000000
+security,kitsune,sonar,collision,48,156,0.307692
+security,readthedocs,sonar,collision,210,245,0.857143
+security,weblate,sonar,collision,0,65,0.000000
+security,mealie,sonar,collision,0,37,0.000000
+security,lnbits,sonar,collision,406,2150,0.188837
+security,jumpserver,sonar,collision,34,129,0.263566
+security,warehouse,sonar,collision,37,90,0.411111
+security,openlibrary,sonar,collision,69,291,0.237113
+security,ckan,sonar,collision,27,52,0.519231
+security,indico,sonar,collision,6,18,0.333333
+security,securedrop,sonar,collision,34,133,0.255639
+security,kiwi,sonar,collision,6,42,0.142857
+security,pgadmin,sonar,collision,78,207,0.376812
+security,erpnext,sonar,collision,0,2,0.000000
+security,edx-platform,sonar,collision,50,277,0.180505
+security,intelowl,sonar,collision,14,87,0.160920
+security,arches,sonar,collision,37,131,0.282443
+security,geonode,sonar,collision,7,145,0.048276
+security,ghost,sonar,collision,61,302,0.201987
+security,nodebb,sonar,collision,197,756,0.260582
+security,calcom,sonar,collision,855,1335,0.640449
+security,documenso,sonar,collision,176,306,0.575163
+security,hoppscotch,sonar,collision,84,387,0.217054
+security,immich,sonar,collision,126,230,0.547826
+security,etherpad,sonar,collision,2,65,0.030769
+security,uptime-kuma,sonar,collision,20,138,0.144928
+security,habitica,sonar,collision,75,142,0.528169
+security,hedgedoc,sonar,collision,12,68,0.176471
+security,defectdojo,sonar_branch,false_new,0,19,0.000000
+security,saleor,sonar_branch,false_new,0,72,0.000000
+security,netbox,sonar_branch,false_new,0,40,0.000000
+security,zulip,sonar_branch,false_new,0,120,0.000000
+security,healthchecks,sonar_branch,false_new,0,91,0.000000
+security,inventree,sonar_branch,false_new,0,37,0.000000
+security,addons-server,sonar_branch,false_new,0,41,0.000000
+security,kitsune,sonar_branch,false_new,0,104,0.000000
+security,readthedocs,sonar_branch,false_new,0,204,0.000000
+security,weblate,sonar_branch,false_new,0,42,0.000000
+security,mealie,sonar_branch,false_new,0,26,0.000000
+security,lnbits,sonar_branch,false_new,1,1708,0.000585
+security,jumpserver,sonar_branch,false_new,1,89,0.011236
+security,warehouse,sonar_branch,false_new,1,66,0.015152
+security,openlibrary,sonar_branch,false_new,2,195,0.010256
+security,ckan,sonar_branch,false_new,0,30,0.000000
+security,indico,sonar_branch,false_new,0,10,0.000000
+security,securedrop,sonar_branch,false_new,0,94,0.000000
+security,kiwi,sonar_branch,false_new,0,31,0.000000
+security,pgadmin,sonar_branch,false_new,0,88,0.000000
+security,erpnext,sonar_branch,false_new,0,1,0.000000
+security,edx-platform,sonar_branch,false_new,0,194,0.000000
+security,intelowl,sonar_branch,false_new,0,43,0.000000
+security,arches,sonar_branch,false_new,0,94,0.000000
+security,geonode,sonar_branch,false_new,1,107,0.009346
+security,ghost,sonar_branch,false_new,3,192,0.015625
+security,nodebb,sonar_branch,false_new,1,591,0.001692
+security,calcom,sonar_branch,false_new,3,655,0.004580
+security,documenso,sonar_branch,false_new,1,155,0.006452
+security,hoppscotch,sonar_branch,false_new,0,235,0.000000
+security,immich,sonar_branch,false_new,0,178,0.000000
+security,etherpad,sonar_branch,false_new,0,33,0.000000
+security,uptime-kuma,sonar_branch,false_new,1,95,0.010526
+security,habitica,sonar_branch,false_new,0,78,0.000000
+security,hedgedoc,sonar_branch,false_new,1,36,0.027778
+security,defectdojo,sonar_branch,false_new_moved,0,19,0.000000
+security,saleor,sonar_branch,false_new_moved,0,72,0.000000
+security,netbox,sonar_branch,false_new_moved,0,40,0.000000
+security,zulip,sonar_branch,false_new_moved,0,120,0.000000
+security,healthchecks,sonar_branch,false_new_moved,0,91,0.000000
+security,inventree,sonar_branch,false_new_moved,0,37,0.000000
+security,addons-server,sonar_branch,false_new_moved,0,41,0.000000
+security,kitsune,sonar_branch,false_new_moved,0,104,0.000000
+security,readthedocs,sonar_branch,false_new_moved,0,204,0.000000
+security,weblate,sonar_branch,false_new_moved,0,42,0.000000
+security,mealie,sonar_branch,false_new_moved,0,26,0.000000
+security,lnbits,sonar_branch,false_new_moved,0,1705,0.000000
+security,jumpserver,sonar_branch,false_new_moved,0,88,0.000000
+security,warehouse,sonar_branch,false_new_moved,0,65,0.000000
+security,openlibrary,sonar_branch,false_new_moved,0,192,0.000000
+security,ckan,sonar_branch,false_new_moved,0,30,0.000000
+security,indico,sonar_branch,false_new_moved,0,10,0.000000
+security,securedrop,sonar_branch,false_new_moved,0,94,0.000000
+security,kiwi,sonar_branch,false_new_moved,0,30,0.000000
+security,pgadmin,sonar_branch,false_new_moved,0,87,0.000000
+security,erpnext,sonar_branch,false_new_moved,0,1,0.000000
+security,edx-platform,sonar_branch,false_new_moved,0,192,0.000000
+security,intelowl,sonar_branch,false_new_moved,0,41,0.000000
+security,arches,sonar_branch,false_new_moved,0,93,0.000000
+security,geonode,sonar_branch,false_new_moved,0,106,0.000000
+security,ghost,sonar_branch,false_new_moved,1,189,0.005291
+security,nodebb,sonar_branch,false_new_moved,1,591,0.001692
+security,calcom,sonar_branch,false_new_moved,0,652,0.000000
+security,documenso,sonar_branch,false_new_moved,0,154,0.000000
+security,hoppscotch,sonar_branch,false_new_moved,0,235,0.000000
+security,immich,sonar_branch,false_new_moved,0,178,0.000000
+security,etherpad,sonar_branch,false_new_moved,0,33,0.000000
+security,uptime-kuma,sonar_branch,false_new_moved,0,94,0.000000
+security,habitica,sonar_branch,false_new_moved,0,78,0.000000
+security,hedgedoc,sonar_branch,false_new_moved,0,35,0.000000
+security,defectdojo,sonar_branch,false_new_edited,0,0,
+security,saleor,sonar_branch,false_new_edited,0,0,
+security,netbox,sonar_branch,false_new_edited,0,0,
+security,zulip,sonar_branch,false_new_edited,0,0,
+security,healthchecks,sonar_branch,false_new_edited,0,0,
+security,inventree,sonar_branch,false_new_edited,0,0,
+security,addons-server,sonar_branch,false_new_edited,0,0,
+security,kitsune,sonar_branch,false_new_edited,0,0,
+security,readthedocs,sonar_branch,false_new_edited,0,0,
+security,weblate,sonar_branch,false_new_edited,0,0,
+security,mealie,sonar_branch,false_new_edited,0,0,
+security,lnbits,sonar_branch,false_new_edited,1,3,0.333333
+security,jumpserver,sonar_branch,false_new_edited,1,1,1.000000
+security,warehouse,sonar_branch,false_new_edited,1,1,1.000000
+security,openlibrary,sonar_branch,false_new_edited,2,3,0.666667
+security,ckan,sonar_branch,false_new_edited,0,0,
+security,indico,sonar_branch,false_new_edited,0,0,
+security,securedrop,sonar_branch,false_new_edited,0,0,
+security,kiwi,sonar_branch,false_new_edited,0,1,0.000000
+security,pgadmin,sonar_branch,false_new_edited,0,1,0.000000
+security,erpnext,sonar_branch,false_new_edited,0,0,
+security,edx-platform,sonar_branch,false_new_edited,0,2,0.000000
+security,intelowl,sonar_branch,false_new_edited,0,2,0.000000
+security,arches,sonar_branch,false_new_edited,0,1,0.000000
+security,geonode,sonar_branch,false_new_edited,1,1,1.000000
+security,ghost,sonar_branch,false_new_edited,2,3,0.666667
+security,nodebb,sonar_branch,false_new_edited,0,0,
+security,calcom,sonar_branch,false_new_edited,3,3,1.000000
+security,documenso,sonar_branch,false_new_edited,1,1,1.000000
+security,hoppscotch,sonar_branch,false_new_edited,0,0,
+security,immich,sonar_branch,false_new_edited,0,0,
+security,etherpad,sonar_branch,false_new_edited,0,0,
+security,uptime-kuma,sonar_branch,false_new_edited,1,1,1.000000
+security,habitica,sonar_branch,false_new_edited,0,0,
+security,hedgedoc,sonar_branch,false_new_edited,1,1,1.000000
+security,defectdojo,sonar_branch,hidden,0,11,0.000000
+security,saleor,sonar_branch,hidden,0,3,0.000000
+security,netbox,sonar_branch,hidden,0,34,0.000000
+security,zulip,sonar_branch,hidden,0,4,0.000000
+security,healthchecks,sonar_branch,hidden,0,0,
+security,inventree,sonar_branch,hidden,0,3,0.000000
+security,addons-server,sonar_branch,hidden,0,0,
+security,kitsune,sonar_branch,hidden,0,2,0.000000
+security,readthedocs,sonar_branch,hidden,1,4,0.250000
+security,weblate,sonar_branch,hidden,0,0,
+security,mealie,sonar_branch,hidden,0,2,0.000000
+security,lnbits,sonar_branch,hidden,0,148,0.000000
+security,jumpserver,sonar_branch,hidden,0,13,0.000000
+security,warehouse,sonar_branch,hidden,0,2,0.000000
+security,openlibrary,sonar_branch,hidden,0,19,0.000000
+security,ckan,sonar_branch,hidden,0,4,0.000000
+security,indico,sonar_branch,hidden,0,0,
+security,securedrop,sonar_branch,hidden,0,0,
+security,kiwi,sonar_branch,hidden,0,3,0.000000
+security,pgadmin,sonar_branch,hidden,0,78,0.000000
+security,erpnext,sonar_branch,hidden,0,0,
+security,edx-platform,sonar_branch,hidden,0,7,0.000000
+security,intelowl,sonar_branch,hidden,2,8,0.250000
+security,arches,sonar_branch,hidden,0,3,0.000000
+security,geonode,sonar_branch,hidden,0,3,0.000000
+security,ghost,sonar_branch,hidden,0,43,0.000000
+security,nodebb,sonar_branch,hidden,1,7,0.142857
+security,calcom,sonar_branch,hidden,4,82,0.048780
+security,documenso,sonar_branch,hidden,0,43,0.000000
+security,hoppscotch,sonar_branch,hidden,0,82,0.000000
+security,immich,sonar_branch,hidden,0,3,0.000000
+security,etherpad,sonar_branch,hidden,0,7,0.000000
+security,uptime-kuma,sonar_branch,hidden,0,21,0.000000
+security,habitica,sonar_branch,hidden,0,4,0.000000
+security,hedgedoc,sonar_branch,hidden,0,5,0.000000
+security,defectdojo,sonar_branch,mispair,0,19,0.000000
+security,saleor,sonar_branch,mispair,0,72,0.000000
+security,netbox,sonar_branch,mispair,2,40,0.050000
+security,zulip,sonar_branch,mispair,0,120,0.000000
+security,healthchecks,sonar_branch,mispair,4,91,0.043956
+security,inventree,sonar_branch,mispair,0,37,0.000000
+security,addons-server,sonar_branch,mispair,0,41,0.000000
+security,kitsune,sonar_branch,mispair,0,104,0.000000
+security,readthedocs,sonar_branch,mispair,0,204,0.000000
+security,weblate,sonar_branch,mispair,0,42,0.000000
+security,mealie,sonar_branch,mispair,0,26,0.000000
+security,lnbits,sonar_branch,mispair,2,1708,0.001171
+security,jumpserver,sonar_branch,mispair,0,89,0.000000
+security,warehouse,sonar_branch,mispair,0,66,0.000000
+security,openlibrary,sonar_branch,mispair,3,195,0.015385
+security,ckan,sonar_branch,mispair,0,30,0.000000
+security,indico,sonar_branch,mispair,0,10,0.000000
+security,securedrop,sonar_branch,mispair,0,94,0.000000
+security,kiwi,sonar_branch,mispair,0,31,0.000000
+security,pgadmin,sonar_branch,mispair,0,88,0.000000
+security,erpnext,sonar_branch,mispair,0,1,0.000000
+security,edx-platform,sonar_branch,mispair,0,194,0.000000
+security,intelowl,sonar_branch,mispair,0,43,0.000000
+security,arches,sonar_branch,mispair,0,94,0.000000
+security,geonode,sonar_branch,mispair,0,107,0.000000
+security,ghost,sonar_branch,mispair,0,192,0.000000
+security,nodebb,sonar_branch,mispair,8,591,0.013536
+security,calcom,sonar_branch,mispair,1,655,0.001527
+security,documenso,sonar_branch,mispair,0,155,0.000000
+security,hoppscotch,sonar_branch,mispair,0,235,0.000000
+security,immich,sonar_branch,mispair,0,178,0.000000
+security,etherpad,sonar_branch,mispair,0,33,0.000000
+security,uptime-kuma,sonar_branch,mispair,0,95,0.000000
+security,habitica,sonar_branch,mispair,0,78,0.000000
+security,hedgedoc,sonar_branch,mispair,0,36,0.000000
+security,defectdojo,sonar_branch,collision,18,46,0.391304
+security,saleor,sonar_branch,collision,42,122,0.344262
+security,netbox,sonar_branch,collision,23,83,0.277108
+security,zulip,sonar_branch,collision,82,236,0.347458
+security,healthchecks,sonar_branch,collision,95,97,0.979381
+security,inventree,sonar_branch,collision,16,78,0.205128
+security,addons-server,sonar_branch,collision,0,55,0.000000
+security,kitsune,sonar_branch,collision,48,156,0.307692
+security,readthedocs,sonar_branch,collision,210,245,0.857143
+security,weblate,sonar_branch,collision,0,65,0.000000
+security,mealie,sonar_branch,collision,0,37,0.000000
+security,lnbits,sonar_branch,collision,406,2150,0.188837
+security,jumpserver,sonar_branch,collision,34,129,0.263566
+security,warehouse,sonar_branch,collision,37,90,0.411111
+security,openlibrary,sonar_branch,collision,69,291,0.237113
+security,ckan,sonar_branch,collision,27,52,0.519231
+security,indico,sonar_branch,collision,6,18,0.333333
+security,securedrop,sonar_branch,collision,34,133,0.255639
+security,kiwi,sonar_branch,collision,6,42,0.142857
+security,pgadmin,sonar_branch,collision,78,207,0.376812
+security,erpnext,sonar_branch,collision,0,2,0.000000
+security,edx-platform,sonar_branch,collision,50,277,0.180505
+security,intelowl,sonar_branch,collision,14,87,0.160920
+security,arches,sonar_branch,collision,37,131,0.282443
+security,geonode,sonar_branch,collision,7,145,0.048276
+security,ghost,sonar_branch,collision,61,302,0.201987
+security,nodebb,sonar_branch,collision,197,756,0.260582
+security,calcom,sonar_branch,collision,855,1335,0.640449
+security,documenso,sonar_branch,collision,176,306,0.575163
+security,hoppscotch,sonar_branch,collision,84,387,0.217054
+security,immich,sonar_branch,collision,126,230,0.547826
+security,etherpad,sonar_branch,collision,2,65,0.030769
+security,uptime-kuma,sonar_branch,collision,20,138,0.144928
+security,habitica,sonar_branch,collision,75,142,0.528169
+security,hedgedoc,sonar_branch,collision,12,68,0.176471
+security,defectdojo,bandit,false_new,2,19,0.105263
+security,saleor,bandit,false_new,0,72,0.000000
+security,netbox,bandit,false_new,12,40,0.300000
+security,zulip,bandit,false_new,6,120,0.050000
+security,healthchecks,bandit,false_new,0,91,0.000000
+security,inventree,bandit,false_new,3,37,0.081081
+security,addons-server,bandit,false_new,7,41,0.170732
+security,kitsune,bandit,false_new,5,104,0.048077
+security,readthedocs,bandit,false_new,0,204,0.000000
+security,weblate,bandit,false_new,1,42,0.023810
+security,mealie,bandit,false_new,0,26,0.000000
+security,lnbits,bandit,false_new,4,1708,0.002342
+security,jumpserver,bandit,false_new,6,89,0.067416
+security,warehouse,bandit,false_new,0,66,0.000000
+security,openlibrary,bandit,false_new,4,195,0.020513
+security,ckan,bandit,false_new,0,30,0.000000
+security,indico,bandit,false_new,0,10,0.000000
+security,securedrop,bandit,false_new,0,94,0.000000
+security,kiwi,bandit,false_new,4,31,0.129032
+security,pgadmin,bandit,false_new,6,88,0.068182
+security,erpnext,bandit,false_new,1,1,1.000000
+security,edx-platform,bandit,false_new,5,194,0.025773
+security,intelowl,bandit,false_new,1,43,0.023256
+security,arches,bandit,false_new,22,94,0.234043
+security,geonode,bandit,false_new,2,107,0.018692
+security,ghost,bandit,false_new,35,192,0.182292
+security,nodebb,bandit,false_new,0,591,0.000000
+security,calcom,bandit,false_new,32,655,0.048855
+security,documenso,bandit,false_new,0,155,0.000000
+security,hoppscotch,bandit,false_new,0,235,0.000000
+security,immich,bandit,false_new,0,178,0.000000
+security,etherpad,bandit,false_new,0,33,0.000000
+security,uptime-kuma,bandit,false_new,5,95,0.052632
+security,habitica,bandit,false_new,0,78,0.000000
+security,hedgedoc,bandit,false_new,0,36,0.000000
+security,defectdojo,bandit,false_new_moved,2,19,0.105263
+security,saleor,bandit,false_new_moved,0,72,0.000000
+security,netbox,bandit,false_new_moved,12,40,0.300000
+security,zulip,bandit,false_new_moved,6,120,0.050000
+security,healthchecks,bandit,false_new_moved,0,91,0.000000
+security,inventree,bandit,false_new_moved,3,37,0.081081
+security,addons-server,bandit,false_new_moved,7,41,0.170732
+security,kitsune,bandit,false_new_moved,5,104,0.048077
+security,readthedocs,bandit,false_new_moved,0,204,0.000000
+security,weblate,bandit,false_new_moved,1,42,0.023810
+security,mealie,bandit,false_new_moved,0,26,0.000000
+security,lnbits,bandit,false_new_moved,4,1705,0.002346
+security,jumpserver,bandit,false_new_moved,5,88,0.056818
+security,warehouse,bandit,false_new_moved,0,65,0.000000
+security,openlibrary,bandit,false_new_moved,4,192,0.020833
+security,ckan,bandit,false_new_moved,0,30,0.000000
+security,indico,bandit,false_new_moved,0,10,0.000000
+security,securedrop,bandit,false_new_moved,0,94,0.000000
+security,kiwi,bandit,false_new_moved,4,30,0.133333
+security,pgadmin,bandit,false_new_moved,6,87,0.068966
+security,erpnext,bandit,false_new_moved,1,1,1.000000
+security,edx-platform,bandit,false_new_moved,3,192,0.015625
+security,intelowl,bandit,false_new_moved,1,41,0.024390
+security,arches,bandit,false_new_moved,22,93,0.236559
+security,geonode,bandit,false_new_moved,2,106,0.018868
+security,ghost,bandit,false_new_moved,34,189,0.179894
+security,nodebb,bandit,false_new_moved,0,591,0.000000
+security,calcom,bandit,false_new_moved,32,652,0.049080
+security,documenso,bandit,false_new_moved,0,154,0.000000
+security,hoppscotch,bandit,false_new_moved,0,235,0.000000
+security,immich,bandit,false_new_moved,0,178,0.000000
+security,etherpad,bandit,false_new_moved,0,33,0.000000
+security,uptime-kuma,bandit,false_new_moved,5,94,0.053191
+security,habitica,bandit,false_new_moved,0,78,0.000000
+security,hedgedoc,bandit,false_new_moved,0,35,0.000000
+security,defectdojo,bandit,false_new_edited,0,0,
+security,saleor,bandit,false_new_edited,0,0,
+security,netbox,bandit,false_new_edited,0,0,
+security,zulip,bandit,false_new_edited,0,0,
+security,healthchecks,bandit,false_new_edited,0,0,
+security,inventree,bandit,false_new_edited,0,0,
+security,addons-server,bandit,false_new_edited,0,0,
+security,kitsune,bandit,false_new_edited,0,0,
+security,readthedocs,bandit,false_new_edited,0,0,
+security,weblate,bandit,false_new_edited,0,0,
+security,mealie,bandit,false_new_edited,0,0,
+security,lnbits,bandit,false_new_edited,0,3,0.000000
+security,jumpserver,bandit,false_new_edited,1,1,1.000000
+security,warehouse,bandit,false_new_edited,0,1,0.000000
+security,openlibrary,bandit,false_new_edited,0,3,0.000000
+security,ckan,bandit,false_new_edited,0,0,
+security,indico,bandit,false_new_edited,0,0,
+security,securedrop,bandit,false_new_edited,0,0,
+security,kiwi,bandit,false_new_edited,0,1,0.000000
+security,pgadmin,bandit,false_new_edited,0,1,0.000000
+security,erpnext,bandit,false_new_edited,0,0,
+security,edx-platform,bandit,false_new_edited,2,2,1.000000
+security,intelowl,bandit,false_new_edited,0,2,0.000000
+security,arches,bandit,false_new_edited,0,1,0.000000
+security,geonode,bandit,false_new_edited,0,1,0.000000
+security,ghost,bandit,false_new_edited,1,3,0.333333
+security,nodebb,bandit,false_new_edited,0,0,
+security,calcom,bandit,false_new_edited,0,3,0.000000
+security,documenso,bandit,false_new_edited,0,1,0.000000
+security,hoppscotch,bandit,false_new_edited,0,0,
+security,immich,bandit,false_new_edited,0,0,
+security,etherpad,bandit,false_new_edited,0,0,
+security,uptime-kuma,bandit,false_new_edited,0,1,0.000000
+security,habitica,bandit,false_new_edited,0,0,
+security,hedgedoc,bandit,false_new_edited,0,1,0.000000
+security,defectdojo,bandit,hidden,0,11,0.000000
+security,saleor,bandit,hidden,1,3,0.333333
+security,netbox,bandit,hidden,6,34,0.176471
+security,zulip,bandit,hidden,4,4,1.000000
+security,healthchecks,bandit,hidden,0,0,
+security,inventree,bandit,hidden,0,3,0.000000
+security,addons-server,bandit,hidden,0,0,
+security,kitsune,bandit,hidden,0,2,0.000000
+security,readthedocs,bandit,hidden,4,4,1.000000
+security,weblate,bandit,hidden,0,0,
+security,mealie,bandit,hidden,0,2,0.000000
+security,lnbits,bandit,hidden,21,148,0.141892
+security,jumpserver,bandit,hidden,0,13,0.000000
+security,warehouse,bandit,hidden,0,2,0.000000
+security,openlibrary,bandit,hidden,3,19,0.157895
+security,ckan,bandit,hidden,0,4,0.000000
+security,indico,bandit,hidden,0,0,
+security,securedrop,bandit,hidden,0,0,
+security,kiwi,bandit,hidden,0,3,0.000000
+security,pgadmin,bandit,hidden,1,78,0.012821
+security,erpnext,bandit,hidden,0,0,
+security,edx-platform,bandit,hidden,1,7,0.142857
+security,intelowl,bandit,hidden,5,8,0.625000
+security,arches,bandit,hidden,2,3,0.666667
+security,geonode,bandit,hidden,2,3,0.666667
+security,ghost,bandit,hidden,13,43,0.302326
+security,nodebb,bandit,hidden,7,7,1.000000
+security,calcom,bandit,hidden,27,82,0.329268
+security,documenso,bandit,hidden,14,43,0.325581
+security,hoppscotch,bandit,hidden,9,82,0.109756
+security,immich,bandit,hidden,0,3,0.000000
+security,etherpad,bandit,hidden,5,7,0.714286
+security,uptime-kuma,bandit,hidden,0,21,0.000000
+security,habitica,bandit,hidden,2,4,0.500000
+security,hedgedoc,bandit,hidden,1,5,0.200000
+security,defectdojo,bandit,mispair,0,19,0.000000
+security,saleor,bandit,mispair,0,72,0.000000
+security,netbox,bandit,mispair,4,40,0.100000
+security,zulip,bandit,mispair,0,120,0.000000
+security,healthchecks,bandit,mispair,0,91,0.000000
+security,inventree,bandit,mispair,0,37,0.000000
+security,addons-server,bandit,mispair,0,41,0.000000
+security,kitsune,bandit,mispair,0,104,0.000000
+security,readthedocs,bandit,mispair,20,204,0.098039
+security,weblate,bandit,mispair,0,42,0.000000
+security,mealie,bandit,mispair,0,26,0.000000
+security,lnbits,bandit,mispair,8,1708,0.004684
+security,jumpserver,bandit,mispair,0,89,0.000000
+security,warehouse,bandit,mispair,0,66,0.000000
+security,openlibrary,bandit,mispair,7,195,0.035897
+security,ckan,bandit,mispair,0,30,0.000000
+security,indico,bandit,mispair,0,10,0.000000
+security,securedrop,bandit,mispair,0,94,0.000000
+security,kiwi,bandit,mispair,0,31,0.000000
+security,pgadmin,bandit,mispair,0,88,0.000000
+security,erpnext,bandit,mispair,0,1,0.000000
+security,edx-platform,bandit,mispair,0,194,0.000000
+security,intelowl,bandit,mispair,0,43,0.000000
+security,arches,bandit,mispair,0,94,0.000000
+security,geonode,bandit,mispair,0,107,0.000000
+security,ghost,bandit,mispair,4,192,0.020833
+security,nodebb,bandit,mispair,7,591,0.011844
+security,calcom,bandit,mispair,45,655,0.068702
+security,documenso,bandit,mispair,12,155,0.077419
+security,hoppscotch,bandit,mispair,0,235,0.000000
+security,immich,bandit,mispair,0,178,0.000000
+security,etherpad,bandit,mispair,1,33,0.030303
+security,uptime-kuma,bandit,mispair,0,95,0.000000
+security,habitica,bandit,mispair,25,78,0.320513
+security,hedgedoc,bandit,mispair,0,36,0.000000
+security,defectdojo,bandit,collision,18,46,0.391304
+security,saleor,bandit,collision,50,122,0.409836
+security,netbox,bandit,collision,39,83,0.469880
+security,zulip,bandit,collision,178,236,0.754237
+security,healthchecks,bandit,collision,95,97,0.979381
+security,inventree,bandit,collision,37,78,0.474359
+security,addons-server,bandit,collision,0,55,0.000000
+security,kitsune,bandit,collision,87,156,0.557692
+security,readthedocs,bandit,collision,219,245,0.893878
+security,weblate,bandit,collision,47,65,0.723077
+security,mealie,bandit,collision,0,37,0.000000
+security,lnbits,bandit,collision,462,2150,0.214884
+security,jumpserver,bandit,collision,30,129,0.232558
+security,warehouse,bandit,collision,37,90,0.411111
+security,openlibrary,bandit,collision,156,291,0.536082
+security,ckan,bandit,collision,39,52,0.750000
+security,indico,bandit,collision,8,18,0.444444
+security,securedrop,bandit,collision,50,133,0.375940
+security,kiwi,bandit,collision,16,42,0.380952
+security,pgadmin,bandit,collision,113,207,0.545894
+security,erpnext,bandit,collision,0,2,0.000000
+security,edx-platform,bandit,collision,69,277,0.249097
+security,intelowl,bandit,collision,51,87,0.586207
+security,arches,bandit,collision,30,131,0.229008
+security,geonode,bandit,collision,7,145,0.048276
+security,ghost,bandit,collision,213,302,0.705298
+security,nodebb,bandit,collision,702,756,0.928571
+security,calcom,bandit,collision,1064,1335,0.797004
+security,documenso,bandit,collision,250,306,0.816993
+security,hoppscotch,bandit,collision,181,387,0.467700
+security,immich,bandit,collision,176,230,0.765217
+security,etherpad,bandit,collision,42,65,0.646154
+security,uptime-kuma,bandit,collision,59,138,0.427536
+security,habitica,bandit,collision,102,142,0.718310
+security,hedgedoc,bandit,collision,14,68,0.205882
diff --git a/research/finding_identity/paper/per_repo.md b/research/finding_identity/paper/per_repo.md
index 51e2e1f..4052120 100644
--- a/research/finding_identity/paper/per_repo.md
+++ b/research/finding_identity/paper/per_repo.md
@@ -1,79 +1,79 @@
 ### All findings: false-new rate per repository (%)
 
