CLAUDE.md says which files a test keeps free of a stated count (closes #2035) - #2039

CLAUDE.md's Never state how many of anything a file holds named the
tests that enforce it and no file the rule governs without one.
SECURITY.md is such a file, so the sentence read as coverage the suite
does not give. The decision is that it stays with the reading, and this is
that decision written where the rule is.

Three grounds, each measured rather than argued:

• The fitting instrument is inert on its own subject. All three of
  tests/release_notes_test.py's _FORBIDDEN patterns answer None
  against the pre-repair SECURITY.md (git show 6065ade8^:SECURITY.md),
  the file that still said "being four other places a secret meets the
  curve" — while answering true on 4 of 4 _RESURRECTED strings. So
  naming the file in _FILES would have been green on the exact sentence
  ISS 2035 was filed
  for, which is what test_the_patterns_still_match exists to refuse.
• The defect mode that justifies a test for the other two is absent.
  git check-attr merge answers union for CHANGELOG.md and
  RELEASE_NOTES.md and unspecified for SECURITY.md — one run over
  six paths, so the unspecified is discriminated and not a silent zero.
  The silent-restore mechanism a test answers for is not there; what is
  left is staleness, and the paragraph says the file is kept by hand.
• The working instrument costs an allowlist coupled to another gate. A
  guard of tests/vendored_data_test.py's shape flags 48 of 481 prose
  lines, 9 of them path:line citations, each wanting an exemption pinned
  verbatim — where an edit anywhere in a cited module moves the number
  tests/security_citations_test.py then reads.

What lands is a paragraph in CLAUDE.md, a comment above
tests/release_notes_test.py's _FILES where somebody minded to add a
third file is standing, and one CHANGELOG.md entry. 3 files, 43
insertions, 0 deletions; no test function, id or collection count moves.

Gates at 2839272f, the pushed tip: lint exit 0 (47 Passed, 0
Failed), tree clean after; pytest exit 0, 32605 passed, 78 skipped,
TOTAL 57179 0 9886 100.00%; sphinx-build -n -W exit 0; the
href="#../" sweep exit 1 with a planted control the sweep exits 0 on;
pinned markdownlint-cli2 v0.23.2 check-only exit 0, and exit 1 naming
MD032/MD022 on a copy with the blank line above this branch's own
heading deleted.

Reviewed at 3dd2efb3 (CLEARED). Two changes since that sha, both prose
and both from the review itself: the reviewer's non-blocking finding on
the CLAUDE.md paragraph's closing clause is taken, so the clause no
longer labels a live class of SECURITY.md sentences as descriptions the
file carries; and the commit body now points the question it raises at
ISS 2038, filed from
this review, rather than settling it here.

closes #2035

🤖 Generated with Claude Code

https://claude.ai/code/session_01Sn2BerFVJcUtGF8Dm1Amd3

Summary by Sourcery

Document why SECURITY.md remains outside the automated stated-count checks while clarifying the intended scope of the existing test.

Bug Fixes:

• Clarify that SECURITY.md is intentionally maintained manually rather than covered by the count-detection test, addressing issue SECURITY.md states how many places a secret meets the curve, and no gate reads that file for a count #2035.

Enhancements:

• Document the rationale for limiting count checks to files where silent restoration or branch-generated edits can introduce defects.
• Add an explanatory comment at the test file allowlist to prevent inappropriate expansion of its scope.

Documentation:

• Update CLAUDE.md with the decision and criteria governing files subject to stated-count checks.
• Record the decision and its rationale in the changelog.