Fix stale symbol snapshots and src-layout imports

[tom-sapletta-com]

The cross-reference validator reused stale symbols after same-sized context edits and missed absent internal modules under src/. Build symbols per instance and compare canonical full module paths. External imports and real packages named src remain supported.

For modules omitted by the context depth limit, bounded source probes verify existence without importing code or following paths outside the project root.

Validation: 57 tests pass, including 14 new regression cases; Ruff and the pinned documentation checker pass. Canonical explanation: docs/information/current-code-references.md.

Protected publication gap: no deployed OneDev profile was observed for this repository; the existing required Python 3.10/3.13 matrix remains. This draft does not waive those requirements.

Intent allocation: #6

[ifuri-validator-agent]

Deterministic Validator approval for exact head c2bb455730d5065648812b3757af939d885bec4d.

Ticket: ticket-006
Correlation ID: local-semcod-docval-pr-7-ticket-006
Model: zai/glm-5.3
Reviewed diff chunks: 2
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 2 diff chunk(s). Chunk removes a process-global symbol cache that could accept stale symbols after same-count edits, and replaces prefix-based import checking with canonical full-module matching that handles src/ layouts and namespace packages. Bounded filesystem probes for modules beyond context depth stay within the resolved project root. Tests pass on both matrix versions. | Second chunk of the crossref validator change adds regression tests covering full-path internal module matching, src-prefixed path handling, bounded source probes beyond context depth, symlink escape rejection, and stale-symbol rescans with identical counts. Tests pass on 3.10 and 3.13.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.

Actual PR impact radar

Exact range: 1debd415c95765c05ec9c975fdc1626943c05e1f...c2bb455730d5065648812b3757af939d885bec4d
Change digest: 73e06e346a389aa5d8ed3e455a33853584e208c583a1c638d17fc9a4f7b0ee5c
Score: 64/100 (L), estimated 78 min, split recommended: true
Affected services/components: repository-wide/unclassified

Machine-readable radar JSONL and SVG

{"actual_change":{"additions":265,"base_sha":"1debd415c95765c05ec9c975fdc1626943c05e1f","binary_files":0,"categories":{"code":1,"configuration":1,"docs":3,"tests":1},"change_digest":"73e06e346a389aa5d8ed3e455a33853584e208c583a1c638d17fc9a4f7b0ee5c","comparison":"1debd415c95765c05ec9c975fdc1626943c05e1f...c2bb455730d5065648812b3757af939d885bec4d","deletions":26,"file_count":6,"files":["docs/README.md","docs/information/current-code-references.md","project/ticket-006/README.md","project/ticket-006/intent.json","src/docval/validators/crossref.py","tests/test_crossref.py"],"head_sha":"c2bb455730d5065648812b3757af939d885bec4d","service_count":0,"services":[]},"assessment_mode":"observed-pr","axes":{"coupling":5,"delivery":3,"scope":4,"uncertainty":3,"validation":1},"complexity":"L","confidence":0.9,"diagnostics":["RADAR-ACCEPTANCE-MISSING","RADAR-BUDGET-EXCEEDED"],"estimate":{"budget_minutes":30,"minutes":78,"within_budget":false},"impact":{"components":["3.10","docs","github.com","project","repository-root","src/docval","tests"],"files":["3.10/3.13","docs/README.md","docs/information/current-code-references.md","github.com/semcod/docval/issues/6","project/ticket-006/README.md","project/ticket-006/intent.json","src","src/docval/validators/crossref.py","tests/test_crossref.py"],"public_interfaces":[],"runtime_dependencies":0},"schema":"subactor.ticket-radar/v1","score":64,"split":{"parts":[{"estimated_minutes":10,"name":"Implement 3.10","scope":["3.10"]},{"estimated_minutes":10,"name":"Implement docs","scope":["docs"]},{"estimated_minutes":10,"name":"Implement github.com","scope":["github.com"]},{"estimated_minutes":10,"name":"Implement project","scope":["project"]},{"estimated_minutes":10,"name":"Implement repository-root","scope":["repository-root"]},{"estimated_minutes":15,"name":"Validate and project to trackers","scope":["tests","planfile","github/gitlab/jira projections"]}],"reason":"estimated_minutes_exceed_budget","recommended":true},"standards":[{"id":"wellmanifest/dsl","revision":"6c60fc4e0dd1f1bb74f46a7745e28019908d1203","version":"0.1.0-dev"},{"id":"wellmanifest/ticket-lifecycle","revision":"5bf581907a87b46a13a73e6c033d3abe4d9a306f","version":"0.1.0-dev"},{"id":"wellmanifest/git-lifecycle","revision":"7d77d4b7af57e69bc75c3a0290b3a4805c5c4438","version":"0.2.0-dev"},{"id":"wellmanifest/logs","revision":"48c284ef7a069055c0bcb6b900147ce5e65f8b43","version":"0.3.0"}],"ticket_ref":"ticket-006"}