-| repository | known | `line` | `line_text` | `github` | `codeguard` | `cg_no_scope` | `cg_no_mask` | `cg_raw` |
-|---|---:|---:|---:|---:|---:|---:|---:|---:|
-| defectdojo | 420 | 49.52 | 0.95 | 1.43 | 0.95 | 0.95 | 0.95 | 0.95 |
-| saleor | 610 | 68.03 | 0.00 | 0.49 | 0.00 | 0.00 | 0.00 | 0.00 |
-| netbox | 367 | 71.39 | 0.27 | 1.36 | 0.00 | 0.27 | 0.00 | 0.00 |
-| zulip | 785 | 53.25 | 0.25 | 0.64 | 0.13 | 0.13 | 0.25 | 0.25 |
-| healthchecks | 414 | 29.95 | 0.72 | 2.42 | 0.48 | 0.48 | 0.72 | 0.72 |
-| inventree | 911 | 62.13 | 0.22 | 0.88 | 0.11 | 0.33 | 0.11 | 0.22 |
-| addons-server | 554 | 42.96 | 0.36 | 1.62 | 0.36 | 0.36 | 0.36 | 0.36 |
-| kitsune | 910 | 46.59 | 0.22 | 2.09 | 0.33 | 0.33 | 0.33 | 0.22 |
-| readthedocs | 302 | 48.34 | 0.33 | 0.99 | 0.33 | 0.33 | 0.33 | 0.33 |
-| weblate | 241 | 68.05 | 0.41 | 0.83 | 0.00 | 0.00 | 0.00 | 0.41 |
-| mealie | 118 | 57.63 | 0.00 | 0.85 | 0.00 | 0.00 | 0.00 | 0.00 |
-| lnbits | 2230 | 46.73 | 0.18 | 1.43 | 0.18 | 0.49 | 0.22 | 0.18 |
-| jumpserver | 355 | 58.59 | 0.56 | 2.25 | 0.56 | 0.56 | 0.56 | 0.56 |
-| warehouse | 167 | 61.08 | 0.60 | 2.99 | 0.60 | 0.60 | 0.60 | 0.60 |
-| openlibrary | 663 | 55.81 | 2.11 | 4.07 | 1.96 | 1.36 | 1.96 | 2.71 |
-| ckan | 742 | 43.26 | 1.75 | 4.58 | 1.35 | 1.35 | 1.35 | 1.75 |
-| indico | 284 | 50.35 | 1.41 | 2.11 | 1.41 | 1.41 | 1.41 | 1.41 |
-| securedrop | 225 | 46.67 | 0.00 | 1.33 | 0.00 | 0.00 | 0.00 | 0.00 |
-| kiwi | 56 | 50.00 | 1.79 | 1.79 | 0.00 | 0.00 | 0.00 | 1.79 |
-| pgadmin | 920 | 64.02 | 1.20 | 1.85 | 1.20 | 1.20 | 1.20 | 1.20 |
-| erpnext | 1355 | 40.15 | 0.37 | 1.55 | 0.22 | 0.15 | 0.37 | 0.44 |
-| edx-platform | 599 | 58.76 | 0.67 | 1.00 | 0.17 | 0.17 | 0.17 | 0.67 |
-| intelowl | 117 | 64.96 | 1.71 | 7.69 | 0.85 | 0.85 | 1.71 | 1.71 |
-| arches | 2635 | 43.76 | 0.57 | 1.71 | 0.57 | 0.57 | 0.57 | 0.57 |
-| geonode | 922 | 43.06 | 0.43 | 1.52 | 0.22 | 0.33 | 0.33 | 0.33 |
-| ghost | 687 | 66.81 | 20.09 | 22.27 | 19.94 | 19.94 | 19.94 | 20.09 |
-| nodebb | 964 | 37.24 | 0.41 | 0.93 | 0.52 | 0.52 | 0.52 | 0.41 |
-| calcom | 1183 | 74.47 | 6.17 | 7.69 | 6.00 | 6.00 | 6.09 | 6.17 |
-| documenso | 643 | 54.43 | 2.02 | 3.11 | 2.18 | 2.18 | 2.02 | 2.02 |
-| hoppscotch | 1246 | 62.04 | 5.70 | 7.06 | 5.38 | 5.38 | 5.38 | 5.70 |
-| immich | 445 | 44.27 | 0.45 | 2.02 | 0.22 | 0.22 | 0.22 | 0.45 |
-| etherpad | 91 | 68.13 | 0.00 | 3.30 | 0.00 | 0.00 | 0.00 | 0.00 |
-| uptime-kuma | 792 | 64.77 | 3.79 | 4.80 | 3.66 | 3.66 | 3.79 | 3.79 |
-| habitica | 236 | 55.93 | 3.39 | 6.78 | 3.81 | 3.81 | 3.39 | 3.39 |
-| hedgedoc | 48 | 54.17 | 6.25 | 8.33 | 6.25 | 6.25 | 6.25 | 6.25 |
+| repository | known | `line` | `line_text` | `github` | `codeguard` | `cg_no_scope` | `cg_no_mask` | `cg_raw` | `sonar` | `sonar_branch` | `bandit` |
+|---|---:|---:|---:|---:|---:|---:|---:|---:|---:|---:|---:|
+| defectdojo | 420 | 49.52 | 0.95 | 1.43 | 0.95 | 0.95 | 0.95 | 0.95 | 0.95 | 0.95 | 4.29 |
+| saleor | 610 | 68.03 | 0.00 | 0.49 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 1.80 |
+| netbox | 367 | 71.39 | 0.27 | 1.36 | 0.00 | 0.27 | 0.00 | 0.00 | 0.00 | 0.00 | 11.17 |
+| zulip | 785 | 53.25 | 0.25 | 0.64 | 0.13 | 0.13 | 0.25 | 0.25 | 0.25 | 0.25 | 4.08 |
+| healthchecks | 414 | 29.95 | 0.72 | 2.42 | 0.48 | 0.48 | 0.72 | 0.72 | 0.00 | 0.00 | 0.97 |
+| inventree | 911 | 62.13 | 0.22 | 0.88 | 0.11 | 0.33 | 0.11 | 0.22 | 0.11 | 0.11 | 3.40 |
+| addons-server | 554 | 42.96 | 0.36 | 1.62 | 0.36 | 0.36 | 0.36 | 0.36 | 0.18 | 0.18 | 4.33 |
+| kitsune | 910 | 46.59 | 0.22 | 2.09 | 0.33 | 0.33 | 0.33 | 0.22 | 0.22 | 0.22 | 3.08 |
+| readthedocs | 302 | 48.34 | 0.33 | 0.99 | 0.33 | 0.33 | 0.33 | 0.33 | 0.00 | 0.00 | 0.99 |
+| weblate | 241 | 68.05 | 0.41 | 0.83 | 0.00 | 0.00 | 0.00 | 0.41 | 0.41 | 0.41 | 4.98 |
+| mealie | 118 | 57.63 | 0.00 | 0.85 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 5.93 |
+| lnbits | 2230 | 46.73 | 0.18 | 1.43 | 0.18 | 0.49 | 0.22 | 0.18 | 0.09 | 0.09 | 0.99 |
+| jumpserver | 355 | 58.59 | 0.56 | 2.25 | 0.56 | 0.56 | 0.56 | 0.56 | 0.56 | 0.56 | 5.63 |
+| warehouse | 167 | 61.08 | 0.60 | 2.99 | 0.60 | 0.60 | 0.60 | 0.60 | 0.60 | 0.60 | 5.99 |
+| openlibrary | 663 | 55.81 | 2.11 | 4.07 | 1.96 | 1.36 | 1.96 | 2.71 | 0.75 | 0.75 | 3.92 |
+| ckan | 742 | 43.26 | 1.75 | 4.58 | 1.35 | 1.35 | 1.35 | 1.75 | 0.27 | 0.27 | 2.56 |
+| indico | 284 | 50.35 | 1.41 | 2.11 | 1.41 | 1.41 | 1.41 | 1.41 | 1.41 | 1.41 | 6.34 |
+| securedrop | 225 | 46.67 | 0.00 | 1.33 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 1.78 |
+| kiwi | 56 | 50.00 | 1.79 | 1.79 | 0.00 | 0.00 | 0.00 | 1.79 | 0.00 | 0.00 | 10.71 |
+| pgadmin | 920 | 64.02 | 1.20 | 1.85 | 1.20 | 1.20 | 1.20 | 1.20 | 1.09 | 1.09 | 3.59 |
+| erpnext | 1355 | 40.15 | 0.37 | 1.55 | 0.22 | 0.15 | 0.37 | 0.44 | 0.07 | 0.07 | 2.58 |
+| edx-platform | 599 | 58.76 | 0.67 | 1.00 | 0.17 | 0.17 | 0.17 | 0.67 | 0.17 | 0.17 | 2.67 |
+| intelowl | 117 | 64.96 | 1.71 | 7.69 | 0.85 | 0.85 | 1.71 | 1.71 | 0.00 | 0.00 | 2.56 |
+| arches | 2635 | 43.76 | 0.57 | 1.71 | 0.57 | 0.57 | 0.57 | 0.57 | 0.23 | 0.34 | 2.20 |
+| geonode | 922 | 43.06 | 0.43 | 1.52 | 0.22 | 0.33 | 0.33 | 0.33 | 0.33 | 0.33 | 3.15 |
+| ghost | 687 | 66.81 | 20.09 | 22.27 | 19.94 | 19.94 | 19.94 | 20.09 | 1.02 | 1.75 | 24.16 |
+| nodebb | 964 | 37.24 | 0.41 | 0.93 | 0.52 | 0.52 | 0.52 | 0.41 | 0.21 | 0.21 | 1.87 |
+| calcom | 1183 | 74.47 | 6.17 | 7.69 | 6.00 | 6.00 | 6.09 | 6.17 | 0.85 | 0.93 | 10.57 |
+| documenso | 643 | 54.43 | 2.02 | 3.11 | 2.18 | 2.18 | 2.02 | 2.02 | 1.56 | 1.56 | 5.13 |
+| hoppscotch | 1246 | 62.04 | 5.70 | 7.06 | 5.38 | 5.38 | 5.38 | 5.70 | 0.16 | 3.45 | 7.30 |
+| immich | 445 | 44.27 | 0.45 | 2.02 | 0.22 | 0.22 | 0.22 | 0.45 | 0.00 | 0.00 | 1.57 |
+| etherpad | 91 | 68.13 | 0.00 | 3.30 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 4.40 |
+| uptime-kuma | 792 | 64.77 | 3.79 | 4.80 | 3.66 | 3.66 | 3.79 | 3.79 | 0.63 | 0.63 | 4.42 |
+| habitica | 236 | 55.93 | 3.39 | 6.78 | 3.81 | 3.81 | 3.39 | 3.39 | 2.54 | 2.54 | 12.29 |
+| hedgedoc | 48 | 54.17 | 6.25 | 8.33 | 6.25 | 6.25 | 6.25 | 6.25 | 2.08 | 2.08 | 2.08 |
 
