Findings Delta

The bug this exists to prevent

Comparing two review runs looks like set subtraction. In the previous run, not in this one: resolved. It is wrong in a way that flatters you.

Absence is only evidence if the check ran. If the second run was scoped to a subset, or a layer was skipped, or a targeted re-check looked at three files instead of forty, then everything outside that scope disappears from the results — and naive subtraction reports all of it as resolved. The report says the codebase improved, and what actually happened is that you looked at less of it.

The inverse matters too: a finding appearing for the first time is only a regression if the thing that found it was watching before. From a layer that runs fully every time, a new finding means something broke. From a layer that just started running, it means you started looking.

Rule 1 — authority decides what absence means

A new finding from an always-fully-rechecked layer is a regression — that layer is authoritative, so its silence last time was real. A new finding from a targeted or partial pass is new, not a regression.

That distinction is the product. It is also the one that gets lost first, because a single "new findings" count is so much easier to put on a dashboard.

Rule 2 — severity movement is its own fact

An unresolved finding carries its severity delta, and reports severityChanged: false when it has not moved. A finding that went critical-to-low is still unresolved and is also the most useful line in the report; merging it into a count of open issues throws that away.

Rule 3 — regression anchors are declared, not inferred

Subjects can be marked as deliberate regression anchors, so a new finding on one is treated as a regression regardless of scope. The things you most need to not break are stated up front rather than guessed from coverage.

What this does NOT do

No reviewing, no scanning, no severity assignment, no identity matching between runs — you supply findings that are already comparable. If your finding IDs are unstable across runs, this will report churn faithfully, because that is what it was given.

Verified

21 tests: resolved, unresolved with and without severity movement, genuinely new versus regression, always-rechecked layers making absence authoritative, declared regression anchors, and empty-versus-empty producing no deltas at all.

Not covered: nothing validates that two runs are actually comparable. Feeding it a full run and a targeted run without marking layer authority will produce a confident, wrong report — that metadata is the input this depends on.