<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" viewBox="0 0 128 128" role="img"><title>ticket-006: Fix stale symbol snapshots and src-layout imports</title><rect width="128" height="128" rx="12" fill="#f8fafc"/><g stroke-width="1"><polygon points="64,55 72,61 69,71 59,71 56,61" fill="none" stroke="#d7dde5"/><polygon points="64,47 80,59 74,78 54,78 48,59" fill="none" stroke="#d7dde5"/><polygon points="64,38 89,56 79,85 49,85 39,56" fill="none" stroke="#d7dde5"/><polygon points="64,30 97,53 84,92 44,92 31,53" fill="none" stroke="#d7dde5"/><polygon points="64,21 105,51 89,99 39,99 23,51" fill="none" stroke="#d7dde5"/><line x1="64" y1="64" x2="64" y2="21" stroke="#aab4c0"/><line x1="64" y1="64" x2="105" y2="51" stroke="#aab4c0"/><line x1="64" y1="64" x2="89" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="39" y2="99" stroke="#aab4c0"/><line x1="64" y1="64" x2="23" y2="51" stroke="#aab4c0"/></g><polygon points="64,30 105,51 79,85 59,71 39,56" fill="#fb923c" fill-opacity="0.45" stroke="#c2410c" stroke-width="2"/><circle cx="64" cy="64" r="3" fill="#c2410c"/><g font-family="sans-serif" font-size="7" fill="#334155"><text x="64" y="11" text-anchor="middle">SCO</text><text x="114" y="48" text-anchor="middle">COU</text><text x="95" y="107" text-anchor="middle">UNC</text><text x="33" y="107" text-anchor="middle">VAL</text><text x="14" y="48" text-anchor="middle">DEL</text></g><text x="64" y="124" text-anchor="middle" font-family="sans-serif" font-size="8" fill="#0f172a">L · 78m</text></svg>

Merge will be attempted after this approval when explicitly authorized. ## Decision record (recomputable)

DECISION D-006-0633
TICKET ticket-006
HEAD_SHA c2bb455730d5065648812b3757af939d885bec4d
CORRELATION_ID local-semcod-docval-pr-7-ticket-006
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["test (3.10)=PASS","test (3.13)=PASS"]
INPUT required_checks = ["test (3.10)","test (3.13)"]
INPUT required_checks_source = "protected registry (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
INPUT superseded_checks = []
INPUT ticket_radar_receipt = {"schema":"subactor.ticket-radar/v1","base_sha":"1debd415c95765c05ec9c975fdc1626943c05e1f","head_sha":"c2bb455730d5065648812b3757af939d885bec4d","change_digest":"73e06e346a389aa5d8ed3e455a33853584e208c583a1c638d17fc9a4f7b0ee5c","score":64,"complexity":"L","estimated_minutes":78,"split_recommended":true,"services":[],"authority":"ADVISORY","promotion":"FORBIDDEN"}
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "zai/glm-5.3"
ASSERT VERDICT_AUTHORITY != "ADVISORY"