 ### Security findings: false-new rate per repository (%)
 
-| repository | known | `line` | `line_text` | `github` | `codeguard` | `cg_no_scope` | `cg_no_mask` | `cg_raw` |
-|---|---:|---:|---:|---:|---:|---:|---:|---:|
-| defectdojo | 19 | 73.68 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 |
-| saleor | 72 | 41.67 | 0.00 | 1.39 | 0.00 | 0.00 | 0.00 | 0.00 |
-| netbox | 40 | 77.50 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 |
-| zulip | 120 | 39.17 | 0.00 | 0.83 | 0.00 | 0.00 | 0.00 | 0.00 |
-| healthchecks | 91 | 58.24 | 0.00 | 1.10 | 0.00 | 0.00 | 0.00 | 0.00 |
-| inventree | 37 | 67.57 | 0.00 | 2.70 | 0.00 | 0.00 | 0.00 | 0.00 |
-| addons-server | 41 | 56.10 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 |
-| kitsune | 104 | 31.73 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 |
-| readthedocs | 204 | 46.08 | 0.49 | 0.98 | 0.49 | 0.49 | 0.49 | 0.49 |
-| weblate | 42 | 45.24 | 0.00 | 2.38 | 0.00 | 0.00 | 0.00 | 0.00 |
-| mealie | 26 | 34.62 | 0.00 | 3.85 | 0.00 | 0.00 | 0.00 | 0.00 |
-| lnbits | 1708 | 40.57 | 0.18 | 1.41 | 0.12 | 0.53 | 0.18 | 0.18 |
-| jumpserver | 89 | 71.91 | 1.12 | 1.12 | 1.12 | 1.12 | 1.12 | 1.12 |
-| warehouse | 66 | 62.12 | 1.52 | 3.03 | 1.52 | 1.52 | 1.52 | 1.52 |
-| openlibrary | 195 | 55.90 | 2.05 | 3.59 | 3.59 | 1.54 | 3.59 | 4.10 |
-| ckan | 30 | 36.67 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 |
-| indico | 10 | 50.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 |
-| securedrop | 94 | 37.23 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 |
-| kiwi | 31 | 45.16 | 3.23 | 3.23 | 0.00 | 0.00 | 0.00 | 3.23 |
-| pgadmin | 88 | 61.36 | 1.14 | 2.27 | 1.14 | 1.14 | 1.14 | 1.14 |
-| erpnext | 1 | 100.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 |
-| edx-platform | 194 | 52.58 | 1.03 | 1.03 | 0.00 | 0.00 | 0.00 | 1.03 |
-| intelowl | 43 | 51.16 | 4.65 | 16.28 | 2.33 | 2.33 | 4.65 | 4.65 |
-| arches | 94 | 45.74 | 1.06 | 6.38 | 1.06 | 1.06 | 1.06 | 1.06 |
-| geonode | 107 | 53.27 | 1.87 | 0.93 | 0.00 | 0.93 | 0.93 | 0.93 |
-| ghost | 192 | 65.10 | 19.27 | 21.88 | 18.75 | 18.75 | 18.75 | 19.27 |
-| nodebb | 591 | 30.80 | 0.34 | 0.34 | 0.51 | 0.51 | 0.51 | 0.34 |
-| calcom | 655 | 81.37 | 6.26 | 7.48 | 6.72 | 6.72 | 6.72 | 6.26 |
-| documenso | 155 | 70.97 | 0.65 | 2.58 | 2.58 | 2.58 | 0.65 | 0.65 |
-| hoppscotch | 235 | 56.60 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 |
-| immich | 178 | 30.90 | 0.00 | 0.56 | 0.00 | 0.00 | 0.00 | 0.00 |
-| etherpad | 33 | 72.73 | 0.00 | 9.09 | 0.00 | 0.00 | 0.00 | 0.00 |
-| uptime-kuma | 95 | 73.68 | 6.32 | 8.42 | 5.26 | 5.26 | 6.32 | 6.32 |
-| habitica | 78 | 74.36 | 1.28 | 3.85 | 2.56 | 2.56 | 1.28 | 1.28 |
-| hedgedoc | 36 | 52.78 | 2.78 | 5.56 | 2.78 | 2.78 | 2.78 | 2.78 |
+| repository | known | `line` | `line_text` | `github` | `codeguard` | `cg_no_scope` | `cg_no_mask` | `cg_raw` | `sonar` | `sonar_branch` | `bandit` |
+|---|---:|---:|---:|---:|---:|---:|---:|---:|---:|---:|---:|
+| defectdojo | 19 | 73.68 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 10.53 |
+| saleor | 72 | 41.67 | 0.00 | 1.39 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 |
+| netbox | 40 | 77.50 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 30.00 |
+| zulip | 120 | 39.17 | 0.00 | 0.83 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 5.00 |
+| healthchecks | 91 | 58.24 | 0.00 | 1.10 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 |
+| inventree | 37 | 67.57 | 0.00 | 2.70 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 8.11 |
+| addons-server | 41 | 56.10 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 17.07 |
+| kitsune | 104 | 31.73 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 4.81 |
+| readthedocs | 204 | 46.08 | 0.49 | 0.98 | 0.49 | 0.49 | 0.49 | 0.49 | 0.00 | 0.00 | 0.00 |
+| weblate | 42 | 45.24 | 0.00 | 2.38 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 2.38 |
+| mealie | 26 | 34.62 | 0.00 | 3.85 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 |
+| lnbits | 1708 | 40.57 | 0.18 | 1.41 | 0.12 | 0.53 | 0.18 | 0.18 | 0.06 | 0.06 | 0.23 |
+| jumpserver | 89 | 71.91 | 1.12 | 1.12 | 1.12 | 1.12 | 1.12 | 1.12 | 1.12 | 1.12 | 6.74 |
+| warehouse | 66 | 62.12 | 1.52 | 3.03 | 1.52 | 1.52 | 1.52 | 1.52 | 1.52 | 1.52 | 0.00 |
+| openlibrary | 195 | 55.90 | 2.05 | 3.59 | 3.59 | 1.54 | 3.59 | 4.10 | 1.03 | 1.03 | 2.05 |
+| ckan | 30 | 36.67 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 |
+| indico | 10 | 50.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 |
+| securedrop | 94 | 37.23 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 |
+| kiwi | 31 | 45.16 | 3.23 | 3.23 | 0.00 | 0.00 | 0.00 | 3.23 | 0.00 | 0.00 | 12.90 |
+| pgadmin | 88 | 61.36 | 1.14 | 2.27 | 1.14 | 1.14 | 1.14 | 1.14 | 0.00 | 0.00 | 6.82 |
+| erpnext | 1 | 100.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 100.00 |
+| edx-platform | 194 | 52.58 | 1.03 | 1.03 | 0.00 | 0.00 | 0.00 | 1.03 | 0.00 | 0.00 | 2.58 |
+| intelowl | 43 | 51.16 | 4.65 | 16.28 | 2.33 | 2.33 | 4.65 | 4.65 | 0.00 | 0.00 | 2.33 |
+| arches | 94 | 45.74 | 1.06 | 6.38 | 1.06 | 1.06 | 1.06 | 1.06 | 0.00 | 0.00 | 23.40 |
+| geonode | 107 | 53.27 | 1.87 | 0.93 | 0.00 | 0.93 | 0.93 | 0.93 | 0.93 | 0.93 | 1.87 |
+| ghost | 192 | 65.10 | 19.27 | 21.88 | 18.75 | 18.75 | 18.75 | 19.27 | 1.04 | 1.56 | 18.23 |
+| nodebb | 591 | 30.80 | 0.34 | 0.34 | 0.51 | 0.51 | 0.51 | 0.34 | 0.17 | 0.17 | 0.00 |
+| calcom | 655 | 81.37 | 6.26 | 7.48 | 6.72 | 6.72 | 6.72 | 6.26 | 0.46 | 0.46 | 4.89 |
+| documenso | 155 | 70.97 | 0.65 | 2.58 | 2.58 | 2.58 | 0.65 | 0.65 | 0.65 | 0.65 | 0.00 |
+| hoppscotch | 235 | 56.60 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 |
+| immich | 178 | 30.90 | 0.00 | 0.56 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 |
+| etherpad | 33 | 72.73 | 0.00 | 9.09 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 |
+| uptime-kuma | 95 | 73.68 | 6.32 | 8.42 | 5.26 | 5.26 | 6.32 | 6.32 | 1.05 | 1.05 | 5.26 |
+| habitica | 78 | 74.36 | 1.28 | 3.85 | 2.56 | 2.56 | 1.28 | 1.28 | 0.00 | 0.00 | 0.00 |
+| hedgedoc | 36 | 52.78 | 2.78 | 5.56 | 2.78 | 2.78 | 2.78 | 2.78 | 2.78 | 2.78 | 0.00 |
diff --git a/research/finding_identity/paper/pooled.csv b/research/finding_identity/paper/pooled.csv
index ac51601..9597fcf 100644
--- a/research/finding_identity/paper/pooled.csv
+++ b/research/finding_identity/paper/pooled.csv
@@ -41,6 +41,24 @@ all,cg_raw,false_new_edited,35,29,142,142,1.000000,0.973660,1.000000,1.000000,1.
 all,cg_raw,hidden,35,35,20,1974,0.010132,0.006568,0.015598,0.003996,0.019674,0.017041,0.004947,0.032008,0.000000,0.000000,0.006093
 all,cg_raw,mispair,35,35,33,23237,0.001420,0.001011,0.001994,0.000166,0.003244,0.002074,0.000089,0.005510,0.000000,0.000000,0.000000
 all,cg_raw,collision,35,35,4747,36232,0.131017,0.127582,0.134530,0.089343,0.176607,0.109271,0.080271,0.142716,0.089370,0.040768,0.141224
+all,sonar,false_new,35,35,91,23237,0.003916,0.003191,0.004805,0.002584,0.005663,0.004783,0.002887,0.006932,0.002198,0.000000,0.006927
+all,sonar,false_new_moved,35,35,1,23095,0.000043,0.000008,0.000245,0.000000,0.000146,0.000030,0.000000,0.000089,0.000000,0.000000,0.000000
+all,sonar,false_new_edited,35,29,90,142,0.633803,0.552011,0.708546,0.514920,0.737145,0.605913,0.474412,0.732971,0.545455,0.333333,1.000000
+all,sonar,hidden,35,35,29,1974,0.014691,0.010248,0.021019,0.008434,0.023653,0.019827,0.008686,0.033499,0.000000,0.000000,0.024019
+all,sonar,mispair,35,35,39,23237,0.001678,0.001228,0.002293,0.000618,0.003277,0.001327,0.000423,0.002555,0.000000,0.000000,0.000871
+all,sonar,collision,35,35,7349,36232,0.202832,0.198723,0.207004,0.164883,0.243706,0.190962,0.154493,0.230352,0.168421,0.106615,0.235594
+all,sonar_branch,false_new,35,35,141,23237,0.006068,0.005148,0.007151,0.003278,0.010205,0.005988,0.003555,0.008802,0.002548,0.000000,0.008420
+all,sonar_branch,false_new_moved,35,35,51,23095,0.002208,0.001680,0.002902,0.000115,0.006173,0.001242,0.000054,0.003342,0.000000,0.000000,0.000000
+all,sonar_branch,false_new_edited,35,29,90,142,0.633803,0.552011,0.708546,0.514920,0.737145,0.605913,0.474412,0.732971,0.545455,0.333333,1.000000
+all,sonar_branch,hidden,35,35,28,1974,0.014184,0.009832,0.020424,0.008194,0.023240,0.019699,0.008630,0.033384,0.000000,0.000000,0.024019
+all,sonar_branch,mispair,35,35,39,23237,0.001678,0.001228,0.002293,0.000618,0.003277,0.001327,0.000423,0.002555,0.000000,0.000000,0.000871
+all,sonar_branch,collision,35,35,7349,36232,0.202832,0.198723,0.207004,0.164883,0.243706,0.190962,0.154493,0.230352,0.168421,0.106615,0.235594
+all,bandit,false_new,35,35,1019,23237,0.043852,0.041294,0.046562,0.030551,0.063435,0.049567,0.036685,0.065673,0.039216,0.023809,0.057830
+all,bandit,false_new_moved,35,35,985,23095,0.042650,0.040119,0.045333,0.029530,0.061965,0.047836,0.035436,0.063682,0.036304,0.022876,0.050496
+all,bandit,false_new_edited,35,29,34,142,0.239437,0.176703,0.315897,0.148513,0.348217,0.244475,0.132005,0.369885,0.000000,0.000000,0.375000
+all,bandit,hidden,35,35,394,1974,0.199595,0.182554,0.217803,0.140856,0.286239,0.236054,0.160480,0.315018,0.173333,0.022500,0.405874
+all,bandit,mispair,35,35,856,23237,0.036838,0.034491,0.039337,0.020550,0.056113,0.029548,0.016366,0.045205,0.010558,0.000000,0.040872
+all,bandit,collision,35,35,19625,36232,0.541648,0.536514,0.546774,0.443804,0.625265,0.457891,0.376926,0.536827,0.452210,0.248294,0.696856
 security,line,false_new,35,35,2938,5794,0.507076,0.494203,0.519940,0.430777,0.628516,0.555587,0.503350,0.609671,0.532710,0.434140,0.692677
 security,line,false_new_moved,35,35,2919,5769,0.505980,0.493079,0.518873,0.430013,0.627157,0.554700,0.502440,0.608883,0.536585,0.425000,0.691734
 security,line,false_new_edited,35,15,19,25,0.760000,0.565703,0.885037,0.529412,0.958333,0.755556,0.527741,0.948718,1.000000,0.666667,1.000000
@@ -83,3 +101,21 @@ security,cg_raw,false_new_edited,35,15,25,25,1.000000,0.866808,1.000000,1.000000
 security,cg_raw,hidden,35,29,11,648,0.016975,0.009505,0.030139,0.001585,0.042828,0.030037,0.003162,0.062662,0.000000,0.000000,0.000000
 security,cg_raw,mispair,35,35,30,5794,0.005178,0.003629,0.007382,0.000000,0.013271,0.005522,0.000000,0.015613,0.000000,0.000000,0.000000
 security,cg_raw,collision,35,35,1756,8703,0.201770,0.193470,0.210332,0.086521,0.350409,0.138000,0.089963,0.193162,0.096386,0.000000,0.201241
+security,sonar,false_new,35,35,15,5794,0.002589,0.001570,0.004267,0.001318,0.004707,0.003086,0.001267,0.005272,0.000000,0.000000,0.003136
+security,sonar,false_new_moved,35,35,1,5769,0.000173,0.000031,0.000981,0.000000,0.000571,0.000048,0.000000,0.000145,0.000000,0.000000,0.000000
+security,sonar,false_new_edited,35,15,14,25,0.560000,0.370673,0.733344,0.333333,0.769231,0.577778,0.333333,0.800000,0.666667,0.000000,1.000000
+security,sonar,hidden,35,29,8,648,0.012346,0.006269,0.024170,0.001562,0.029907,0.023850,0.001876,0.051190,0.000000,0.000000,0.000000
+security,sonar,mispair,35,35,20,5794,0.003452,0.002236,0.005326,0.001022,0.007178,0.003588,0.000474,0.007710,0.000000,0.000000,0.000000
+security,sonar,collision,35,35,2947,8703,0.338619,0.328750,0.348631,0.238727,0.467974,0.298101,0.226439,0.376412,0.260582,0.168695,0.384058
+security,sonar_branch,false_new,35,35,16,5794,0.002761,0.001701,0.004481,0.001353,0.005197,0.003235,0.001337,0.005513,0.000000,0.000000,0.003136
+security,sonar_branch,false_new_moved,35,35,2,5769,0.000347,0.000095,0.001263,0.000000,0.000964,0.000200,0.000000,0.000550,0.000000,0.000000,0.000000
+security,sonar_branch,false_new_edited,35,15,14,25,0.560000,0.370673,0.733344,0.333333,0.769231,0.577778,0.333333,0.800000,0.666667,0.000000,1.000000
+security,sonar_branch,hidden,35,29,8,648,0.012346,0.006269,0.024170,0.001562,0.029907,0.023850,0.001876,0.051190,0.000000,0.000000,0.000000
+security,sonar_branch,mispair,35,35,20,5794,0.003452,0.002236,0.005326,0.001022,0.007178,0.003588,0.000474,0.007710,0.000000,0.000000,0.000000
+security,sonar_branch,collision,35,35,2947,8703,0.338619,0.328750,0.348631,0.238727,0.467974,0.298101,0.226439,0.376412,0.260582,0.168695,0.384058
+security,bandit,false_new,35,35,163,5794,0.028133,0.024178,0.032713,0.012404,0.057348,0.075771,0.030815,0.141834,0.020513,0.000000,0.067799
+security,bandit,false_new_moved,35,35,159,5769,0.027561,0.023641,0.032110,0.012040,0.056548,0.075396,0.030426,0.141435,0.018868,0.000000,0.062892
+security,bandit,false_new_edited,35,15,4,25,0.160000,0.064035,0.346536,0.000000,0.360000,0.155556,0.000000,0.355556,0.000000,0.000000,0.000000
+security,bandit,hidden,35,29,128,648,0.197531,0.168698,0.229929,0.131735,0.292796,0.289821,0.173962,0.415491,0.157895,0.000000,0.500000
+security,bandit,mispair,35,35,133,5794,0.022955,0.019403,0.027139,0.008288,0.045049,0.021950,0.006386,0.044178,0.000000,0.000000,0.008264
+security,bandit,collision,35,35,4641,8703,0.533264,0.522771,0.543729,0.369401,0.710788,0.489622,0.401224,0.577952,0.469880,0.312519,0.720693
diff --git a/research/finding_identity/paper/repos.csv b/research/finding_identity/paper/repos.csv
index b40f83e..0ee13ab 100644
--- a/research/finding_identity/paper/repos.csv
+++ b/research/finding_identity/paper/repos.csv
@@ -1,36 +1,36 @@
 label,head,commit_pairs,versions_scanned,elapsed_seconds,all_observations,all_known,all_introduced,security_observations,security_known,security_introduced
-defectdojo,559a677f183c0083cd78906be1527b3eb1a2dfb7,200,578,38.700000,700,420,21,46,19,11
-saleor,925b69959a97c9deda7cdc85092494896d0aa1f4,200,1624,95.900000,1066,610,40,122,72,3
-netbox,0c2635e0b86096e1937976ce9158e139dff108dd,200,1302,130.000000,553,367,67,83,40,34
-zulip,85f6f243094f7a2bdff42f565763eb2bf68d5f6a,200,755,150.700000,1298,785,16,236,120,4
-healthchecks,ea65922ae6b3bdf3cf4cb4e3a5ed5f6e660c31ed,200,717,22.100000,615,414,13,97,91,0
-inventree,720ba157bb006cb0edcebe9dba05a2b9d0a3d7ba,200,1378,104.200000,1352,911,41,78,37,3
-addons-server,1acac15ee405a6664eb02c2a991b99e6f53cf22f,200,730,92.000000,776,554,1,55,41,0
-kitsune,522df66df0ff55f8e3406dfe5c8ee6b7fe8cc8e5,200,734,44.100000,1396,910,56,156,104,2
-readthedocs,90e0eb5a328bd5c973067b2b4b412c787afebe73,200,609,40.800000,383,302,6,245,204,4
-weblate,5b328473a12d06dac172f9bd90f3ebeb3edef1f6,200,332,86.200000,393,241,16,65,42,0
-mealie,1eced44c96664e8263e817317c87e7fc2ce85790,200,596,21.400000,186,118,7,37,26,2
-lnbits,dc24c15f4735871c382ca96827a62224852d39e4,200,1037,76.200000,2969,2230,352,2150,1708,148
-jumpserver,ac331bb74f054883ffea1559c8a044eb66fcd794,200,793,29.200000,497,355,50,129,89,13
-warehouse,8a4943e82c7f5f3e26ab1c9688f5cb141030050e,200,692,68.700000,230,167,12,90,66,2
-openlibrary,083e584de8fa360dba048f643076e04c210429a8,200,1358,87.500000,973,663,71,291,195,19
-ckan,94a2156b7ae8156b8ef478648a90095313134781,200,647,55.400000,1605,742,66,52,30,4
-indico,b373431fd7a06849bb112cdbca60abbcfc5a0b21,200,655,34.600000,406,284,5,18,10,0
-securedrop,fb5c1f153ebef7c5057cd3c7b69fadd49bcc83f4,200,364,20.000000,323,225,11,133,94,0
-kiwi,bdeefcac75426a8ff6c10a4c95184c536e61f125,200,417,12.700000,79,56,3,42,31,3
-pgadmin,5f6d72c686863682d9e79166a23e269dcdf1e9a1,200,497,41.200000,1532,920,152,207,88,78
-erpnext,9527ffc41e79454091f98c2d9fd0932ad6a2b025,200,1030,134.900000,2141,1355,23,2,1,0
-edx-platform,ce074d1155541e42f811da8e9d0891590ab73e8e,200,1142,87.800000,934,599,12,277,194,7
-intelowl,862df0a04ec6caf294f49e87f28ead79691fe0af,200,1381,32.300000,224,117,25,87,43,8
-arches,028cc114a2a5e9151fd87ef2776fa1bd3a3d01d5,200,1083,57.400000,4023,2635,107,131,94,3
-geonode,6b1aca59bb500d00f166b910307a56897734eb01,200,645,56.700000,1229,922,8,145,107,3
-ghost,90392e7ada714530b0de7046a10b3e52981845f8,200,1596,125.500000,1063,687,77,302,192,43
-nodebb,1fc9d42a3e07be4d1bd2f087bfdca889faf287da,200,506,94.600000,1276,964,24,756,591,7
-calcom,54343aa685ae8f33159d2f485ec4a57bad5c574a,200,5131,271.700000,2661,1183,104,1335,655,82
-documenso,d4e6eeaf880dc2b3425dcb0242b9a4206ac10443,200,2260,116.600000,1269,643,225,306,155,43
-hoppscotch,63273f8e599e73f0fb38c0739314e8d46b6bc83d,200,1286,122.700000,1894,1246,222,387,235,82
-immich,83c7ec50056bbefa10869c78457f8882c72275e2,200,599,100.300000,642,445,27,230,178,3
-etherpad,bb0473c650b8253ba5bf14a59a7a6d7b0c16a24e,200,133,14.400000,190,91,29,65,33,7
-uptime-kuma,b092505f894d66669b67f46e1da72b51016eceab,200,439,41.500000,930,792,68,138,95,21
-habitica,6eceb3d7707e1c8049d36e50debb03a119057067,200,618,55.800000,329,236,6,142,78,4
-hedgedoc,f98ea9c4079dea39a54ed6d20e9521a3039dbff7,200,611,20.400000,95,48,11,68,36,5
+defectdojo,559a677f183c0083cd78906be1527b3eb1a2dfb7,200,578,60.400000,700,420,21,46,19,11
+saleor,925b69959a97c9deda7cdc85092494896d0aa1f4,200,1624,153.700000,1066,610,40,122,72,3
+netbox,0c2635e0b86096e1937976ce9158e139dff108dd,200,1302,206.500000,553,367,67,83,40,34
+zulip,85f6f243094f7a2bdff42f565763eb2bf68d5f6a,200,755,244.500000,1298,785,16,236,120,4
+healthchecks,ea65922ae6b3bdf3cf4cb4e3a5ed5f6e660c31ed,200,717,35.900000,615,414,13,97,91,0
+inventree,720ba157bb006cb0edcebe9dba05a2b9d0a3d7ba,200,1378,177.900000,1352,911,41,78,37,3
+addons-server,1acac15ee405a6664eb02c2a991b99e6f53cf22f,200,730,159.400000,776,554,1,55,41,0
+kitsune,522df66df0ff55f8e3406dfe5c8ee6b7fe8cc8e5,200,734,70.800000,1396,910,56,156,104,2
+readthedocs,90e0eb5a328bd5c973067b2b4b412c787afebe73,200,609,68.800000,383,302,6,245,204,4
+weblate,5b328473a12d06dac172f9bd90f3ebeb3edef1f6,200,332,148.700000,393,241,16,65,42,0
+mealie,1eced44c96664e8263e817317c87e7fc2ce85790,200,596,33.400000,186,118,7,37,26,2
+lnbits,dc24c15f4735871c382ca96827a62224852d39e4,200,1037,130.100000,2969,2230,352,2150,1708,148
+jumpserver,ac331bb74f054883ffea1559c8a044eb66fcd794,200,793,49.400000,497,355,50,129,89,13
+warehouse,8a4943e82c7f5f3e26ab1c9688f5cb141030050e,200,692,117.500000,230,167,12,90,66,2
+openlibrary,083e584de8fa360dba048f643076e04c210429a8,200,1358,143.900000,973,663,71,291,195,19
+ckan,94a2156b7ae8156b8ef478648a90095313134781,200,647,95.600000,1605,742,66,52,30,4
+indico,b373431fd7a06849bb112cdbca60abbcfc5a0b21,200,655,55.100000,406,284,5,18,10,0
+securedrop,fb5c1f153ebef7c5057cd3c7b69fadd49bcc83f4,200,364,33.600000,323,225,11,133,94,0
+kiwi,bdeefcac75426a8ff6c10a4c95184c536e61f125,200,417,19.400000,79,56,3,42,31,3
+pgadmin,5f6d72c686863682d9e79166a23e269dcdf1e9a1,200,497,69.400000,1532,920,152,207,88,78
+erpnext,9527ffc41e79454091f98c2d9fd0932ad6a2b025,200,1030,233.000000,2141,1355,23,2,1,0
+edx-platform,ce074d1155541e42f811da8e9d0891590ab73e8e,200,1142,147.800000,934,599,12,277,194,7
+intelowl,862df0a04ec6caf294f49e87f28ead79691fe0af,200,1381,50.100000,224,117,25,87,43,8
+arches,028cc114a2a5e9151fd87ef2776fa1bd3a3d01d5,200,1083,103.500000,4023,2635,107,131,94,3
+geonode,6b1aca59bb500d00f166b910307a56897734eb01,200,645,106.000000,1229,922,8,145,107,3
+ghost,90392e7ada714530b0de7046a10b3e52981845f8,200,1596,203.700000,1063,687,77,302,192,43
+nodebb,1fc9d42a3e07be4d1bd2f087bfdca889faf287da,200,506,154.400000,1276,964,24,756,591,7
+calcom,54343aa685ae8f33159d2f485ec4a57bad5c574a,200,5131,424.200000,2661,1183,104,1335,655,82
+documenso,d4e6eeaf880dc2b3425dcb0242b9a4206ac10443,200,2260,183.300000,1269,643,225,306,155,43
+hoppscotch,63273f8e599e73f0fb38c0739314e8d46b6bc83d,200,1286,201.200000,1894,1246,222,387,235,82
+immich,83c7ec50056bbefa10869c78457f8882c72275e2,200,599,156.200000,642,445,27,230,178,3
+etherpad,bb0473c650b8253ba5bf14a59a7a6d7b0c16a24e,200,133,21.800000,190,91,29,65,33,7
+uptime-kuma,b092505f894d66669b67f46e1da72b51016eceab,200,439,71.000000,930,792,68,138,95,21
+habitica,6eceb3d7707e1c8049d36e50debb03a119057067,200,618,87.400000,329,236,6,142,78,4
+hedgedoc,f98ea9c4079dea39a54ed6d20e9521a3039dbff7,200,611,30.300000,95,48,11,68,36,5
diff --git a/research/finding_identity/paper/rq1.csv b/research/finding_identity/paper/rq1.csv
new file mode 100644
index 0000000..c1f311e
--- /dev/null
+++ b/research/finding_identity/paper/rq1.csv
@@ -0,0 +1,127 @@
+findings,scheme,metric,num,den,rate,ci_lo,ci_hi,median
+codeguard,line,false_new,12215,23237,0.5256702672462021,0.48508707074732044,0.576212044563034,0.5443234836702955
+codeguard,line,false_new_same_path,11928,22950,0.5197385620915033,0.481059906369137,0.567509829315723,0.543613707165109
+codeguard,line,false_new_renamed,287,287,1.0,1.0,1.0,1.0
+codeguard,line,hidden,24,1974,0.0121580547112462,0.006280502968270888,0.02159216568560695,0.0
+codeguard,line,mispair,655,23237,0.028187803933382105,0.01574143975350118,0.03930860435686168,0.015730337078651686
+codeguard,line,collision,758,36232,0.020920733053654227,0.010801571220582751,0.035127247989899614,0.0031520882584712374
+codeguard,line_text,false_new,440,23237,0.0189353186728063,0.00797919830915503,0.035132729220192276,0.0056925996204933585
+codeguard,line_text,false_new_same_path,153,22950,0.006666666666666667,0.004841317659190545,0.009084832325648285,0.005633802816901409
+codeguard,line_text,false_new_renamed,287,287,1.0,1.0,1.0,1.0
+codeguard,line_text,hidden,23,1974,0.01165146909827761,0.005177498838521272,0.02206548229606482,0.0
+codeguard,line_text,mispair,44,23237,0.00189353186728063,0.0004866991255674466,0.0039321620852973355,0.0
+codeguard,line_text,collision,6318,36232,0.1743762419960256,0.139869114403663,0.21275167477317317,0.14782608695652175
+codeguard,github,false_new,730,23237,0.03141541507079227,0.019566594444845983,0.0486210420254932,0.01847826086956522
+codeguard,github,false_new_same_path,443,22950,0.019302832244008715,0.01618012486320386,0.023231940483154197,0.017857142857142856
+codeguard,github,false_new_renamed,287,287,1.0,1.0,1.0,1.0
+codeguard,github,hidden,16,1974,0.008105369807497468,0.00217388352266018,0.01871356638902986,0.0
+codeguard,github,mispair,21,23237,0.0009037311184748461,0.0,0.0021783282304894255,0.0
+codeguard,github,collision,758,36232,0.020920733053654227,0.010801571220582751,0.035127247989899614,0.0031520882584712374
+codeguard,codeguard,false_new,417,23237,0.017945517924000516,0.007168154629764463,0.033881127095392025,0.004830917874396135
+codeguard,codeguard,false_new_same_path,130,22950,0.005664488017429194,0.003885563982323795,0.007959004328635323,0.0036101083032490976
+codeguard,codeguard,false_new_renamed,287,287,1.0,1.0,1.0,1.0
+codeguard,codeguard,hidden,37,1974,0.018743667679837893,0.00918306937235426,0.03501239876239876,0.0
+codeguard,codeguard,mispair,78,23237,0.0033567155829065712,0.0009607399260565736,0.006765654070207919,0.0
+codeguard,codeguard,collision,6723,36232,0.18555420622654006,0.12907089875538497,0.2484917726073919,0.11921891058581706
+codeguard,sonar,false_new,91,23237,0.003916168180057667,0.0025837985863663582,0.005662752136242597,0.002197802197802198
+codeguard,sonar,false_new_same_path,83,22950,0.003616557734204793,0.0023754979646875367,0.005269806606773018,0.002074688796680498
+codeguard,sonar,false_new_renamed,8,287,0.027874564459930314,0.0165016501650165,0.08333333333333333,0.020622895622895623
