It was reporting and shrugging. A definite leak, a read past the end of an allocation or a branch on uninitialised memory now fails the build on the push that introduces it, which is the only point at which it is cheap to fix. The six findings the job had on its first run were fixed rather than excused, so the gate closes on a clean tree instead of on a backlog. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>