[hyperpolymath]

Rebased onto main (c978994, which now carries #208/#211/#213), so this PR is only the part main still gets wrong — and main still cannot load the package.

1. using MetaManifold fails

File	Defect	Effect
src/core/doi.jl	module DOI declared twice (lines 4 and 21) with one terminator	ParseError at EOF, before a single test runs
src/MetaManifold.jl	analysis/clade_cumulus.jl included twice; analysis/compositional.jl never included	module redefined; UndefVarError: CompositionalModels when differential.jl loads
src/server/server.jl	routes/cladistics.jl never included	the Cladistics tab calls endpoints that return 404 while the route file sits unused

Each is a one-line fix in place. cladistics.jl is included after clade_cumulus.jl; it shares no route path or helper name with the other route files.

2. Test registration

test/runtests.jl listed test_clade_cumulus.jl twice and had lost test_evidence.jl and test_evidence_routes.jl, which #201 added. Now 49 files, each once, and every file in test/unit is registered.

3. Two statistics tests that contradicted their own sources

Both came from a branch whose tests were written against different source behaviour:

• test_exact_summaries.jl expected 0/1 proportions for a zero-read sample. _summarise fills them with nothing and stores null, because a proportion is undefined — not zero — when a sample has no reads. The test is realigned to the source; the source is not weakened to the test.
• test_high_precision.jl expected UnsupportedRepresentationError for a policy of the wrong numeric mode. assert_mode raises ArgumentError for that (a caller error, not an unrepresentable value). Realigned, with the reason stated inline.

4. Documentation main lost in the #196 merge

• docs/statistics/zero-handling.md is back to the full treatment — replacement policies and their exact cmultRepl calls, delta semantics, what the Bayesian posterior parameterisation does and does not claim, warnings, and references — instead of the 60-line summary.
• README.md regains the Evidence Mode section and the differential-abundance method guidance (why a count model rather than a t-test, choosing the reference taxon, overdispersion, which model to use), documents all nine methods and their settings, and the config sample lists every differential key including the multinomial optimiser budget.

Validation

Julia is not available in my environment, so the Julia side is static: tree-sitter parses every touched file, no file is included twice, every test/unit file is registered exactly once, and the YAML parses with the expected differential keys. Frontend: npx tsc --noEmit clean, bun test src 85/85, npm run build succeeds. CI is the first real execution of the Julia suite, and I will follow it and fix what it reports.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-23T00:14:37.277340Z We couldn’t complete this review. Comment @codex review to try again.	c6a97e0	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 53 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 51614486-aef1-4a40-a814-82615f75923d

📥 Commits

Reviewing files that changed from the base of the PR and between c978994 and f79c1ca.

📒 Files selected for processing: 8

• README.md
• docs/statistics/zero-handling.md
• src/MetaManifold.jl
• src/core/doi.jl
• src/server/server.jl
• test/runtests.jl
• test/unit/test_exact_summaries.jl
• test/unit/test_high_precision.jl

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Fork governance

Lane	Status	Run
DEED syntax (repo deed)	🟢 conformant	run 39878624021
Hypatia verdict grid	purple (job: success)	same run

🟣 critical · commit f79c1ca4c925 · run 39878624021

Reporter	Status	Critical	High	Medium	Minor	Since previous revision
Hypatia scan	🟣 critical	47	63	31	0	↔ unchanged
panic-attack assail	🔴 high	0	5	13	0	↔ unchanged
pons asinorum	🟡 medium	0	0	10	0	↔ unchanged
rhodibot (RSR compliance)	🟠 indeterminate	0	0	0	0	— indeterminate
panicbot (panic recovery, error handling)	🟠 indeterminate	0	0	0	0	— indeterminate
echidnabot (formal verification: proofs/)	🟠 indeterminate	0	0	0	0	— indeterminate
seambot (integration health: API routes)	🟠 indeterminate	0	0	0	0	— indeterminate
finishingbot (release readiness)	🟠 indeterminate	0	0	0	0	— indeterminate
accessibilitybot (WCAG on the React UI)	🟠 indeterminate	0	0	0	0	— indeterminate
glambot (presentation quality)	🟠 indeterminate	0	0	0	0	— indeterminate
cipherbot	⚪ not applicable	0	0	0	0	↔ unchanged
sustainabot	⚪ not applicable	0	0	0	0	↔ unchanged