+codeguard,sonar,hidden,29,1974,0.014690982776089158,0.008434340810975164,0.023653088042049936,0.0
+codeguard,sonar,mispair,39,23237,0.0016783577914532856,0.0006183088998349797,0.0032774825830011074,0.0
+codeguard,sonar,collision,7349,36232,0.202831750938397,0.16488306905032582,0.2437057730684742,0.16842105263157894
+codeguard,sonar_branch,false_new,141,23237,0.00606790893833111,0.0032775592020222416,0.010204573533971922,0.0025477707006369425
+codeguard,sonar_branch,false_new_same_path,83,22950,0.003616557734204793,0.0023754979646875367,0.005269806606773018,0.002074688796680498
+codeguard,sonar_branch,false_new_renamed,58,287,0.20209059233449478,0.04276315789473684,0.6227242524916942,0.2803030303030303
+codeguard,sonar_branch,hidden,28,1974,0.014184397163120567,0.008193657420937084,0.023239968895040722,0.0
+codeguard,sonar_branch,mispair,39,23237,0.0016783577914532856,0.0006183088998349797,0.0032774825830011074,0.0
+codeguard,sonar_branch,collision,7349,36232,0.202831750938397,0.16488306905032582,0.2437057730684742,0.16842105263157894
+codeguard,bandit,false_new,1019,23237,0.04385247665361277,0.030550941370830163,0.06343474642518161,0.0392156862745098
+codeguard,bandit,false_new_same_path,732,22950,0.03189542483660131,0.025389941511239116,0.040506391521089036,0.03402854006586169
+codeguard,bandit,false_new_renamed,287,287,1.0,1.0,1.0,1.0
+codeguard,bandit,hidden,394,1974,0.19959473150962512,0.14085591003948478,0.2862391490186747,0.17333333333333334
+codeguard,bandit,mispair,856,23237,0.036837801781641345,0.020549923347719497,0.05611311126411797,0.010558069381598794
+codeguard,bandit,collision,19625,36232,0.5416482667255464,0.4438042926191753,0.6252649223186961,0.4522096608427544
+bandit,line,false_new,8638,15718,0.5495610128515078,0.49565958253161585,0.6156128820534795,0.5491857506361324
+bandit,line,false_new_same_path,8634,15714,0.5494463535700649,0.4955458919069132,0.6155928336076846,0.5491857506361324
+bandit,line,false_new_renamed,4,4,1.0,1.0,1.0,1.0
+bandit,line,hidden,21,1097,0.019143117593436645,0.0039837472983364425,0.04005372097347767,0.0
+bandit,line,mispair,304,15718,0.019340883064003053,0.01273345882376265,0.028753906553047437,0.012282948899379191
+bandit,line,collision,0,0,,,,
+bandit,line_text,false_new,122,15718,0.007761801755948594,0.005173824499974432,0.010797870487310254,0.005867694026323704
+bandit,line_text,false_new_same_path,118,15714,0.007509227440498918,0.00487279830286158,0.010582022546114442,0.0055415316390926145
+bandit,line_text,false_new_renamed,4,4,1.0,1.0,1.0,1.0
+bandit,line_text,hidden,66,1097,0.0601640838650866,0.025746368964681653,0.1,0.01165994623655914
+bandit,line_text,mispair,204,15718,0.012978750477159944,0.002909843386225609,0.020976232424536417,0.0
+bandit,line_text,collision,0,0,,,,
+bandit,github,false_new,304,15718,0.019340883064003053,0.010955503435360184,0.030539413543518072,0.012740157808881405
+bandit,github,false_new_same_path,300,15714,0.019091256204658267,0.010675196116731366,0.03033853746685627,0.011399966024232395
+bandit,github,false_new_renamed,4,4,1.0,1.0,1.0,1.0
+bandit,github,hidden,36,1097,0.032816773017319965,0.01241098118515914,0.05868289998076936,0.0
+bandit,github,mispair,51,15718,0.003244687619289986,0.0005205399857086933,0.006581753151840349,0.0
+bandit,github,collision,0,0,,,,
+bandit,codeguard,false_new,66,15718,0.004199007507316452,0.0022769338846928503,0.00716322906011409,0.0019913419913419913
+bandit,codeguard,false_new_same_path,62,15714,0.003945526282296042,0.002065093960607553,0.006941956490066572,0.0016724496877168634
+bandit,codeguard,false_new_renamed,4,4,1.0,1.0,1.0,1.0
+bandit,codeguard,hidden,27,1097,0.024612579762989972,0.011409878861772638,0.04153026481715006,0.0
+bandit,codeguard,mispair,4,15718,0.0002544853034737244,0.0,0.0005928853754940712,0.0
+bandit,codeguard,collision,0,0,,,,
+bandit,sonar,false_new,43,15718,0.002735717012342537,0.0010957672820826139,0.005225246028721964,0.00018621973929236498
+bandit,sonar,false_new_same_path,43,15714,0.0027364133893343517,0.0010957805841125756,0.005225246028721964,0.00018621973929236498
+bandit,sonar,false_new_renamed,0,4,0.0,0.0,0.0,0.0
+bandit,sonar,hidden,49,1097,0.044667274384685506,0.015642655588159856,0.0838225476958907,0.0
+bandit,sonar,mispair,96,15718,0.006107647283369385,0.0030163660143298155,0.009522771018103962,0.0
+bandit,sonar,collision,0,0,,,,
+bandit,sonar_branch,false_new,43,15718,0.002735717012342537,0.0010957672820826139,0.005225246028721964,0.00018621973929236498
+bandit,sonar_branch,false_new_same_path,43,15714,0.0027364133893343517,0.0010957805841125756,0.005225246028721964,0.00018621973929236498
+bandit,sonar_branch,false_new_renamed,0,4,0.0,0.0,0.0,0.0
+bandit,sonar_branch,hidden,49,1097,0.044667274384685506,0.015642655588159856,0.0838225476958907,0.0
+bandit,sonar_branch,mispair,96,15718,0.006107647283369385,0.0030163660143298155,0.009522771018103962,0.0
+bandit,sonar_branch,collision,0,0,,,,
+bandit,bandit,false_new,9,15718,0.0005725919328158799,7.530092134839615e-05,0.0012577898687104834,0.0
+bandit,bandit,false_new_same_path,5,15714,0.0003181876034109711,0.0,0.0007360320371823546,0.0
+bandit,bandit,false_new_renamed,4,4,1.0,1.0,1.0,1.0
+bandit,bandit,hidden,320,1097,0.2917046490428441,0.20108275328692962,0.4088865034194061,0.34673202614379084
+bandit,bandit,mispair,567,15718,0.036073291767400435,0.015291902658913835,0.05615494418945678,0.008777929776561787
+bandit,bandit,collision,0,0,,,,
+bandit_all_rules,line,false_new,85570,174853,0.48938250987972753,0.43722422427799196,0.566897712961824,0.5490669859643328
+bandit_all_rules,line,false_new_same_path,85500,174783,0.48917800930296423,0.4369695580086782,0.5668448209848959,0.5490669859643328
+bandit_all_rules,line,false_new_renamed,70,70,1.0,1.0,1.0,1.0
+bandit_all_rules,line,hidden,454,13024,0.03485872235872236,0.02538164428043939,0.053109951505471056,0.024480880856920594
+bandit_all_rules,line,mispair,20008,174853,0.11442754771150623,0.08360929298571583,0.13639820479800702,0.05482565558462171
+bandit_all_rules,line,collision,117,252744,0.0004629190010445352,0.00027295279392511524,0.0009201032340911476,0.00018905418849612422
+bandit_all_rules,line_text,false_new,1270,174853,0.007263243982087811,0.004627073251351284,0.011282785158347044,0.007222232183553756
+bandit_all_rules,line_text,false_new_same_path,1200,174783,0.0068656562709187964,0.004397939597249003,0.010852324074835704,0.005554351646014883
+bandit_all_rules,line_text,false_new_renamed,70,70,1.0,1.0,1.0,1.0
+bandit_all_rules,line_text,hidden,506,13024,0.03885135135135135,0.025534185737443284,0.06482081452222961,0.04365706369991991
+bandit_all_rules,line_text,mispair,2709,174853,0.01549301413187077,0.008813256762321737,0.024165530333210204,0.004490497849850129
+bandit_all_rules,line_text,collision,149946,252744,0.5932722438514861,0.491162665641819,0.6411771806268207,0.46716195859591253
+bandit_all_rules,github,false_new,3165,174853,0.018100919057722775,0.009931730494423266,0.030699928086305703,0.013456727610650792
+bandit_all_rules,github,false_new_same_path,3095,174783,0.017707671798744728,0.009744141364445728,0.030278909693681102,0.012920707234723123
+bandit_all_rules,github,false_new_renamed,70,70,1.0,1.0,1.0,1.0
+bandit_all_rules,github,hidden,108,13024,0.008292383292383292,0.005761116191217989,0.013391507317203037,0.0049345680622581625
+bandit_all_rules,github,mispair,272,174853,0.0015555924119117202,0.00046490395337545233,0.0032673909363624696,8.826644698128751e-05
+bandit_all_rules,github,collision,117,252744,0.0004629190010445352,0.00027295279392511524,0.0009201032340911476,0.00018905418849612422
+bandit_all_rules,codeguard,false_new,944,174853,0.005398820723693617,0.0028121589661579895,0.009448434766099804,0.002199625654414101
+bandit_all_rules,codeguard,false_new_same_path,874,174783,0.00500048631731919,0.002557011344560956,0.008991910229681647,0.0021003901413532457
+bandit_all_rules,codeguard,false_new_renamed,70,70,1.0,1.0,1.0,1.0
+bandit_all_rules,codeguard,hidden,90,13024,0.00691031941031941,0.0041471682061604825,0.01275671953810376,0.003417061972213303
+bandit_all_rules,codeguard,mispair,63,174853,0.0003603026542295528,0.00020361820496298728,0.0006163465585609357,0.0
+bandit_all_rules,codeguard,collision,51411,252744,0.20341135694615897,0.1420038404794161,0.2655710752657374,0.2367170561406819
+bandit_all_rules,sonar,false_new,570,174853,0.003259881157315002,0.0013789325609642503,0.006679854612409861,0.0012767619292765665
+bandit_all_rules,sonar,false_new_same_path,570,174783,0.003261186728686428,0.0013790003172387277,0.006681063329364826,0.0012795360338772833
+bandit_all_rules,sonar,false_new_renamed,0,70,0.0,0.0,0.0,0.0
+bandit_all_rules,sonar,hidden,185,13024,0.014204545454545454,0.007456602150725001,0.029426470380437136,0.006119840289547008
+bandit_all_rules,sonar,mispair,1284,174853,0.007343311238583267,0.005416439861715222,0.008911701932242985,0.005781645016453781
+bandit_all_rules,sonar,collision,153531,252744,0.6074565568322097,0.5122909745143007,0.6526140704889047,0.5086412264002841
+bandit_all_rules,sonar_branch,false_new,570,174853,0.003259881157315002,0.0013789325609642503,0.006679854612409861,0.0012767619292765665
+bandit_all_rules,sonar_branch,false_new_same_path,570,174783,0.003261186728686428,0.0013790003172387277,0.006681063329364826,0.0012795360338772833
+bandit_all_rules,sonar_branch,false_new_renamed,0,70,0.0,0.0,0.0,0.0
+bandit_all_rules,sonar_branch,hidden,185,13024,0.014204545454545454,0.007456602150725001,0.029426470380437136,0.006119840289547008
+bandit_all_rules,sonar_branch,mispair,1284,174853,0.007343311238583267,0.005416439861715222,0.008911701932242985,0.005781645016453781
+bandit_all_rules,sonar_branch,collision,153531,252744,0.6074565568322097,0.5122909745143007,0.6526140704889047,0.5086412264002841
+bandit_all_rules,bandit,false_new,75,174853,0.0004289317312256581,3.024026552716357e-05,0.0014423667615447878,0.0
+bandit_all_rules,bandit,false_new_same_path,5,174783,2.860690112882832e-05,0.0,8.345442641835046e-05,0.0
+bandit_all_rules,bandit,false_new_renamed,70,70,1.0,1.0,1.0,1.0
+bandit_all_rules,bandit,hidden,6670,13024,0.5121314496314496,0.4246053704806639,0.6518475453002107,0.5395814802677777
+bandit_all_rules,bandit,mispair,41064,174853,0.23484870148067233,0.18832462032764707,0.2886678478274734,0.11731823813095377
+bandit_all_rules,bandit,collision,246840,252744,0.9766403950242142,0.9498377207172566,0.9865686584683001,0.9278630762478302
diff --git a/research/finding_identity/paper/rq2.csv b/research/finding_identity/paper/rq2.csv
new file mode 100644
index 0000000..5d198cd
--- /dev/null
+++ b/research/finding_identity/paper/rq2.csv
@@ -0,0 +1,141 @@
+transform,scheme,metric,num,den,rate,ci_lo,ci_hi
+reformat,line,false_new,781,909,0.8591859185918592,0.8216943199723665,0.8921682308927248
+reformat,line,hidden,0,4,0.0,0.0,0.0
+reformat,line_text,false_new,198,909,0.21782178217821782,0.1457283637318964,0.30582262949039263
+reformat,line_text,hidden,0,4,0.0,0.0,0.0
+reformat,github,false_new,276,909,0.30363036303630364,0.2220942937233526,0.3933167972522196
+reformat,github,hidden,0,4,0.0,0.0,0.0
+reformat,codeguard,false_new,152,909,0.16721672167216722,0.10789630090078302,0.24494605253367063
+reformat,codeguard,hidden,0,4,0.0,0.0,0.0
+reformat,sonar,false_new,160,909,0.17601760176017603,0.11452056680802018,0.25446487498114345
+reformat,sonar,hidden,0,4,0.0,0.0,0.0
+reformat,sonar_branch,false_new,160,909,0.17601760176017603,0.11452056680802018,0.25446487498114345
+reformat,sonar_branch,hidden,0,4,0.0,0.0,0.0
+reformat,bandit,false_new,18,909,0.019801980198019802,0.011682242990654205,0.028402366863905324
+reformat,bandit,hidden,4,4,1.0,1.0,1.0
+insert_top,line,false_new,929,937,0.991462113127001,0.9846482793522268,0.9969761856132915
+insert_top,line,hidden,0,0,,,
+insert_top,line_text,false_new,0,937,0.0,0.0,0.0
+insert_top,line_text,hidden,0,0,,,
+insert_top,github,false_new,0,937,0.0,0.0,0.0
+insert_top,github,hidden,0,0,,,
+insert_top,codeguard,false_new,0,937,0.0,0.0,0.0
+insert_top,codeguard,hidden,0,0,,,
+insert_top,sonar,false_new,0,937,0.0,0.0,0.0
+insert_top,sonar,hidden,0,0,,,
+insert_top,sonar_branch,false_new,0,937,0.0,0.0,0.0
+insert_top,sonar_branch,hidden,0,0,,,
+insert_top,bandit,false_new,23,937,0.02454642475987193,0.015431334800146686,0.03433559662362132
+insert_top,bandit,hidden,0,0,,,
+insert_below,line,false_new,0,937,0.0,0.0,0.0
+insert_below,line,hidden,0,0,,,
+insert_below,line_text,false_new,0,937,0.0,0.0,0.0
+insert_below,line_text,hidden,0,0,,,
+insert_below,github,false_new,726,937,0.7748132337246532,0.7071032681348062,0.8336935439843305
+insert_below,github,hidden,0,0,,,
+insert_below,codeguard,false_new,0,937,0.0,0.0,0.0
+insert_below,codeguard,hidden,0,0,,,
+insert_below,sonar,false_new,0,937,0.0,0.0,0.0
+insert_below,sonar,hidden,0,0,,,
+insert_below,sonar_branch,false_new,0,937,0.0,0.0,0.0
+insert_below,sonar_branch,hidden,0,0,,,
+insert_below,bandit,false_new,0,937,0.0,0.0,0.0
+insert_below,bandit,hidden,0,0,,,
+rename_local,line,false_new,0,285,0.0,0.0,0.0
+rename_local,line,hidden,0,0,,,
+rename_local,line_text,false_new,285,285,1.0,1.0,1.0
+rename_local,line_text,hidden,0,0,,,
+rename_local,github,false_new,285,285,1.0,1.0,1.0
+rename_local,github,hidden,0,0,,,
+rename_local,codeguard,false_new,279,285,0.9789473684210527,0.9635627530364372,0.992727931488801
+rename_local,codeguard,hidden,0,0,,,
+rename_local,sonar,false_new,28,285,0.09824561403508772,0.06,0.13564837764758897
+rename_local,sonar,hidden,0,0,,,
+rename_local,sonar_branch,false_new,28,285,0.09824561403508772,0.06,0.13564837764758897
+rename_local,sonar_branch,hidden,0,0,,,
+rename_local,bandit,false_new,28,285,0.09824561403508772,0.06,0.13564837764758897
+rename_local,bandit,hidden,0,0,,,
+rename_function,line,false_new,0,822,0.0,0.0,0.0
+rename_function,line,hidden,0,0,,,
+rename_function,line_text,false_new,489,822,0.5948905109489051,0.5061411762358988,0.6744803871110191
+rename_function,line_text,hidden,0,0,,,
+rename_function,github,false_new,489,822,0.5948905109489051,0.5062770177208976,0.6734190131748903
+rename_function,github,hidden,0,0,,,
+rename_function,codeguard,false_new,822,822,1.0,1.0,1.0
+rename_function,codeguard,hidden,0,0,,,
+rename_function,sonar,false_new,485,822,0.5900243309002433,0.5006104264305965,0.670813582870219
+rename_function,sonar,hidden,0,0,,,
+rename_function,sonar_branch,false_new,485,822,0.5900243309002433,0.5006104264305965,0.670813582870219
+rename_function,sonar_branch,hidden,0,0,,,
+rename_function,bandit,false_new,485,822,0.5900243309002433,0.5006104264305965,0.670813582870219
+rename_function,bandit,hidden,0,0,,,
+move_function,line,false_new,786,817,0.9620563035495716,0.9489932885906041,0.9748808963233109
+move_function,line,hidden,0,0,,,
+move_function,line_text,false_new,0,817,0.0,0.0,0.0
+move_function,line_text,hidden,0,0,,,
+move_function,github,false_new,62,817,0.07588739290085679,0.04964416304694595,0.1046998617090264
+move_function,github,hidden,0,0,,,
+move_function,codeguard,false_new,0,817,0.0,0.0,0.0
+move_function,codeguard,hidden,0,0,,,
+move_function,sonar,false_new,0,817,0.0,0.0,0.0
+move_function,sonar,hidden,0,0,,,
+move_function,sonar_branch,false_new,0,817,0.0,0.0,0.0
+move_function,sonar_branch,hidden,0,0,,,
+move_function,bandit,false_new,17,817,0.0208078335373317,0.012179897519789233,0.03
+move_function,bandit,hidden,0,0,,,
+change_literal,line,false_new,0,259,0.0,0.0,0.0
+change_literal,line,hidden,0,0,,,
+change_literal,line_text,false_new,259,259,1.0,1.0,1.0
+change_literal,line_text,hidden,0,0,,,
+change_literal,github,false_new,258,259,0.9961389961389961,0.9878542510121457,1.0
+change_literal,github,hidden,0,0,,,
+change_literal,codeguard,false_new,0,259,0.0,0.0,0.0
+change_literal,codeguard,hidden,0,0,,,
+change_literal,sonar,false_new,0,259,0.0,0.0,0.0
+change_literal,sonar,hidden,0,0,,,
+change_literal,sonar_branch,false_new,0,259,0.0,0.0,0.0
+change_literal,sonar_branch,hidden,0,0,,,
+change_literal,bandit,false_new,0,259,0.0,0.0,0.0
+change_literal,bandit,hidden,0,0,,,
+extract_helper,line,false_new,146,150,0.9733333333333334,0.9461538461538461,0.9935897435897436
+extract_helper,line,hidden,2,33,0.06060606060606061,0.0,0.17647058823529413
+extract_helper,line_text,false_new,116,150,0.7733333333333333,0.704225352112676,0.8425969601677148
+extract_helper,line_text,hidden,0,33,0.0,0.0,0.0
+extract_helper,github,false_new,132,150,0.88,0.8110570419790449,0.9448289437958186
+extract_helper,github,hidden,0,33,0.0,0.0,0.0
+extract_helper,codeguard,false_new,150,150,1.0,1.0,1.0
+extract_helper,codeguard,hidden,0,33,0.0,0.0,0.0
+extract_helper,sonar,false_new,0,150,0.0,0.0,0.0
+extract_helper,sonar,hidden,0,33,0.0,0.0,0.0
+extract_helper,sonar_branch,false_new,0,150,0.0,0.0,0.0
+extract_helper,sonar_branch,hidden,0,33,0.0,0.0,0.0
+extract_helper,bandit,false_new,6,150,0.04,0.010638297872340425,0.08461864406779657
+extract_helper,bandit,hidden,32,33,0.9696969696969697,0.8918918918918919,1.0
+duplicate_above,line,false_new,251,257,0.9766536964980544,0.9576923076923077,0.9927536231884058
+duplicate_above,line,hidden,261,261,1.0,1.0,1.0
+duplicate_above,line_text,false_new,244,257,0.9494163424124513,0.9190279836916234,0.9766536964980544
+duplicate_above,line_text,hidden,261,261,1.0,1.0,1.0
+duplicate_above,github,false_new,30,257,0.11673151750972763,0.06692913385826772,0.17006802721088435
+duplicate_above,github,hidden,30,261,0.11494252873563218,0.06611116156570707,0.16666666666666666
+duplicate_above,codeguard,false_new,250,257,0.9727626459143969,0.9467199453551912,0.9931277361954526
+duplicate_above,codeguard,hidden,261,261,1.0,1.0,1.0
+duplicate_above,sonar,false_new,256,257,0.9961089494163424,0.988,1.0
+duplicate_above,sonar,hidden,261,261,1.0,1.0,1.0
+duplicate_above,sonar_branch,false_new,256,257,0.9961089494163424,0.988,1.0
+duplicate_above,sonar_branch,hidden,261,261,1.0,1.0,1.0
+duplicate_above,bandit,false_new,7,257,0.027237354085603113,0.010675210115847666,0.049773755656108594
+duplicate_above,bandit,hidden,261,261,1.0,1.0,1.0
+duplicate_below,line,false_new,0,257,0.0,0.0,0.0
+duplicate_below,line,hidden,6,261,0.022988505747126436,0.0071174377224199285,0.04182509505703422
+duplicate_below,line_text,false_new,0,257,0.0,0.0,0.0
+duplicate_below,line_text,hidden,14,261,0.05363984674329502,0.024489795918367346,0.0860655737704918
+duplicate_below,github,false_new,227,257,0.8832684824902723,0.8299319727891157,0.9330708661417323
+duplicate_below,github,hidden,231,261,0.8850574712643678,0.8333333333333334,0.9338888384342929
+duplicate_below,codeguard,false_new,0,257,0.0,0.0,0.0
+duplicate_below,codeguard,hidden,7,261,0.02681992337164751,0.006711409395973154,0.05263157894736842
+duplicate_below,sonar,false_new,0,257,0.0,0.0,0.0
+duplicate_below,sonar,hidden,1,261,0.0038314176245210726,0.0,0.011811023622047244
+duplicate_below,sonar_branch,false_new,0,257,0.0,0.0,0.0
+duplicate_below,sonar_branch,hidden,1,261,0.0038314176245210726,0.0,0.011811023622047244
+duplicate_below,bandit,false_new,0,257,0.0,0.0,0.0
+duplicate_below,bandit,hidden,254,261,0.9731800766283525,0.9512195121951219,0.9894736842105263
diff --git a/research/finding_identity/paper/table_rq1.tex b/research/finding_identity/paper/table_rq1.tex
new file mode 100644
index 0000000..7dbe358
--- /dev/null
+++ b/research/finding_identity/paper/table_rq1.tex
@@ -0,0 +1,23 @@
+% Generated by research/finding_identity/paper_kit.py; do not edit by hand.
+\begin{table*}[t]
+\centering
+\caption{Identity errors over 200 consecutive commit pairs per repository, in percent: pooled rate with its 95\% cluster-bootstrap interval over repositories. CodeGuard findings: 35 repositories, 23,237 persisting and 1,974 introduced findings, 287 of the persisting ones in renamed files. Bandit findings other than B101: 25 Python repositories, 15,718 persisting and 1,097 introduced findings.}
+\label{tab:rq1}
+\begin{tabular}{lrrrrrrr}
+\toprule
+ & \multicolumn{5}{c}{CodeGuard findings} & \multicolumn{2}{c}{Bandit findings} \\
+\cmidrule(lr){2-6} \cmidrule(lr){7-8}
+ & \multicolumn{3}{c}{False new} & Hidden & Collisions & False new & Hidden \\
+\cmidrule(lr){2-4}
+Scheme & all & same path & renamed \\
+\midrule
+\texttt{line} & 52.6 {\scriptsize(48.5--57.6)} & 52.0 {\scriptsize(48.1--56.8)} & 100.0 {\scriptsize(100.0--100.0)} & 1.2 {\scriptsize(0.6--2.2)} & 2.1 {\scriptsize(1.1--3.5)} & 55.0 {\scriptsize(49.6--61.6)} & 1.9 {\scriptsize(0.4--4.0)} \\
+\texttt{line\_text} & 1.9 {\scriptsize(0.8--3.5)} & 0.7 {\scriptsize(0.5--0.9)} & 100.0 {\scriptsize(100.0--100.0)} & 1.2 {\scriptsize(0.5--2.2)} & 17.4 {\scriptsize(14.0--21.3)} & 0.8 {\scriptsize(0.5--1.1)} & 6.0 {\scriptsize(2.6--10.0)} \\
+\texttt{github} & 3.1 {\scriptsize(2.0--4.9)} & 1.9 {\scriptsize(1.6--2.3)} & 100.0 {\scriptsize(100.0--100.0)} & 0.8 {\scriptsize(0.2--1.9)} & 2.1 {\scriptsize(1.1--3.5)} & 1.9 {\scriptsize(1.1--3.1)} & 3.3 {\scriptsize(1.2--5.9)} \\
+\texttt{codeguard} & 1.8 {\scriptsize(0.7--3.4)} & 0.6 {\scriptsize(0.4--0.8)} & 100.0 {\scriptsize(100.0--100.0)} & 1.9 {\scriptsize(0.9--3.5)} & 18.6 {\scriptsize(12.9--24.8)} & 0.4 {\scriptsize(0.2--0.7)} & 2.5 {\scriptsize(1.1--4.2)} \\
+\texttt{sonar} & 0.4 {\scriptsize(0.3--0.6)} & 0.4 {\scriptsize(0.2--0.5)} & 2.8 {\scriptsize(1.7--8.3)} & 1.5 {\scriptsize(0.8--2.4)} & 20.3 {\scriptsize(16.5--24.4)} & 0.3 {\scriptsize(0.1--0.5)} & 4.5 {\scriptsize(1.6--8.4)} \\
+\texttt{sonar\_branch} & 0.6 {\scriptsize(0.3--1.0)} & 0.4 {\scriptsize(0.2--0.5)} & 20.2 {\scriptsize(4.3--62.3)} & 1.4 {\scriptsize(0.8--2.3)} & 20.3 {\scriptsize(16.5--24.4)} & 0.3 {\scriptsize(0.1--0.5)} & 4.5 {\scriptsize(1.6--8.4)} \\
+\texttt{bandit} & 4.4 {\scriptsize(3.1--6.3)} & 3.2 {\scriptsize(2.5--4.1)} & 100.0 {\scriptsize(100.0--100.0)} & 20.0 {\scriptsize(14.1--28.6)} & 54.2 {\scriptsize(44.4--62.5)} & 0.1 {\scriptsize(0.0--0.1)} & 29.2 {\scriptsize(20.1--40.9)} \\
+\bottomrule
+\end{tabular}
+\end{table*}
diff --git a/research/finding_identity/paper/tables.md b/research/finding_identity/paper/tables.md
index 5b57494..b2e9190 100644
--- a/research/finding_identity/paper/tables.md
+++ b/research/finding_identity/paper/tables.md
@@ -11,6 +11,9 @@
 | `cg_no_scope` | 1.82 | [1.66, 2.00] | [0.75, 3.40] | 1.72 [0.78, 3.07] | 0.49 [0.20, 1.35] |
 | `cg_no_mask` | 1.82 | [1.66, 2.00] | [0.74, 3.42] | 1.75 [0.81, 3.10] | 0.52 [0.20, 1.56] |
 | `cg_raw` | 1.91 | [1.74, 2.09] | [0.81, 3.52] | 1.88 [0.93, 3.23] | 0.57 [0.29, 1.77] |
+| `sonar` | 0.39 | [0.32, 0.48] | [0.26, 0.57] | 0.48 [0.29, 0.69] | 0.22 [0.00, 0.69] |
+| `sonar_branch` | 0.61 | [0.51, 0.72] | [0.33, 1.02] | 0.60 [0.36, 0.88] | 0.25 [0.00, 0.84] |
+| `bandit` | 4.39 | [4.13, 4.66] | [3.06, 6.34] | 4.96 [3.67, 6.57] | 3.92 [2.38, 5.78] |
 
