docs(audit): refresh audit citations after main rewrite; glmGamPoi notices

[arena-ai-coding-agent]

Summary

Follow-up to the memory / numerical / backend / warning-boundary audit
(landed on main in 4c2c79e). Two things happened after that audit was
written, and this PR brings it back in line with the tree it describes:

1. main was rewritten to a new root. 4a848da (the revision the audit
   was written against) and 4c2c79e share no merge base —
   git merge-base returns nothing. Execution.jl moved +125/−60 and
   estimation.jl +231/−29, so a large part of the audit's file:line
   evidence no longer pointed at what it claims to.
2. glmGamPoi dispersion landed (issue feat(analysis): Advanced zero handling — glmGamPoi dispersion, Bayesian multiplicative replacement, multiplicative replacement with delta  #21) as a pure-Julia port in
   src/analysis/dispersion.jl. The notice catalogue was written when
   glmGamPoi was refused along with local/mean/pooled.

Base check

• Base is hyperpolymath/MetaManifold-WebUI:main (not the upstream parent)

Changes

Re-verification (not just renumbering). All 21 findings were re-checked
against 4c2c79e. Four of the six audited files are byte-identical
(ilr_basis.jl, analysis.jl, provenance.jl, bench/ilr_bases/benchmark.jl)
so their citations are untouched; every citation into the two files that moved
was re-located. The four headline findings were confirmed by reading the new
code, not by trusting the old line numbers:

finding	still reproduces at
M3 — clr_table written, never read for values	written 1164, read for dimensions only 1167, 1182, 1183
M4 — redundant full-table copies	840, 858, 868, 989, 1062
N1 — healing mixes scales (epsilon vs log(1/epsilon))	603, 608
W1 — is_dangerous not updated when estimation is :not_run	1682

Catalogue corrections for glmGamPoi:

• estimation.dispersion_refused — no longer says "use parametric" for
  glmgampoi; that method is now supported, and only local, mean, pooled
  are refused by name.
• added estimation.dispersion_glmgampoi_port (method limitation / warning) —
  the dispersion estimate comes from this repository's port, not R's glmGamPoi.
• added estimation.dispersion_spline_refused (fatal) — the spline abundance
  trend at SPLINE_TREND_MIN_FEATURES (100) features is not ported.
• added estimation.dispersion_pass1_fallback (data quality / warning) —
  features with no pass-1 fit entered the dispersion estimate at their row mean.

Audit revision note recording the rewrite, the re-verification, and that two
pure-Julia kernels now exist (dispersion.jl, zero_replacement.jl) — which
strengthens the answer to question 10 (reference path for a future accelerated
implementation) without changing the gate: each still needs a published
conditions document, an independent oracle and a stated parity tolerance, and
CI still has no recorded verdict on any of this code.

Engineering checklist

Required

• scripts/check-spdx.sh passes (391 files; the two changed files carry
  CC-BY-SA-4.0)
• Conventional commit subject; SPDX headers correct
• No secrets, credentials, or data included
• bun run check — not run: this PR touches only docs/, and no
  frontend or Julia source changed
• scripts/check-format.sh / check-lint.sh — not run: both target
  source files, not prose; check-spdx.sh, which does cover .md, passes
• No application-logic changes hidden inside a docs PR — documentation only

As applicable

• CHANGELOG.md — not updated: documentation-only, no user-visible
  behaviour change
• docs/testing/coverage.md — not updated: no test coverage moved

Testing

Documentation only; no code path changed. Verification performed:

• git merge-base 4a848da origin/main → no merge base (confirmed rewrite)
• byte-identity of the four unchanged audited files, by md5 of
  git show 4a848da:<f> vs git show origin/main:<f>
• each re-located citation anchored on the content of the cited line
  (e.g. mean_first_i = mean(log_col[1:i]), is_dangerous = diagnostics.is_dangerous), not on a blind offset
• an automated pass asserting every Execution.jl: / estimation.jl: /
  ilr_basis.jl: / analysis.jl: / provenance.jl: / benchmark.jl:
  citation in both documents points at a line that exists in the current tree
• bash scripts/check-spdx.sh → OK

Note for the reviewer

CI will not report on this PR. Every CI workflow run since 2026-09-25 has
been startup_failure with zero jobs (gh api …/jobs → {"total_count":0});
GitHub's own verdict is "This run likely failed because of a workflow file
issue." That is finding B1 of the audit and it is not addressed here — it
is owner-side, and it is the first of the preconditions for the backend work
this audit was commissioned to scope.

This branch was also force-pushed: it previously carried the original audit
commit 78da9ea, whose entire patch content was already on main, so the
rebase onto 4c2c79e dropped it as "patch contents already upstream". Nothing
was discarded — the content is on main byte-for-byte.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 6520c13a-d2a0-442e-951d-3fae3650727a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}