spec(pre-push-safety-net): reserve the independent population v2 (17 cases, unscanned)

v1 was evaluated and then used to retune the analyzer. A retune can only be
qualified on a population that did not inform it.

The candidates came from web research alone (research-2026-09-26.md):
- advisories were taken newest-first per language under fixed criteria, never by
  how easy they look;
- 261 advisories were examined and 224 rejected, each with a reason;
- every SHA pair was verified through the GitHub API;
- no clone and no scan.
The maintainer selected the rule-based "balanced" set: 5 Python, 6 JS/TS, and 6 PHP
of which 4 are WordPress plugins; 10 injection, 6 destination and 1 config.
Each case declares the advisory's sink sites before any scan, for protocol v2.

freeze.py takes --population and writes freeze-vN.json. The reservation tests now
cover every population-v*.toml.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

tests/test_independent_population.py

@@ -12,18 +12,22 @@ import re
 import tomllib
 from pathlib import Path
 
+import pytest
+
 ROOT = Path(__file__).resolve().parents[1]
-POPULATION = ROOT / "benchmarks" / "independent" / "population-v1.toml"
+POPULATIONS = sorted((ROOT / "benchmarks" / "independent").glob("population-v*.toml"))
+POPULATION = POPULATIONS[0]
 FAMILIES = {"injection", "untrusted_destination", "config_secrets"}
 SHA = re.compile(r"[0-9a-f]{40}")
 
 
-def _population() -> dict:
-    return tomllib.loads(POPULATION.read_text())
+def _population(path: Path = POPULATION) -> dict:
+    return tomllib.loads(path.read_text())
 
 
-def test_the_reservation_is_well_formed() -> None:
-    data = _population()
+@pytest.mark.parametrize("path", POPULATIONS, ids=lambda p: p.stem)
+def test_the_reservation_is_well_formed(path: Path) -> None:
+    data = _population(path)
     assert data["status"] in {"reserved-unscanned", "frozen"}
     cases = data["case"]
     ids = [case["id"] for case in cases]
@@ -40,21 +44,22 @@ def test_the_reservation_is_well_formed() -> None:
         for case in cases:
             benign = case.get("benign") or {}
             assert SHA.fullmatch(benign.get("base", "")) and SHA.fullmatch(benign.get("tip", "")), case["id"]
-        assert (POPULATION.parent / data["freeze_record"]).is_file()
+        assert (path.parent / data["freeze_record"]).is_file()
     languages = {case["language"] for case in cases}
     assert {"php", "python"} <= languages and languages & {"javascript", "typescript"}
 
 
-def test_a_multi_language_repository_is_reserved() -> None:
+@pytest.mark.parametrize("path", POPULATIONS, ids=lambda p: p.stem)
+def test_a_multi_language_repository_is_reserved(path: Path) -> None:
     """The declared v0.1 target is a WordPress plugin: PHP plus its admin JavaScript (task 13.4)."""
-    data = _population()
+    data = _population(path)
     by_id = {case["id"]: case for case in data["case"]}
     members = data["multi_language_members"]
     assert members and all(by_id[m]["language"] == "php" and "javascript" in by_id[m].get("also", []) for m in members)
 
 
 def test_no_reserved_repository_is_referenced_by_the_development_tree() -> None:
-    reserved = {case["repo"].rstrip("/").lower() for case in _population()["case"]}
+    reserved = {case["repo"].rstrip("/").lower() for path in POPULATIONS for case in _population(path)["case"]}
     names = {url.rsplit("/", 2)[-2] + "/" + url.rsplit("/", 1)[-1] for url in reserved}
     offenders = []
     for top in ("benchmarks", "src", "tests"):