 | scheme | false-new, moved | false-new, edited | hidden | mispair | collision |
 |---|---|---|---|---|---|
@@ -21,6 +24,9 @@
 | `cg_no_scope` | 1.37 [0.33, 2.89] | 74.65 [65.10, 83.33] | 2.48 [1.47, 3.98] | 0.41 [0.16, 0.76] | 23.64 [18.96, 28.98] |
 | `cg_no_mask` | 1.32 [0.27, 2.86] | 83.80 [74.66, 92.42] | 1.62 [0.64, 3.30] | 0.24 [0.05, 0.51] | 15.59 [10.91, 20.58] |
 | `cg_raw` | 1.30 [0.26, 2.84] | 100.00 [100.00, 100.00] | 1.01 [0.40, 1.97] | 0.14 [0.02, 0.32] | 13.10 [8.93, 17.66] |
+| `sonar` | 0.00 [0.00, 0.01] | 63.38 [51.49, 73.71] | 1.47 [0.84, 2.37] | 0.17 [0.06, 0.33] | 20.28 [16.49, 24.37] |
+| `sonar_branch` | 0.22 [0.01, 0.62] | 63.38 [51.49, 73.71] | 1.42 [0.82, 2.32] | 0.17 [0.06, 0.33] | 20.28 [16.49, 24.37] |
+| `bandit` | 4.26 [2.95, 6.20] | 23.94 [14.85, 34.82] | 19.96 [14.09, 28.62] | 3.68 [2.05, 5.61] | 54.16 [44.38, 62.53] |
 