Hypatia scan: 141 finding(s)

• critical cicd_rules/banned_language_file — frontend/src/views/run/parseFilterYaml.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/figure/encode.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/figure/charts.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/figure/export.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/figure/figure.test.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/figure/legend.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/figure/types.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/utils/download.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/utils/text.test.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/utils/timeago.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/utils/text.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/hooks/useUnsavedGuard.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/hooks/useApi.test.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/hooks/useApi.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/hooks/useAnalysis.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/hooks/useSSE.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/hooks/useTabParam.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/hooks/useNavRefresh.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/hooks/useJobEvents.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/about.ts — TypeScript file detected -- banned language
• 121 more; see the structured report in the artifact.

panic-attack assail: 18 finding(s)

• high DynamicCodeExecution — src/pipeline/dada2/context.jl — eval/Meta.parse in src/pipeline/dada2/context.jl
• high DynamicCodeExecution — src/analysis/analysis.jl — eval/Meta.parse in src/analysis/analysis.jl
• high DynamicCodeExecution — src/analysis/differential.jl — eval/Meta.parse in src/analysis/differential.jl
• high DynamicCodeExecution — src/core/provenance.jl — eval/Meta.parse in src/core/provenance.jl
• high DynamicCodeExecution — test/unit/test_permanova.jl — eval/Meta.parse in test/unit/test_permanova.jl
• medium UnsafeFFI — src/core/memory_probe.jl — 3 ccall/FFI calls in src/core/memory_probe.jl
• medium InputBoundary — src/server/routes/runs.jl — 2 JSON3.read/JSON.parse call(s) with 0 try block(s) in src/server/routes/runs.jl — these throw on malformed input; wrap in try/catch
• medium InputBoundary — src/server/routes/composition.jl — 6 JSON3.read/JSON.parse call(s) with 2 try block(s) in src/server/routes/composition.jl — these throw on malformed input; wrap in try/catch
• medium InputBoundary — src/server/routes/studies.jl — 4 JSON3.read/JSON.parse call(s) with 2 try block(s) in src/server/routes/studies.jl — these throw on malformed input; wrap in try/catch
• medium InputBoundary — src/server/routes/analysis.jl — 9 JSON3.read/JSON.parse call(s) with 3 try block(s) in src/server/routes/analysis.jl — these throw on malformed input; wrap in try/catch
• medium UnsafeFFI — install.jl — 1 ccall/FFI calls in install.jl
• medium ProofDrift — test/unit/test_occupancy_grade.jl — 2 `@test x isa Y` assertion(s) with no value check — type-only tests may substitute for an unwritten formal theorem in test/unit/test_occupancy_grade.jl
• medium ProofDrift — test/unit/test_evidence.jl — 1 `@test x isa Y` assertion(s) with no value check — type-only tests may substitute for an unwritten formal theorem in test/unit/test_evidence.jl
• medium InputBoundary — bench/advanced_zero_handling/benchmark.jl — 1 JSON3.read/JSON.parse call(s) with 0 try block(s) in bench/advanced_zero_handling/benchmark.jl — these throw on malformed input; wrap in try/catch
• medium InputBoundary — frontend/src/figure/charts.ts — 1 JSON.parse call(s) with 0 try block(s) in frontend/src/figure/charts.ts — JSON.parse throws SyntaxError on malformed input; wrap in try-catch
• medium InputBoundary — frontend/src/tree/model.ts — 1 JSON.parse call(s) with 0 try block(s) in frontend/src/tree/model.ts — JSON.parse throws SyntaxError on malformed input; wrap in try-catch
• medium InputBoundary — frontend/src/api/events.ts — 2 JSON.parse call(s) with 0 try block(s) in frontend/src/api/events.ts — JSON.parse throws SyntaxError on malformed input; wrap in try-catch
• medium InputBoundary — frontend/src/components/alphaMetrics.tsx — 1 JSON.parse call(s) with 0 try block(s) in frontend/src/components/alphaMetrics.tsx — JSON.parse throws SyntaxError on malformed input; wrap in try-catch

