fix(p1,p0): restore the pre-P1 range contract for two callers; docs link and maintainer paths

The full suite after the replay found regressions from 062a7b7 and 94e96c6:
- catalog_gen and candidates.labeled_spans still unpacked 3-tuples and expected None on a parser
  rejection; source.ranges returns FunctionRange (4 fields, module entry first) and raises ValueError.
- ranges_from_ir passed the language to declarator_name, so the repo-facts declaration table named a
  callback call (exec(..., function () {) as a function; the pre-P1 call had no language.
- the catalog_gen fail-loud test blocked the old module name.
- docs: a renumbered examples anchor, and two .kiro paths in the public threat model.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

benchmarks/pairs/catalog_gen.py

@@ -269,10 +269,11 @@ def _language(recipe: dict[str, object]) -> str:
 
 
 def _ranges(path: Path, language: str) -> tuple[tuple[str, int, int], ...] | None:
-    ranges = source_ranges(str(path), path.read_text(errors="ignore"), language)
+    try:
-    if ranges is None:
+        ranges = source_ranges(str(path), path.read_text(errors="ignore"), language)
+    except ValueError:
         return None  # parser rejected the excerpt; a regex label would not scope
-    return tuple(r for r in ranges if r[0] != ANON_FUNCTION)
+    return tuple((r.name, r.start, r.end) for r in ranges if r.kind == "function" and r.name != ANON_FUNCTION)
 
 
 def _innermost(ranges: tuple[tuple[str, int, int], ...], line: int) -> str | None:

docs/deployment.md

@@ -148,7 +148,7 @@ files live in `~/.cache/ousast/ax-src/` (`OUSAST_AX_SRC`).
     - An admin must set up the bucket once, as [RustFS setup](rustfs.md) describes. The store verifies
       it at every start.
 
-5. **Run a real Run**, as in [Examples](examples.md#7-running-the-agentic-plane): `ousast plane run
+5. **Run a real Run**, as in [Examples](examples.md#6-running-the-agentic-plane): `ousast plane run
     plane/runs/validation-46.yaml`, then `status` and `remember`.
 
 6. **Tear down** with `ops/ax/down.sh`. It deletes the cluster and its registry.

docs/threat-model.md

@@ -12,8 +12,8 @@ It also lists the controls that keep a scan safe to run in CI and safe to share.
     control flow and data flow) with Joern. It uses `joern-parse`, a parser, not a build.
     Standard mode may send code excerpts to the configured model.
   - No scan mode executes target-derived code any more: the deep-mode REGRESS stage was retired on 2026-10-13
-    and is recorded as `regress_retired`. Execution happens only in the search-with-proof arm's sandbox,
+    and is recorded as `regress_retired`. Execution happens only in the search-with-proof arm's sandbox
-    described in `.kiro/specs/search-with-proof/`.
+    (`src/openultrasast/search/_sandbox.py`).
 - **The ruleset and CWE policy are trusted, governed data.** They change
   through reviewed commits.
 - **Provider credentials are the operator's.** The core install (PyYAML only) makes no network
@@ -94,4 +94,4 @@ internal hunter tools. No tool accepts a free-form command argument.
 
 Retired on 2026-10-13 with the REGRESS stage. The search-with-proof arm runs demos under bubblewrap with
 seccomp, no network unless the oracle needs a namespace, and differential runs against owned canaries;
-see `src/openultrasast/search/_sandbox.py` and `.kiro/specs/search-with-proof/`.
+see `src/openultrasast/search/_sandbox.py`.

src/openultrasast/model/candidates.py

@@ -379,7 +379,7 @@ def labeled_spans(
     wanted.discard("")
     found: list[tuple[str, int, int]] = []
     for path, entries in ranges.items():
-        for name, start, end in entries:
+        for name, start, end, *_kind in entries:
             if name in wanted:
                 found.append((path, start, end))
     return tuple(found)

src/openultrasast/source.py

@@ -238,7 +238,7 @@ def ranges_from_ir(ir: FileIR, text: str) -> tuple[FunctionRange, ...]:
         if fn.name == MODULE_FUNCTION:
             continue
         line = lines[fn.start_line - 1] if 0 < fn.start_line <= len(lines) else ""
-        declared = declarator_name(line, ir.language)
+        declared = declarator_name(line)  # the declaration tables would name a callback call (`exec(..., function () {`)
         name = declared or fn.name
         if (
             name in RESERVED_FUNCTION_LABELS

tests/test_pair_harvest.py

@@ -360,7 +360,7 @@ def test_catalog_gen_fails_loud_without_the_package_and_refuses_to_prune_an_empt
         gen["generate"]("s", prune=True)
     assert pair.is_dir()
     # The package import must fail loud, never degrade into "no named function".
-    monkeypatch.setitem(sys.modules, "openultrasast.semantic.functions", None)
+    monkeypatch.setitem(sys.modules, "openultrasast.source", None)
     with pytest.raises((SystemExit, ImportError)):
         runpy.run_path(str(Path("benchmarks/pairs/catalog_gen.py")), run_name="catalog_gen_lib_blocked")