 ### Security findings
 
@@ -35,6 +41,9 @@
 | `cg_no_scope` | 1.97 | [1.64, 2.36] | [0.58, 4.25] | 1.42 [0.56, 2.71] | 0.00 [0.00, 1.33] |
 | `cg_no_mask` | 1.90 | [1.58, 2.28] | [0.44, 4.29] | 1.48 [0.55, 2.79] | 0.00 [0.00, 1.13] |
 | `cg_raw` | 1.92 | [1.59, 2.30] | [0.49, 4.30] | 1.61 [0.67, 2.94] | 0.18 [0.00, 1.21] |
+| `sonar` | 0.26 | [0.16, 0.43] | [0.13, 0.47] | 0.31 [0.13, 0.53] | 0.00 [0.00, 0.31] |
+| `sonar_branch` | 0.28 | [0.17, 0.45] | [0.14, 0.52] | 0.32 [0.13, 0.55] | 0.00 [0.00, 0.31] |
+| `bandit` | 2.81 | [2.42, 3.27] | [1.24, 5.73] | 7.58 [3.08, 14.18] | 2.05 [0.00, 6.78] |
 
 | scheme | false-new, moved | false-new, edited | hidden | mispair | collision |
 |---|---|---|---|---|---|
@@ -45,5 +54,8 @@
 | `cg_no_scope` | 1.70 [0.37, 3.84] | 64.00 [44.44, 80.95] | 4.78 [1.48, 8.93] | 1.28 [0.30, 2.78] | 41.81 [28.43, 57.66] |
 | `cg_no_mask` | 1.56 [0.18, 3.81] | 80.00 [60.71, 95.83] | 2.78 [0.16, 7.31] | 0.76 [0.00, 1.92] | 22.45 [10.00, 38.44] |
 | `cg_raw` | 1.49 [0.16, 3.67] | 100.00 [100.00, 100.00] | 1.70 [0.16, 4.28] | 0.52 [0.00, 1.33] | 20.18 [8.65, 35.04] |
+| `sonar` | 0.02 [0.00, 0.06] | 56.00 [33.33, 76.92] | 1.23 [0.16, 2.99] | 0.35 [0.10, 0.72] | 33.86 [23.87, 46.80] |
+| `sonar_branch` | 0.03 [0.00, 0.10] | 56.00 [33.33, 76.92] | 1.23 [0.16, 2.99] | 0.35 [0.10, 0.72] | 33.86 [23.87, 46.80] |
+| `bandit` | 2.76 [1.20, 5.65] | 16.00 [0.00, 36.00] | 19.75 [13.17, 29.28] | 2.30 [0.83, 4.50] | 53.33 [36.94, 71.08] |
 