pons asinorum: 10 finding(s)

• medium string-concat-in-loop — ./frontend/src/tree/model.ts:122 — string built by repeated concatenation in a loop (T0, HEURISTIC)
• medium string-concat-in-loop — ./frontend/src/tree/model.ts:118 — string built by repeated concatenation in a loop (T0, HEURISTIC)
• medium string-concat-in-loop — ./frontend/src/tree/TreeShapes.tsx:69 — string built by repeated concatenation in a loop (T0, HEURISTIC)
• medium string-concat-in-loop — ./frontend/src/tree/TreeShapes.tsx:66 — string built by repeated concatenation in a loop (T0, HEURISTIC)
• medium string-concat-in-loop — ./frontend/src/tree/TreeShapes.tsx:61 — string built by repeated concatenation in a loop (T0, HEURISTIC)
• medium string-concat-in-loop — ./frontend/src/tree/TreeShapes.tsx:53 — string built by repeated concatenation in a loop (T0, HEURISTIC)
• medium string-concat-in-loop — ./frontend/src/tree/TreeShapes.tsx:43 — string built by repeated concatenation in a loop (T0, HEURISTIC)
• medium string-concat-in-loop — ./frontend/src/tree/TreeShapes.tsx:42 — string built by repeated concatenation in a loop (T0, HEURISTIC)
• medium unreachable-after-jump — ./frontend/src/figure/PaneEditor.tsx:45 — statement is unreachable after an unconditional jump (T0, HEURISTIC)
• medium unreachable-after-jump — ./frontend/src/components/PublicationTablesPanel.tsx:208 — statement is unreachable after an unconditional jump (T0, HEURISTIC)

rhodibot (RSR compliance): not_run — enrolled, but no report-back was received

• 🟠 indeterminate: enrolled, but no report-back was received

panicbot (panic recovery, error handling): not_run — enrolled, but no report-back was received

• 🟠 indeterminate: enrolled, but no report-back was received

echidnabot (formal verification: proofs/): not_run — enrolled, but no report-back was received

• 🟠 indeterminate: enrolled, but no report-back was received

seambot (integration health: API routes): not_run — enrolled, but no report-back was received

• 🟠 indeterminate: enrolled, but no report-back was received

finishingbot (release readiness): not_run — enrolled, but no report-back was received

• 🟠 indeterminate: enrolled, but no report-back was received

accessibilitybot (WCAG on the React UI): not_run — enrolled, but no report-back was received

• 🟠 indeterminate: enrolled, but no report-back was received

glambot (presentation quality): not_run — enrolled, but no report-back was received

• 🟠 indeterminate: enrolled, but no report-back was received

cipherbot: not_applicable — no cryptography is implemented in this repository

• ⚪ not applicable: no cryptography is implemented in this repository

sustainabot: not_applicable — fleet adapter slot reserved; no adapter exists yet (gitbot-fleet README)

• ⚪ not applicable: fleet adapter slot reserved; no adapter exists yet (gitbot-fleet README)

Scope: static findings reported by each row's tool at the named commit. Purple, red, yellow and blue grade the worst finding present; orange is evidence missing, malformed or a scanner that did not run; grey is an explicit scope exclusion with its reason. No row is a security certification. report.json, badge.json and the raw findings are in the verdict-grid artifact on the linked run.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud