audit H2/M1/M11: say what cannot be done, say what is checked, stop keeping two copies

[ojassug]

Closes the last three audit items — H2, M1 and M11. The audit filed these as decisions
rather than tasks, because each had a legitimate "narrow the product" answer and a legitimate
"build more" one. Reasoning, including the options refused, in DECISIONS §46.

Every audit item is now closed. What remains is the architectural work in the status doc's §5,
chiefly Phase 1c.

---

H2 — decided: report why, don't narrow the accepted set

Twelve of nineteen recognised extensions can't produce a non-zero reduction under any flag
combination, and that was indistinguishable from a file with nothing worth compressing.

Refused: rejecting --language go. Stronger honesty signal, but it deletes a working
behaviour — pass-through is byte-identical and harmless.

Taken: trace.languageSupport carries supported / unsupported / unsupportedLanguages /
noneSupported / reason, and validate() raises an info issue (LANGUAGE_NOT_ELIDIBLE)
that doesn't vote on the verdict. Same correction M5a made for budgets, one layer down.

Three things worth flagging for review:

• The predicate had to come from the gate, not from intuition. A first version asked "does
  the item yield symbols or markers?" and called Go supported — a trivial Go file yields
  exactly one symbol, import:fmt, an incidental match by the TypeScript import regex. The
  answer is exactly supportsRegionElision. Measured: 3 of 17 probed languages, which is the
  audit headline and the corpus agreeing independently.
• The field crosses four whitelists that each enumerate their keys — validate()'s return,
  createValidationReport, buildTrace, createOptimizationTrace. Three dropped it silently.
  The test asserts on the trace, not on validate(), for that reason.
• A friendly CLI notice was written and then removed. stderr is a JSON trace document and
  consumers parse the whole stream — four of this repo's own tests do. Prepending prose broke
  them. The explanation now lives inside the report as reason.

M1 — decided: correct the docs, don't wire the compiler API

The TypeScript "AST-lite validator" builds no AST. Probed against the shipped code rather than
copied from the audit (three audit claims here have failed that test — §40, §42, §45), all of it
reproduced:

Input	Verdict
const x = ; · import from "x"; · let 123abc = 5; · const a = 1 +++++ 2; · English prose	PASS
super(; }	FAIL

Refused: ts.createSourceFile. On cost, not principle — typescript is a dev dependency
today; promoting it to runtime costs install size and parse latency against a lexer that runs in
single-digit milliseconds.

Taken: README and CLAUDE.md now say bracket/quote integrity, with a per-language table of
what each validator does and does not catch. test/unit/validator-guarantee.test.ts pins every
row — strengthen a validator and it fails on purpose, and the table has to move with it.

M11 — decided: retire the narratives and root planning artifacts

Twelve files, 226 KB. Markdown 31 files → 19; markdown:src 1.40:1 → 0.95:1.
docs/retired-documents.md maps each file to where its conclusion lives and gives the git show
command to read the original.

The premise was stale, and measuring first changed what the decision was about. M11 was filed
as 4.1:1; measured before acting it was already 1.40:1 — and not because the docs had
shrunk (they'd grown to 726 KB) but because src/ grew faster. Since 32.8% of src/ is comment
prose, prose:code actually ran ~2.6:1. So the finding isn't about bytes, it's about two copies
of an argument kept in sync by hand. In-source commentary isn't that, and none of it was touched.

Twenty-five source and test comments cite a retired document — the check this option called
for, and the thing that nearly made it a bad change. They're marked [retired] rather than
re-pointed: the citation names something git still holds, whereas re-pointing 25 citations at
DECISIONS sections by hand risks mapping some to the wrong place — trading a volume problem for a
correctness one. CHANGELOG.md and DECISIONS.md keep their older citations untouched, each with
a note saying why: they record what was true when written.

---

Verification

• 599 tests passing (was 566), typecheck and lint clean.
• 574 of 574 corpus rows identical to the pre-change engine across 17 fields, same frozen
  corpus, varying only dist/. H2 refactored selectElisionRegions to derive its gate from a
  shared predicate, so this was a real risk rather than a formality.
• Verified end-to-end on the built CLI: a Go file reports noneSupported with its reason, a
  TypeScript file doesn't, and stderr still parses as JSON.

The corpus recipe moves again, both changes mine: typescript 60 → 61
(src/core/validation/language-support.ts) and prose 29 → 18 (twelve retired, one added).
collect.js refused on both before measuring anything.

Left undone, deliberately

cli/bench-table-renderer.ts:97 still prints a risk column sourced from riskTolerance, which
H4 established no stage reads. It's now the only reader of that field, and a benchmark column
implies the row's numbers depend on it. Small and real — left out because changing what a
benchmark reports is a measurement change, not a documentation one.

🤖 Generated with Claude Code