 Pooled = total numerator over total denominator. Brackets after a pooled rate are the cluster bootstrap 95% CI over repositories; macro = mean of per-repository rates; IQR over per-repository rates.
diff --git a/research/finding_identity/paper_kit.py b/research/finding_identity/paper_kit.py
new file mode 100644
index 0000000..ddc21c1
--- /dev/null
+++ b/research/finding_identity/paper_kit.py
@@ -0,0 +1,539 @@
+# SPDX-License-Identifier: Apache-2.0
+
+"""Tables, figures and numbers for the paper: RQ1 from corpus replays, RQ2 from the
+transformation experiment.
+
+``python -m research.finding_identity.paper_kit --codeguard <results> --bandit <results>
+--transform <results>`` reads one batch of replays per analyzer, and the
+``transform-<label>`` directories of the experiment, and writes to ``--out``:
+
+- ``rq1.csv``: per analyzer, scheme and metric, the pooled rate with its cluster
+  bootstrap 95% CI over repositories, and the per-repository median;
+- ``table_rq1.tex``: Table II of the paper (LaTeX, ``booktabs``);
+- ``numbers.md``: every number the RQ1 section cites, with its source;
+- ``rq2.csv`` and ``fig_rq2.pdf``: the invariance matrix pooled over repositories, with
+  cluster-bootstrap intervals, and Fig. 1 of the paper (needs matplotlib).
+
+Besides the metrics of :mod:`stats`, the false-new rate is split by whether the file was
+renamed in the commit, from each replay's ``findings.jsonl`` (``--details``). Every
+estimate of one analyzer uses the same bootstrap draws, so their intervals are paired.
+"""
+
+from __future__ import annotations
+
+import argparse
+import csv
+import json
+import sys
+from collections.abc import Sequence
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+from .corpus import load_corpus
+from .stats import bootstrap_draws, cluster_bootstrap, counts, load_summaries, quantile
+
+HERE = Path(__file__).parent
+
+#: Schemes in the paper's table, from the naive baseline to the shipped tools.
+TABLE_SCHEMES = ("line", "line_text", "github", "codeguard", "sonar", "sonar_branch", "bandit")
+ANALYZER_NAMES = {
+    "codeguard": "CodeGuard",
+    "bandit": "Bandit",
+    "bandit_all_rules": "Bandit (all rules)",
+    "semgrep": "Semgrep",
+}
+#: Metrics computed for every scheme: (name, description).
+METRICS = (
+    ("false_new", "persisting findings reported as new"),
+    ("false_new_same_path", "of those in files that kept their path"),
+    ("false_new_renamed", "of those in renamed files"),
+    ("hidden", "introduced findings matched to an old one"),
+    ("mispair", "persisting findings matched to the wrong old one"),
+    ("collision", "findings sharing a key with another in the same file version"),
+)
+
+
+@dataclass(frozen=True)
+class Run:
+    """One repository's replay: its summary and its per-finding records."""
+
+    label: str
+    summary: dict[str, Any]
+    findings: Path
+    #: Rules left out. The metrics are then counted from ``findings.jsonl``, which does
+    #: not hold what collisions need, so the collision rate is not computed.
+    exclude: frozenset[str] = frozenset()
+
+
+@dataclass(frozen=True)
+class Estimate:
+    num: int
+    den: int
+    rate: float | None
+    ci: tuple[float, float] | None
+    median: float | None
+
+
+def load_runs(
+    results: Path, labels: Sequence[str] | None, exclude: frozenset[str] = frozenset()
+) -> list[Run]:
+    runs = []
+    for summary in load_summaries([results], labels):
+        label = summary["label"]
+        findings = results / label / "findings.jsonl"
+        if not findings.exists():
+            raise SystemExit(f"{findings} is missing: replay with --details")
+        runs.append(Run(label, summary, findings, exclude))
+    return runs
+
+
+def _rename_split(run: Run, scheme: str) -> dict[str, tuple[int, int]]:
+    """``(false_new, known)`` among persisting findings, by whether the file was renamed."""
+    split = {"false_new_same_path": [0, 0], "false_new_renamed": [0, 0]}
+    with run.findings.open(encoding="utf-8") as f:
+        for line in f:
+            rec = json.loads(line)
+            if rec["truth"] != "known" or rec["rule"] in run.exclude:
+                continue
+            renamed = str(rec.get("status", "")).startswith("R")
+            cell = split["false_new_renamed" if renamed else "false_new_same_path"]
+            cell[0] += rec["outcomes"][scheme] == "false_new"
+            cell[1] += 1
+    return {k: (v[0], v[1]) for k, v in split.items()}
+
+
+def _record_counts(run: Run, scheme: str) -> dict[str, tuple[int, int]]:
+    """False-new, hidden and mispair counts from ``findings.jsonl``, without excluded rules."""
+    c = {"false_new": [0, 0], "hidden": [0, 0], "mispair": [0, 0]}
+    with run.findings.open(encoding="utf-8") as f:
+        for line in f:
+            rec = json.loads(line)
+            if rec["rule"] in run.exclude:
+                continue
+            outcome = rec["outcomes"][scheme]
+            if rec["truth"] == "known":
+                for name, hit in (("false_new", "false_new"), ("mispair", "mispaired")):
+                    c[name][0] += outcome == hit
+                    c[name][1] += 1
+            else:
+                c["hidden"][0] += outcome == "false_known"
+                c["hidden"][1] += 1
+    return {k: (v[0], v[1]) for k, v in c.items()}
+
+
+def repo_counts(runs: Sequence[Run], scheme: str) -> dict[str, list[tuple[int, int]]]:
+    """Per metric, one ``(numerator, denominator)`` per repository, in *runs* order."""
+    out: dict[str, list[tuple[int, int]]] = {name: [] for name, _ in METRICS}
+    for run in runs:
+        if run.exclude:
+            for name, pair in _record_counts(run, scheme).items():
+                out[name].append(pair)
+            out["collision"].append((0, 0))
+        else:
+            for name in ("false_new", "hidden", "mispair", "collision"):
+                out[name].append(counts(run.summary, scheme, name))
+        for name, pair in _rename_split(run, scheme).items():
+            out[name].append(pair)
+    return out
+
+
+def estimate(pairs: Sequence[tuple[int, int]], draws: Sequence[Sequence[int]]) -> Estimate:
+    num = sum(n for n, _ in pairs)
+    den = sum(d for _, d in pairs)
+    rates = [n / d for n, d in pairs if d]
+    return Estimate(
+        num,
+        den,
+        num / den if den else None,
+        cluster_bootstrap(pairs, draws)["pooled"],
+        quantile(rates, 0.5) if rates else None,
+    )
+
+
+def estimates(
+    runs: Sequence[Run], schemes: Sequence[str], resamples: int, seed: int
+) -> dict[tuple[str, str], Estimate]:
+    """``{(scheme, metric): estimate}`` over *runs*."""
+    draws = bootstrap_draws(len(runs), resamples, seed)
+    out = {}
+    for scheme in schemes:
+        for metric, pairs in repo_counts(runs, scheme).items():
+            out[(scheme, metric)] = estimate(pairs, draws)
+    return out
+
+
+# ---------------------------------------------------------------------------
+# Outputs
+# ---------------------------------------------------------------------------
+
+
+def _pct(x: float | None, digits: int = 2) -> str:
+    return "n/a" if x is None else f"{100 * x:.{digits}f}"
+
+
+def write_csv(path: Path, results: dict[str, dict[tuple[str, str], Estimate]]) -> None:
+    with path.open("w", newline="", encoding="utf-8") as f:
+        w = csv.writer(f)
+        w.writerow(
+            ["findings", "scheme", "metric", "num", "den", "rate", "ci_lo", "ci_hi", "median"]
+        )
+        for analyzer, table in results.items():
+            for (scheme, metric), e in table.items():
+                lo, hi = e.ci if e.ci else (None, None)
+                w.writerow([analyzer, scheme, metric, e.num, e.den, e.rate, lo, hi, e.median])
+
+
+def _tex_cell(e: Estimate | None) -> str:
+    if e is None or e.rate is None:
+        return "--"
+    if e.ci is None:
+        return f"{100 * e.rate:.1f}"
+    lo, hi = e.ci
+    return f"{100 * e.rate:.1f} {{\\scriptsize({100 * lo:.1f}--{100 * hi:.1f})}}"
+
+
+def _tex_name(scheme: str) -> str:
+    return "\\texttt{" + scheme.replace("_", "\\_") + "}"
+
+
+def latex_table(
+    codeguard: dict[tuple[str, str], Estimate],
+    bandit: dict[tuple[str, str], Estimate] | None,
+    facts: dict[str, Any],
+) -> str:
+    cg_cols = ("false_new", "false_new_same_path", "false_new_renamed", "hidden", "collision")
+    bd_cols = ("false_new", "hidden")
+    n_cols = len(cg_cols) + (len(bd_cols) if bandit else 0)
+    cg = facts["codeguard"]
+    caption = (
+        "Identity errors over 200 consecutive commit pairs per repository, in percent: "
+        "pooled rate with its 95\\% cluster-bootstrap interval over repositories. "
+        f"CodeGuard findings: {cg['repos']} repositories, {cg['known']:,} persisting and "
+        f"{cg['introduced']:,} introduced findings, {cg['known_renamed']:,} of the "
+        "persisting ones in renamed files."
+    )
+    if bandit:
+        bd = facts["bandit"]
+        without = f" other than {', '.join(bd['excluded'])}" if bd["excluded"] else ""
+        caption += (
+            f" Bandit findings{without}: {bd['repos']} Python repositories, {bd['known']:,} "
+            f"persisting and {bd['introduced']:,} introduced findings."
+        )
+    lines = [
+        "% Generated by research/finding_identity/paper_kit.py; do not edit by hand.",
+        "\\begin{table*}[t]",
+        "\\centering",
+        f"\\caption{{{caption}}}",
+        "\\label{tab:rq1}",
+        "\\begin{tabular}{l" + "r" * n_cols + "}",
+        "\\toprule",
+    ]
+    head = f" & \\multicolumn{{{len(cg_cols)}}}{{c}}{{CodeGuard findings}}"
+    rule = f"\\cmidrule(lr){{2-{1 + len(cg_cols)}}}"
+    if bandit:
+        head += f" & \\multicolumn{{{len(bd_cols)}}}{{c}}{{Bandit findings}}"
+        rule += f" \\cmidrule(lr){{{2 + len(cg_cols)}-{1 + n_cols}}}"
+    lines += [head + " \\\\", rule]
+    sub = " & \\multicolumn{3}{c}{False new} & Hidden & Collisions"
+    if bandit:
+        sub += " & False new & Hidden"
+    lines += [sub + " \\\\", "\\cmidrule(lr){2-4}"]
+    sub2 = "Scheme & all & same path & renamed & & "
+    if bandit:
+        sub2 += " & & "
+    lines += [sub2.rstrip(" &") + " \\\\", "\\midrule"]
+    for scheme in TABLE_SCHEMES:
+        cells = [_tex_cell(codeguard.get((scheme, m))) for m in cg_cols]
+        if bandit:
+            cells += [_tex_cell(bandit.get((scheme, m))) for m in bd_cols]
+        lines.append(_tex_name(scheme) + " & " + " & ".join(cells) + " \\\\")
+    lines += ["\\bottomrule", "\\end{tabular}", "\\end{table*}", ""]
+    return "\n".join(lines)
+
+
+#: A path with one of these parts counts as test code in the rule breakdown.
+TEST_PATH_PARTS = ("test", "conftest")
+
+
+def rule_breakdown(runs: Sequence[Run], top: int = 5) -> list[dict[str, Any]]:
+    """The *top* rules by persisting findings: counts, and how many are in test code."""
+    rows: dict[str, dict[str, int]] = {}
+    for run in runs:
+        with run.findings.open(encoding="utf-8") as f:
+            for line in f:
+                rec = json.loads(line)
+                if rec["rule"] in run.exclude:
+                    continue
+                row = rows.setdefault(rec["rule"], {"known": 0, "introduced": 0, "in_tests": 0})
+                row["known" if rec["truth"] == "known" else "introduced"] += 1
+                row["in_tests"] += any(p in rec["path"].lower() for p in TEST_PATH_PARTS)
+    ranked = sorted(rows.items(), key=lambda kv: -kv[1]["known"])[:top]
+    return [{"rule": rule, **row} for rule, row in ranked]
+
+
+def facts_for(runs: Sequence[Run]) -> dict[str, Any]:
+    split = [_rename_split(r, "line") for r in runs]
+    if any(r.exclude for r in runs):
+        rc = [_record_counts(r, "line") for r in runs]
+        known = sum(c["false_new"][1] for c in rc)
+        introduced = sum(c["hidden"][1] for c in rc)
+    else:
+        known = sum(int(r.summary["totals"]["gt"]["known"]) for r in runs)
+        introduced = sum(int(r.summary["totals"]["gt"]["introduced"]) for r in runs)
+    return {
+        "repos": len(runs),
+        "commit_pairs": sum(int(r.summary["commit_pairs"]) for r in runs),
+        "known": known,
+        "introduced": introduced,
+        "excluded": sorted(set().union(*(r.exclude for r in runs))),
+        "known_renamed": sum(s["false_new_renamed"][1] for s in split),
+        "repos_with_renamed": sum(1 for s in split if s["false_new_renamed"][1]),
+        "rules": rule_breakdown(runs),
+    }
+
+
+def numbers_markdown(
+    results: dict[str, dict[tuple[str, str], Estimate]],
+    facts: dict[str, dict[str, Any]],
+    sources: dict[str, Path],
+) -> str:
+    out = [
+        "# RQ1 numbers",
+        "",
+        "Generated by `research/finding_identity/paper_kit.py`; do not edit by hand. Rates",
+        "in percent: pooled rate, 95% cluster-bootstrap interval over repositories, and",
+        "the median of the per-repository rates.",
+        "",
+    ]
+    for analyzer, table in results.items():
+        f = facts[analyzer]
+        out += [
+            f"## {ANALYZER_NAMES[analyzer]} findings",
+            "",
+            f"Source: `{sources[analyzer]}`"
+            + (f", without rules {', '.join(f['excluded'])}" if f["excluded"] else "")
+            + f". {f['repos']} repositories, "
+            f"{f['commit_pairs']:,} commit pairs, {f['known']:,} persisting and "
+            f"{f['introduced']:,} introduced findings; {f['known_renamed']:,} persisting "
+            f"findings in renamed files, in {f['repos_with_renamed']} "
+            + ("repository." if f["repos_with_renamed"] == 1 else "repositories."),
+            "",
+            "| scheme | metric | rate | 95% CI | median | n |",
+            "|---|---|---:|---|---:|---:|",
+        ]
+        for (scheme, metric), e in table.items():
+            ci = f"[{_pct(e.ci[0])}, {_pct(e.ci[1])}]" if e.ci else "n/a"
+            out.append(
+                f"| `{scheme}` | {metric} | {_pct(e.rate)} | {ci} | {_pct(e.median)} | "
+                f"{e.num:,}/{e.den:,} |"
+            )
+        out += [
+            "",
+            "Rules with the most persisting findings (share of all; findings in test code):",
+            "",
+            "| rule | persisting | introduced | in test code |",
+            "|---|---:|---:|---:|",
+        ]
+        for r in f["rules"]:
+            total = r["known"] + r["introduced"]
+            out.append(
+                f"| `{r['rule']}` | {r['known']:,} ({100 * r['known'] / f['known']:.1f}%) | "
+                f"{r['introduced']:,} ({100 * r['introduced'] / max(f['introduced'], 1):.1f}%) | "
+                f"{100 * r['in_tests'] / total:.0f}% |"
+            )
+        out.append("")
+    out += ["Metrics:", ""] + [f"- `{name}`: {desc}." for name, desc in METRICS]
+    return "\n".join(out) + "\n"
+
+
+# ---------------------------------------------------------------------------
+# RQ2: the invariance matrix
+# ---------------------------------------------------------------------------
+
+#: Transformations that introduce a finding: their row shows the hidden rate.
+DUPLICATES = ("duplicate_above", "duplicate_below")
+
+
+def load_matrices(results: Path, labels: Sequence[str]) -> dict[str, list[dict[str, str]]]:
+    """``{label: matrix.csv rows}`` for each ``transform-<label>`` under *results*."""
+    out = {}
+    for label in labels:
+        path = results / f"transform-{label}" / "matrix.csv"
+        if path.exists():
+            with path.open(newline="", encoding="utf-8") as f:
+                out[label] = list(csv.DictReader(f))
+    return out
+
+
+def rq2_estimates(
+    matrices: dict[str, list[dict[str, str]]],
+    schemes: Sequence[str],
+    resamples: int,
+    seed: int,
+) -> dict[tuple[str, str, str], Estimate]:
+    """``{(transform, scheme, metric): estimate}``, metric ``false_new`` or ``hidden``."""
+    labels = list(matrices)
+    draws = bootstrap_draws(len(labels), resamples, seed)
+    cells: dict[tuple[str, str, str], list[tuple[int, int]]] = {}
+    for i, label in enumerate(labels):
+        for row in matrices[label]:
+            if row["scheme"] not in schemes:
+                continue
+            for metric, num, den in (
+                ("false_new", "false_new", "target_known"),
+                ("hidden", "hidden", "introduced"),
+            ):
+                key = (row["transform"], row["scheme"], metric)
+                pairs = cells.setdefault(key, [(0, 0)] * len(labels))
+                pairs[i] = (int(row[num]), int(row[den]))
+    return {key: estimate(pairs, draws) for key, pairs in cells.items()}
+
+
+def write_rq2_csv(path: Path, table: dict[tuple[str, str, str], Estimate]) -> None:
+    with path.open("w", newline="", encoding="utf-8") as f:
+        w = csv.writer(f)
+        w.writerow(["transform", "scheme", "metric", "num", "den", "rate", "ci_lo", "ci_hi"])
+        for (transform, scheme, metric), e in table.items():
+            lo, hi = e.ci if e.ci else (None, None)
+            w.writerow([transform, scheme, metric, e.num, e.den, e.rate, lo, hi])
+
+
+#: Sequential blue ramp, light to dark (steps 100 to 700 of the reference palette).
+_RAMP = (
+    "#cde2fb", "#b7d3f6", "#9ec5f4", "#86b6ef", "#6da7ec", "#5598e7", "#3987e5",
+    "#2a78d6", "#256abf", "#1c5cab", "#184f95", "#104281", "#0d366b",
+)  # fmt: skip
+_INK = "#0b0b0b"
+_INK_SECONDARY = "#52514e"
+_EMPTY = "#f0efec"
+
+
+def heatmap(
+    table: dict[tuple[str, str, str], Estimate],
+    transforms: Sequence[str],
+    schemes: Sequence[str],
+    path: Path,
+) -> bool:
+    """Fig. 1: false-new rate per transformation and scheme, and the hidden rate for the
+    duplicating transformations, as one heatmap. False without matplotlib."""
+    try:
+        import matplotlib
+
+        matplotlib.use("Agg")
+        import matplotlib.pyplot as plt
+        from matplotlib.colors import BoundaryNorm, ListedColormap
+        from matplotlib.patches import Rectangle
+    except ImportError:
+        print("matplotlib is not installed; skipping fig_rq2.pdf", file=sys.stderr)
+        return False
+    matplotlib.rcParams.update({"pdf.fonttype": 42, "font.size": 7})
+    upper = [t for t in transforms if t not in DUPLICATES]
+    lower = [t for t in transforms if t in DUPLICATES]
+    cmap = ListedColormap(list(_RAMP))
+    norm = BoundaryNorm([i * 100 / len(_RAMP) for i in range(len(_RAMP) + 1)], len(_RAMP))
+    fig, axes = plt.subplots(
+        2,
+        1,
+        figsize=(3.5, 0.24 * (len(upper) + len(lower)) + 1.0),
+        gridspec_kw={"height_ratios": [len(upper), len(lower)], "hspace": 0.08},
+        sharex=True,
+    )
+    panels = ((axes[0], upper, "false_new"), (axes[1], lower, "hidden"))
+    for ax, rows, metric in panels:
+        for y, transform in enumerate(rows):
+            for x, scheme in enumerate(schemes):
+                e = table.get((transform, scheme, metric))
+                if e is None or e.rate is None:
+                    ax.add_patch(Rectangle((x - 0.5, y - 0.5), 1, 1, color=_EMPTY))
+                    ax.text(x, y, "n/a", ha="center", va="center", color=_INK_SECONDARY)
+                    continue
+                value = 100 * e.rate
+                colour = cmap(norm(min(value, 99.999)))
+                ax.add_patch(
+                    Rectangle((x - 0.5, y - 0.5), 1, 1, facecolor=colour, edgecolor="white", lw=1)
+                )
+                ink = "white" if value >= 50 else _INK
+                ax.text(x, y, f"{value:.0f}", ha="center", va="center", color=ink)
+        ax.set_xlim(-0.5, len(schemes) - 0.5)
+        ax.set_ylim(len(rows) - 0.5, -0.5)
+        ax.set_yticks(range(len(rows)), [t.replace("_", " ") for t in rows])
+        ax.tick_params(length=0, colors=_INK)
+        for spine in ax.spines.values():
+            spine.set_visible(False)
+        label = "false new (%)" if metric == "false_new" else "hidden (%)"
+        ax.set_ylabel(label, color=_INK_SECONDARY)
+    axes[0].xaxis.set_ticks_position("top")
+    axes[0].set_xticks(range(len(schemes)), schemes, rotation=35, ha="left")
+    axes[1].tick_params(labelbottom=False)
+    fig.savefig(path, bbox_inches="tight")
+    plt.close(fig)
+    return True
+
+
+def main(argv: list[str] | None = None) -> None:
+    ap = argparse.ArgumentParser(prog="python -m research.finding_identity.paper_kit")
+    ap.add_argument("--codeguard", type=Path, required=True, help="batch results, CodeGuard")
+    ap.add_argument("--bandit", type=Path, help="batch results, Bandit")
+    ap.add_argument(
+        "--bandit-exclude",
+        default="",
+        help="comma-separated Bandit rules to leave out of the table (all rules stay in "
+        "numbers.md as 'bandit_all_rules')",
+    )
+    ap.add_argument("--transform", type=Path, help="directory of transform-<label> results")
+    ap.add_argument("--corpus", type=Path, default=HERE / "corpus.csv")
+    ap.add_argument("--out", type=Path, default=HERE / "paper")
+    ap.add_argument("--resamples", type=int, default=10_000)
+    ap.add_argument("--seed", type=int, default=20261014)
+    args = ap.parse_args(argv)
+
+    labels = [e.label for e in load_corpus(args.corpus)]
+    sources = {"codeguard": args.codeguard}
+    if args.bandit:
+        sources["bandit"] = args.bandit
+    results: dict[str, dict[tuple[str, str], Estimate]] = {}
+    facts: dict[str, dict[str, Any]] = {}
+    exclude = frozenset(x.strip() for x in args.bandit_exclude.split(",") if x.strip())
+    jobs: list[tuple[str, Path, frozenset[str]]] = [("codeguard", args.codeguard, frozenset())]
+    if args.bandit:
+        jobs.append(("bandit", args.bandit, exclude))
+        if exclude:
+            jobs.append(("bandit_all_rules", args.bandit, frozenset()))
+            sources["bandit_all_rules"] = args.bandit
+    for analyzer, path, leave_out in jobs:
+        wanted = [x for x in labels if (path / x / "summary.json").exists()]
+        runs = load_runs(path, wanted, leave_out)
+        facts[analyzer] = facts_for(runs)
+        present = [s for s in TABLE_SCHEMES if all(s in r.summary["schemes"] for r in runs)]
+        results[analyzer] = estimates(runs, present, args.resamples, args.seed)
+
+    args.out.mkdir(parents=True, exist_ok=True)
+    write_csv(args.out / "rq1.csv", results)
+    (args.out / "table_rq1.tex").write_text(
+        latex_table(results["codeguard"], results.get("bandit"), facts), encoding="utf-8"
+    )
+    (args.out / "numbers.md").write_text(
+        numbers_markdown(results, facts, sources), encoding="utf-8"
+    )
+    written = ["rq1.csv", "table_rq1.tex", "numbers.md"]
+    if args.transform:
+        matrices = load_matrices(args.transform, labels)
+        if not matrices:
+            raise SystemExit(f"no transform-<label>/matrix.csv under {args.transform}")
+        from .transforms import DETERMINISTIC  # needs libcst, so only for RQ2
+
+        rq2 = rq2_estimates(matrices, TABLE_SCHEMES, args.resamples, args.seed)
+        write_rq2_csv(args.out / "rq2.csv", rq2)
+        written.append(f"rq2.csv ({len(matrices)} repositories)")
+        present = [t for t in DETERMINISTIC if any(k[0] == t for k in rq2)]
+        # No transformation renames a file, so the two SonarQube modes agree: one column.
+        columns = [s for s in TABLE_SCHEMES if s != "sonar_branch"]
+        if heatmap(rq2, present, columns, args.out / "fig_rq2.pdf"):
+            heatmap(rq2, present, columns, args.out / "fig_rq2.png")
+            written.append("fig_rq2.pdf")
+    print(f"wrote {', '.join(written)} to {args.out}")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/research/finding_identity/replay.py b/research/finding_identity/replay.py
index da8cbed..5651fe7 100644
--- a/research/finding_identity/replay.py
+++ b/research/finding_identity/replay.py
@@ -76,7 +76,10 @@ def _replay_change(
     if not old_obs and not new_obs:
         return
     line_map = map_lines(old_res.lines, new_res.lines) if old_res and new_res else {}
-    result = evaluate(old_obs, new_obs, line_map, schemes, keep_records=records is not None)
+    renamed = ch.status == "R"
+    result = evaluate(
+        old_obs, new_obs, line_map, schemes, keep_records=records is not None, renamed=renamed
+    )
     for k, v in result.gt.items():
         totals["gt"][k] += v
     for s, counts in result.by_scheme.items():
@@ -105,7 +108,11 @@ def _add_by_category(
     old_split, new_split = split_by_category(old_obs), split_by_category(new_obs)
     for category in sorted(old_split.keys() | new_split.keys()):
         result = evaluate(
-            old_split.get(category, []), new_split.get(category, []), line_map, schemes
+            old_split.get(category, []),
+            new_split.get(category, []),
+            line_map,
+            schemes,
+            renamed=status == "R",
         )
         totals = by_category.setdefault(category, _empty_totals(schemes))
         for k, v in result.gt.items():
diff --git a/research/finding_identity/schemes.py b/research/finding_identity/schemes.py
index 43543ce..170250b 100644
--- a/research/finding_identity/schemes.py
+++ b/research/finding_identity/schemes.py
@@ -39,7 +39,7 @@
 PRIMARY_SCHEMES = ("line", "line_text", "github", "codeguard")
 ABLATION_SCHEMES = ("cg_no_scope", "cg_no_mask", "cg_raw")
 #: Matching methods of shipped tools that apply to findings from any analyzer.
-TOOL_SCHEMES = ("sonar", "bandit")
+TOOL_SCHEMES = ("sonar", "sonar_branch", "bandit")
 #: Schemes every analyzer supports.
 ALL_SCHEMES = PRIMARY_SCHEMES + ABLATION_SCHEMES + TOOL_SCHEMES
 #: Needs Semgrep's rule formula and metavariable bindings, so Semgrep findings only.
@@ -336,7 +336,7 @@ def keys_for(
             out[name] = _sha(rule, ctx.path, scope, _strip_comments_and_space(raw))
         elif name == "cg_raw":
             out[name] = _sha(rule, ctx.path, scope, raw)
-        elif name == "sonar":
+        elif name in ("sonar", "sonar_branch"):
             # The weakest pass of SonarQube's tracker: same rule and line hash.
             out[name] = _sha(rule, ctx.path, sonar_line_hash(raw))
         elif name == "bandit":
diff --git a/research/finding_identity/tests/test_batch.py b/research/finding_identity/tests/test_batch.py
index 0f0b05a..923b355 100644
--- a/research/finding_identity/tests/test_batch.py
+++ b/research/finding_identity/tests/test_batch.py
@@ -54,6 +54,19 @@ def test_is_done_requires_matching_sha_and_enough_pairs(tmp_path: Path) -> None:
     assert not is_done(entry, opts)
 
 
+def test_is_done_requires_the_same_analyzer(tmp_path: Path) -> None:
+    entry = _entry("x", SHA_A)
+    codeguard = BatchOptions(commits=10, out=tmp_path, workdir=tmp_path / "repos")
+    bandit = BatchOptions(commits=10, out=tmp_path, workdir=tmp_path, analyzer="bandit")
+    _write_summary(codeguard, "x", SHA_A, 10)
+    # Replays from before analyzer.json was written all used CodeGuard.
+    assert is_done(entry, codeguard) and not is_done(entry, bandit)
+    (tmp_path / "x" / "analyzer.json").write_text(json.dumps({"analyzer": "bandit"}))
+    assert is_done(entry, bandit) and not is_done(entry, codeguard)
+    (tmp_path / "x" / "analyzer.json").write_text("{not json")
+    assert not is_done(entry, bandit) and not is_done(entry, codeguard)
+
+
 def test_resume_skips_done_and_survives_failures(tmp_path: Path) -> None:
     opts = BatchOptions(commits=10, out=tmp_path / "out", workdir=tmp_path / "repos")
     entries = [_entry("done", SHA_A), _entry("stale", SHA_A), _entry("new", SHA_A)]
@@ -145,6 +158,35 @@ def test_run_one_end_to_end(tmp_path: Path) -> None:
     assert run_batch([entry], opts)[0]["status"] == "skipped"
 
 
+def test_run_one_with_bandit(tmp_path: Path) -> None:
+    pytest.importorskip("bandit")
+    upstream = tmp_path / "upstream"
+    upstream.mkdir()
+    _git(upstream, "init", "-q")
+    versions = [
+        "import subprocess\n\n\ndef run(cmd):\n    subprocess.call(cmd, shell=True)\n",
+        "import os\nimport subprocess\n\n\ndef run(cmd):\n    subprocess.call(cmd, shell=True)\n",
+    ]
+    for i, text in enumerate(versions):
+        (upstream / "app.py").write_text(text)
+        _git(upstream, "add", "app.py")
+        _git(upstream, "commit", "-q", "-m", f"v{i}")
+    head = _git(upstream, "rev-parse", "HEAD").strip()
+
+    opts = BatchOptions(
+        commits=1, out=tmp_path / "out", workdir=tmp_path / "repos", analyzer="bandit"
+    )
+    entry = _entry("tiny", head, url=upstream.as_uri())
+    statuses = run_batch([entry], opts)
+    assert statuses[0]["status"] == "ok", (opts.out / "_logs" / "tiny.log").read_text()
+    analyzer = json.loads((opts.out / "tiny" / "analyzer.json").read_text())
+    assert analyzer["analyzer"] == "bandit"
+    summary = json.loads((opts.out / "tiny" / "summary.json").read_text())
+    assert summary["label"] == "tiny"  # no "-bandit" suffix: the batch names the run
+    assert summary["totals"]["gt"]["known"] >= 1
+    assert "sonar" in summary["totals"]["schemes"]
+
+
 # ---------------------------------------------------------------------------
 # Corpus helpers
 # ---------------------------------------------------------------------------
diff --git a/research/finding_identity/tests/test_drift.py b/research/finding_identity/tests/test_drift.py
index 3b56859..e580e68 100644
--- a/research/finding_identity/tests/test_drift.py
+++ b/research/finding_identity/tests/test_drift.py
@@ -141,6 +141,8 @@ def test_span_3_file_rename_breaks_every_path_based_key(summary: dict[str, Any])
     # keeps L; it still loses the edited E. Bandit compares the file name, so it loses L
     # but keeps E.
     assert _outcomes(entry, "sonar") == {"known_ok": 2, "false_new": 1}
+    # lib.py moved unchanged, so a branch analysis detects the move too.
+    assert _outcomes(entry, "sonar_branch") == {"known_ok": 2, "false_new": 1}
     assert _outcomes(entry, "bandit") == {"known_ok": 2, "false_new": 1}
     assert entry["totals"]["schemes"]["sonar"]["false_new_edited"] == 1
     assert entry["totals"]["schemes"]["bandit"]["false_new_edited"] == 0
diff --git a/research/finding_identity/tests/test_experiment.py b/research/finding_identity/tests/test_experiment.py
index fa09f23..1f872d1 100644
--- a/research/finding_identity/tests/test_experiment.py
+++ b/research/finding_identity/tests/test_experiment.py
@@ -116,6 +116,41 @@ def test_cli_subcommand(tmp_path: Path, capsys: pytest.CaptureFixture[str]) -> N
         main(["transform", str(tmp_path / "src"), "--transforms", "ai_refactor"])
 
