[rchildress87]

Summary

internal/sdkinv derives the coverage denominator from each cloud's SDK, but it had drifted into hand-maintained word lists, provider code in the core, and SDK surface dropped without a trace. This PR removes all three so the subsystem scales to many providers: adding one touches no core file.

Six phases, one commit each, plus a separate docs pass:

1. Core seams and an accounting invariant (4f1fca27). Universe.SourceOps / Dropped: every SDK op lands in exactly one of a candidate, Other, or Dropped with a reason, checked on fixtures and live caches. Scope vocabulary, Operation.Client, and Resolver.LabelOp replace provider special cases in the core. Denominator unchanged.
2. Relocation (ce7f07b4). Each provider's extractor, refs, pairing resolver, pins and fixtures move to an SDK-free leaf internal/providers/<p>/<p>inventory, wired only through the slim-gated internal/providers/all/<p>.go. TestCoreIsProviderNeutral fails if a core identifier names a cloud. Denominator unchanged.
3. AWS model-first (38ea8a13). Keys, listers and lineage come from Smithy resource shapes, items elements, paginator traits, httpLabel order and ARN grammar instead of verb and noun lists.
4. GCP model-first (68df458f). Listers from pageToken/nextPageToken plus a sibling on the item schema; class from HTTP verb × flatPath; parents from matched get paths.
5. Azure model-first (daa0d00c). A go/parser extractor over armX sources replaces the regex walk: builders are followed from every exported client method; the element is the decoded response field's shape; instance ids, namespace, scope and parent come from path structure. singletonIDs, armOwnModules, lowerFirst and the ref allow-lists are gone.
6. Pairing cleanup (188e3446). Unaliased import names come from the importing file's selector roots, not a version-stripping guess; derived pairings require an exact service match. Live pairings byte-identical.

Then d9d1a68b audits every CLAUDE.md against the code (stale names, signatures, paths and numbers fixed; repeats collapsed into pointers).

Coverage impact

Provider	main	this PR
AWS	48.7% (1677/3441)	49.8% (1660/3336)
Azure	15.8% (398/2515)	16.1% (398/2478)
GCP	22.9% (239/1042)	23.2% (240/1034)

The denominators move because classification is now structural. Every changed row was classified in a live before/after diff; accepted misreads are recorded per provider in <p>inventory/CLAUDE.md ("Accepted residuals"). Zero unexplained types. docs/coverage.md and the baseline are regenerated.

User-visible changes

• disco coverage prints a per-provider count of extractor warnings (--verbose lists them), e.g. an Azure arm module the binary links that the pinned SDK HEAD no longer holds.
• Under -tags 'slim <p>', coverage sdk fetch|status knows only the compiled providers.
• The Azure SDK cache KeepID changed, so the next make sdk-fetch refetches Azure.

Verification

• CGO_ENABLED=0 go test ./... green; golangci-lint clean on changed packages; make check-coverage green.
• Four hashed disco coverage services -o json runs agree (determinism).
• Every structural rule mutation-checked against its fixture (break the rule, confirm a test goes red). One known gap: Azure b.paged || paged (fixture emits one builder per method).
• Each phase closed with an adversarial review; every finding fixed or recorded.

Follow-ups (not in this PR)

• store/scans.go:419,437, store/findings.go:148 order by rowid, which Postgres lacks — suspected, unverified.
• --scan-as still documented in README.md, FEATURES.md and cmd/scans.go help; cmd/summary.go help shows snake_case by_account.
• gcpinventory/extract.go:579 compares CanonSingular output instead of Ident.
• cmd/disco-scaffold/gen.go scannerSigs per-provider table; AWS per-module version provenance; azure-rest-api-specs x-ms-arm-id as a second Azure ref source.

🤖 Generated with Claude Code