 
+def test_cli_uses_a_commit_of_a_repository_without_checkout(tmp_path: Path) -> None:
+    import os
+    import subprocess
+
+    env = {**os.environ, "GIT_AUTHOR_NAME": "t", "GIT_AUTHOR_EMAIL": "t@example.com"}
+    env |= {"GIT_COMMITTER_NAME": "t", "GIT_COMMITTER_EMAIL": "t@example.com"}
+
+    def git(repo: Path, *args: str) -> str:
+        done = subprocess.run(
+            ["git", "-C", str(repo), *args], check=True, env=env, capture_output=True, text=True
+        )
+        return done.stdout.strip()
+
+    src = tmp_path / "src"
+    _fixture(src)
+    git(src, "init", "-q")
+    git(src, "add", ".")
+    git(src, "commit", "-qm", "pinned")
+    pinned = git(src, "rev-parse", "HEAD")
+    for f in src.rglob("*.py"):  # a later commit with no findings at all
+        f.write_text("x = 1\n")
+    git(src, "commit", "-qam", "later")
+    bare = tmp_path / "bare.git"  # like a corpus clone: history but no working tree
+    subprocess.run(["git", "clone", "-q", "--bare", str(src), str(bare)], check=True)
+
+    out = tmp_path / "out"
+    argv = ["transform", str(bare), "--ref", pinned, "--transforms", "insert_top"]
+    main([*argv, "--samples", "1", "--categories", "security", "--out", str(out)])
+    summary = json.loads((out / "summary.json").read_text())
+    assert summary["head"] == pinned
+    assert {row[0] for row in _rows(out)} == {"insert_top"}
+    cases = [json.loads(line) for line in (out / "cases.jsonl").read_text().splitlines()]
+    assert cases and all(not c["path"].startswith("/") for c in cases)
+
+
 def test_ground_truth_follows_the_finding_into_a_split_line() -> None:
     old = [Observation("R", 1, 1, {})]
     new = [Observation("R", 3, 5, {})]
diff --git a/research/finding_identity/tests/test_matching.py b/research/finding_identity/tests/test_matching.py
index 1efbefa..69e58ab 100644
--- a/research/finding_identity/tests/test_matching.py
+++ b/research/finding_identity/tests/test_matching.py
@@ -38,3 +38,79 @@ def test_line_scheme_hides_a_new_finding_and_loses_the_old_one() -> None:
     assert result.by_scheme["line"]["false_new"] == 1  # eval(x) reported as new
     assert result.by_scheme["codeguard"]["known_ok"] == 1
     assert result.by_scheme["codeguard"]["new_ok"] == 1
+
+
+# ---------------------------------------------------------------------------
+# SonarQube file move detection (branch analyses)
+# ---------------------------------------------------------------------------
+
+
+def _levenshtein(a: list[str], b: list[str]) -> int:
+    # The textbook algorithm, without the common prefix/suffix shortcut.
+    cost = list(range(len(a) + 1))
+    for j in range(1, len(b) + 1):
+        new = [j] + [0] * len(a)
+        for i in range(1, len(a) + 1):
+            new[i] = min(cost[i] + 1, new[i - 1] + 1, cost[i - 1] + (a[i - 1] != b[j - 1]))
+        cost = new
+    return cost[len(a)]
+
+
+def test_sonar_similarity_matches_the_textbook_edit_distance() -> None:
+    import random
+
+    from research.finding_identity.trackers import sonar_similarity
+
+    assert sonar_similarity([], []) == 0
+    assert sonar_similarity(["a"], []) == 0
+    assert sonar_similarity(["a", "b"], ["a", "b"]) == 100
+    assert sonar_similarity(["a", "b", "c", "d"], ["a", "x", "c", "d"]) == 75  # 1 - 1/4
+    assert sonar_similarity(["a", "b", "c"], ["a", "c"]) == 66  # 1 - 1/3, truncated
+    rng = random.Random(7)  # noqa: S311  (test data, not security)
+    for _ in range(300):
+        a = [rng.choice("abc") for _ in range(rng.randint(0, 12))]
+        b = [rng.choice("abc") for _ in range(rng.randint(0, 12))]
+        if a or b:
+            expected = int(100 * (1.0 - _levenshtein(a, b) / max(len(a), len(b))))
+            assert sonar_similarity(a, b) == expected, (a, b)
+
+
+def test_sonar_file_moved_score_and_line_count_bounds() -> None:
+    from research.finding_identity.trackers import sonar_file_moved
+
+    old = [f"line_{i} = {i}" for i in range(100)]
+    assert sonar_file_moved(old, old)
+    assert sonar_file_moved(old, [*old, "", "x = 1"])
+    # Score 1 - 15/100 = 85 is enough, but 84 lines is at the lower bound floor(100 * 0.84).
+    assert sonar_file_moved(old, old[:85])
+    assert not sonar_file_moved(old, old[:84])
+    # 15 added lines: 1 - 15/115 = 86. 18 added lines: within the upper bound
+    # ceil(100 * 1.18) = 119 (the product is 118.00000000000001) but 1 - 18/118 = 84.
+    assert sonar_file_moved(old, old + [f"y{i}" for i in range(15)])
+    assert not sonar_file_moved(old, old + [f"y{i}" for i in range(18)])
+    # Spaces and tabs do not count: line hashes drop them.
+    assert sonar_file_moved(old, [line.replace(" ", "\t") for line in old])
+    # Half the lines rewritten.
+    assert not sonar_file_moved(old, old[:50] + [f"z{i}" for i in range(50)])
+
+
+def test_sonar_branch_pairs_nothing_across_a_rename_it_does_not_detect() -> None:
+    from research.finding_identity.matching import scheme_pairs
+
+    old_text = "def f(x):\n    eval(x)\n" + "".join(f"a{i} = {i}\n" for i in range(20))
+    new_text = "def f(x):\n    eval(x)\n" + "".join(f"b{i} = {i}\n" for i in range(20))
+
+    def obs(text: str) -> Observation:
+        ctx = FileContext.build("f.py", text, is_python=True)
+        keys = keys_for("R", 2, ctx, ALL_SCHEMES)
+        return Observation("R", 2, 5, keys, lines=split_lines(text))
+
+    old, new = [obs(old_text)], [obs(new_text)]
+    # The flagged line is unchanged, so both modes keep the finding at the same path...
+    assert scheme_pairs(old, new, "sonar") == {0: 0}
+    assert scheme_pairs(old, new, "sonar_branch") == {0: 0}
+    # ...but across a rename, a branch analysis sees a new file (2 of 23 lines equal).
+    assert scheme_pairs(old, new, "sonar", renamed=True) == {0: 0}
+    assert scheme_pairs(old, new, "sonar_branch", renamed=True) == {}
+    # A rename with the same content is a detected move.
+    assert scheme_pairs(old, [obs(old_text)], "sonar_branch", renamed=True) == {0: 0}
diff --git a/research/finding_identity/tests/test_paper_kit.py b/research/finding_identity/tests/test_paper_kit.py
new file mode 100644
index 0000000..e358dfd
--- /dev/null
+++ b/research/finding_identity/tests/test_paper_kit.py
@@ -0,0 +1,96 @@
+"""The paper's RQ1 numbers: the rename split and the estimates."""
+
+import json
+from pathlib import Path
+
+from research.finding_identity.paper_kit import Run, _rename_split, estimate, latex_table
+
+
+def _run(tmp_path: Path, records: list[dict[str, object]]) -> Run:
+    path = tmp_path / "findings.jsonl"
+    path.write_text("".join(json.dumps(r) + "\n" for r in records))
+    return Run("x", {}, path)
+
+
+def test_rename_split_counts_persisting_findings_only(tmp_path: Path) -> None:
+    def rec(truth: str, status: str, outcome: str) -> dict[str, object]:
+        return {"rule": "R", "truth": truth, "status": status, "outcomes": {"s": outcome}}
+
+    run = _run(
+        tmp_path,
+        [
+            rec("known", "M", "known_ok"),
+            rec("known", "M", "false_new"),
+            rec("known", "R", "false_new"),
+            rec("new", "R", "false_known"),  # introduced: not part of the split
+            rec("known", "A", "known_ok"),
+        ],
+    )
+    assert _rename_split(run, "s") == {
+        "false_new_same_path": (1, 3),
+        "false_new_renamed": (1, 1),
+    }
+
+
+def test_estimate_pools_and_takes_the_median_of_repository_rates() -> None:
+    pairs = [(1, 4), (3, 6), (0, 0)]
+    draws = [[0, 1, 2], [0, 0, 1], [1, 1, 1]]
+    e = estimate(pairs, draws)
+    assert (e.num, e.den, e.rate) == (4, 10, 0.4)
+    assert e.median == 0.375  # of 1/4 and 3/6; the repository without findings is left out
+    assert e.ci is not None and e.ci[0] <= 0.4 <= e.ci[1]
+
+
+def test_latex_table_marks_missing_schemes() -> None:
+    facts = {"codeguard": {"repos": 1, "known": 10, "introduced": 2, "known_renamed": 0}}
+    e = estimate([(1, 10)], [[0]])
+    tex = latex_table({("line", "false_new"): e}, None, facts)
+    assert "\\texttt{line} & 10.0 {\\scriptsize(10.0--10.0)} & -- &" in tex
+    assert "\\texttt{sonar\\_branch} & -- &" in tex
+
+
+def test_rq2_pools_counts_over_repositories(tmp_path: Path) -> None:
+    from research.finding_identity.paper_kit import load_matrices, rq2_estimates
+
+    def write(label: str, false_new: int, known: int) -> None:
+        d = tmp_path / f"transform-{label}"
+        d.mkdir()
+        head = "transform,scheme,false_new,target_known,hidden,introduced\n"
+        rows = f"insert_top,line,{false_new},{known},0,0\ninsert_top,other,0,{known},0,0\n"
+        (d / "matrix.csv").write_text(head + rows)
+
+    write("a", 2, 4)
+    write("b", 1, 6)
+    matrices = load_matrices(tmp_path, ["a", "b", "missing"])
+    assert list(matrices) == ["a", "b"]
+    table = rq2_estimates(matrices, ["line"], resamples=50, seed=1)
+    fn = table[("insert_top", "line", "false_new")]
+    assert (fn.num, fn.den, fn.rate) == (3, 10, 0.3)
+    assert table[("insert_top", "line", "hidden")].rate is None  # nothing introduced
+    assert not any(key[1] == "other" for key in table)
+
+
+def test_excluded_rules_leave_every_count(tmp_path: Path) -> None:
+    from research.finding_identity.paper_kit import _record_counts, repo_counts
+
+    def rec(rule: str, truth: str, outcome: str) -> dict[str, object]:
+        return {"rule": rule, "truth": truth, "status": "M", "outcomes": {"s": outcome}}
+
+    records = [
+        rec("B101", "known", "false_new"),
+        rec("B101", "new", "false_known"),
+        rec("B602", "known", "known_ok"),
+        rec("B602", "known", "mispaired"),
+        rec("B602", "new", "false_known"),
+        rec("B602", "new", "new_ok"),
+    ]
+    run = _run(tmp_path, records)
+    run = type(run)(run.label, run.summary, run.findings, frozenset({"B101"}))
+    assert _record_counts(run, "s") == {
+        "false_new": (0, 2),
+        "hidden": (1, 2),
+        "mispair": (1, 2),
+    }
+    counts = repo_counts([run], "s")
+    assert counts["false_new_same_path"] == [(0, 2)]
+    assert counts["collision"] == [(0, 0)]  # not computable from the records
diff --git a/research/finding_identity/tests/test_schemes.py b/research/finding_identity/tests/test_schemes.py
index c0e72ce..b7964bf 100644
--- a/research/finding_identity/tests/test_schemes.py
+++ b/research/finding_identity/tests/test_schemes.py
@@ -61,7 +61,9 @@ def test_codeguard_key_equals_runner_fingerprint() -> None:
     assert keys["codeguard"] == f.fingerprint
     # With no literals on the line, masking changes nothing: the two keys coincide.
     assert keys["cg_no_mask"] == keys["codeguard"]
-    others = [keys[s] for s in ALL_SCHEMES if s != "cg_no_mask"]
+    # Both SonarQube modes run the same tracker; they differ only across renamed files.
+    assert keys["sonar_branch"] == keys["sonar"]
+    others = [keys[s] for s in ALL_SCHEMES if s not in ("cg_no_mask", "sonar_branch")]
     assert len(set(others)) == len(others)
 
 
diff --git a/research/finding_identity/trackers.py b/research/finding_identity/trackers.py
index 02c8ad5..39d6c88 100644
--- a/research/finding_identity/trackers.py
+++ b/research/finding_identity/trackers.py
@@ -3,7 +3,12 @@
 Key schemes pair findings with equal keys (:func:`matching.scheme_pairs`). Two tools decide
 "same finding" differently, so their schemes plug in a matcher here instead:
 
-- ``sonar``: SonarQube's multi-pass issue tracker, ported line by line below.
+- ``sonar``: SonarQube's multi-pass issue tracker, ported line by line below. A renamed
+  file's findings are tracked against the old file, as in a pull-request analysis, which
+  takes renames from the SCM.
+- ``sonar_branch``: the same tracker as a branch analysis runs it. A renamed file is the
+  old file only if SonarQube's own file move detection says so (:func:`sonar_file_moved`);
+  otherwise its findings are all new.
 - ``bandit``: ``bandit -b baseline.json``, which asks only whether an *equal* issue exists
   in the baseline (set membership, not one-to-one pairing).
 
@@ -15,6 +20,7 @@
 from __future__ import annotations
 
 import hashlib
+import math
 from collections import defaultdict
 from collections.abc import Callable, Hashable, Iterable, Sequence
 from dataclasses import dataclass
@@ -857,4 +863,71 @@ def bandit_baseline(old: Sequence[Trackable], new: Sequence[Trackable]) -> dict[
     return pairs
 
 
-MATCHERS: dict[str, Matcher] = {"sonar": sonar_track, "bandit": bandit_baseline}
+# ---------------------------------------------------------------------------
+# SonarQube file move detection (branch analyses)
+# ---------------------------------------------------------------------------
+# Port of the per-pair decision of FileMoveDetectionStep (computeScoreMatrix and its
+# MIN_REQUIRED_SCORE, LOWER_BOUND_RATIO and UPPER_BOUND_RATIO) and of
+# SourceSimilarityImpl.score, in sonar-ce-task-projectanalysis
+# org/sonar/ce/task/projectanalysis/filemove, SonarQube 26.10.0.133078 (LGPL-3.0). The
+# step compares every removed file with every added file and elects the best-scoring
+# pairs; the harness already pairs files by git's rename detection, so only the decision
+# for that pair is ported. Pull-request analyses skip the step and take renames from the
+# SCM (PullRequestFileMoveDetectionStep).
+
+_MOVE_MIN_SCORE = 85
+_MOVE_LOWER_BOUND_RATIO = 0.84
+_MOVE_UPPER_BOUND_RATIO = 1.18
+
+
+def sonar_similarity(left: Sequence[str], right: Sequence[str]) -> int:
+    """``SourceSimilarityImpl.score``: 100 * (1 - edit distance / longer length), truncated."""
+    if not left and not right:
+        return 0
+    longest = max(len(left), len(right))
+    # A common prefix and suffix do not change the edit distance; dropping them first
+    # keeps the quadratic part to the lines that differ.
+    start = 0
+    while start < min(len(left), len(right)) and left[start] == right[start]:
+        start += 1
+    end = 0
+    while end < min(len(left), len(right)) - start and left[-1 - end] == right[-1 - end]:
+        end += 1
+    a, b = left[start : len(left) - end], right[start : len(right) - end]
+    cost = list(range(len(a) + 1))
+    for j in range(1, len(b) + 1):
+        new_cost = [j] + [0] * len(a)
+        for i in range(1, len(a) + 1):
+            replace = cost[i - 1] + (a[i - 1] != b[j - 1])
+            new_cost[i] = min(cost[i] + 1, new_cost[i - 1] + 1, replace)
+        cost = new_cost
+    return int(100 * (1.0 - cost[len(a)] / longest))
+
+
+def sonar_file_moved(old_lines: Sequence[str], new_lines: Sequence[str]) -> bool:
+    """Whether a branch analysis takes the added file for the removed one."""
+    old_count, new_count = len(old_lines), len(new_lines)
+    lower = math.floor(old_count * _MOVE_LOWER_BOUND_RATIO)
+    upper = math.ceil(old_count * _MOVE_UPPER_BOUND_RATIO)
+    if new_count >= upper or new_count <= lower:
+        return False
+    score = sonar_similarity(sonar_line_hashes(old_lines), sonar_line_hashes(new_lines))
+    return score >= _MOVE_MIN_SCORE
+
+
+def _sonar_branch_moved(old: Sequence[Trackable], new: Sequence[Trackable]) -> bool:
+    # Every finding of a file version carries that version's lines.
+    return sonar_file_moved(old[0].lines, new[0].lines)
+
+
+MATCHERS: dict[str, Matcher] = {
+    "sonar": sonar_track,
+    "sonar_branch": sonar_track,
+    "bandit": bandit_baseline,
+}
+
+#: For a renamed file: whether the scheme still takes it for the old file. A scheme
+#: listed here pairs nothing across a rename that its check rejects.
+RENAME_CHECKS: dict[str, Callable[[Sequence[Trackable], Sequence[Trackable]], bool]] = {
+    "sonar_branch": _sonar_branch_moved,
+}
diff --git a/research/finding_identity/transform_cli.py b/research/finding_identity/transform_cli.py
index 81f29d2..e78fcf3 100644
--- a/research/finding_identity/transform_cli.py
+++ b/research/finding_identity/transform_cli.py
@@ -8,6 +8,7 @@
 
 import argparse
 import os
+import tempfile
 from pathlib import Path
 from typing import Any
 
@@ -22,7 +23,11 @@ def add_parser(sub: Any) -> None:
         help="apply controlled transformations and score every scheme (invariance matrix)",
     )
     tp.add_argument("source", help="local directory, local repository or git URL to clone")
-    tp.add_argument("--ref", help="branch or tag to clone (URLs only)")
+    tp.add_argument(
+        "--ref",
+        help="branch or tag to clone for a URL; for a local repository, the commit whose "
+        "Python files to use (for example a pinned corpus commit)",
+    )
     tp.add_argument(
         "--transforms",
         default="all",
@@ -81,24 +86,53 @@ def run(args: argparse.Namespace) -> None:
 
     meta: dict[str, Any] = {"source": args.source, "ai_model": model if model else None}
     local = Path(args.source)
-    if local.is_dir():
-        root = local
-    else:
-        repo = GitRepo.open_or_clone(args.source, args.workdir, depth=1, ref=args.ref)
-        root = repo.path
-        meta["head"] = repo.resolve("HEAD")
-        repo.close()
-    label = args.label or root.resolve().name
+    label = args.label or local.resolve().name
     categories = [c.strip() for c in args.categories.split(",") if c.strip()]
-    run_experiment(
-        root,
-        label=label,
-        transforms=transforms,
-        scanner=Scanner(rule_ids_for(categories), ALL_SCHEMES),
-        schemes=ALL_SCHEMES,
-        samples=args.samples,
-        seed=args.seed,
-        out_dir=args.out or HERE / "results" / f"transform-{label}",
-        meta={**meta, "categories": categories},
-        draw_heatmap=args.heatmap,
-    )
+
+    def experiment(root: Path) -> None:
+        run_experiment(
+            root,
+            label=label,
+            transforms=transforms,
+            scanner=Scanner(rule_ids_for(categories), ALL_SCHEMES),
+            schemes=ALL_SCHEMES,
+            samples=args.samples,
+            seed=args.seed,
+            out_dir=args.out or HERE / "results" / f"transform-{label}",
+            meta={**meta, "categories": categories},
+            draw_heatmap=args.heatmap,
+        )
+
+    if local.is_dir() and not args.ref:
+        experiment(local)  # a working tree, used as it is
+        return
+    if local.is_dir():
+        # A commit of a local repository, such as a corpus clone (which has no checkout):
+        # its Python files are exported to a temporary directory.
+        repo = GitRepo(local)
+        try:
+            meta["head"] = repo.resolve(args.ref)
+            with tempfile.TemporaryDirectory(prefix="transform-") as tmp:
+                export_python_files(repo, meta["head"], Path(tmp))
+                experiment(Path(tmp))
+        finally:
+            repo.close()
+        return
+    repo = GitRepo.open_or_clone(args.source, args.workdir, depth=1, ref=args.ref)
+    meta["head"] = repo.resolve("HEAD")
+    repo.close()
+    label = args.label or repo.path.resolve().name
+    experiment(repo.path)
+
+
+def export_python_files(repo: Any, commit: str, dest: Path) -> int:
+    """Write the ``.py`` files of *commit* under *dest*; return how many were written."""
+    count = 0
+    for path, blob in repo.files(commit).items():
+        if not path.endswith(".py"):
+            continue
+        target = dest / path
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_bytes(repo.blob(blob))
+        count += 1
+    return count