docs(flow-aware-ranking): the three decisions -- 4.0.625 as baseline, vendored out, tests not product

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

.kiro/specs/flow-aware-ranking/brief.md

@@ -209,7 +209,12 @@ A phase that cannot show that is not an improvement, it is a story.
   the 14 test-file regions ahead of the CVE included -- counts as product. Knowing that `tests/`,
   `test-*.php` and `*Test.php` are not product is ecosystem convention, which is to say policy: it
   belongs in a `[[layout]]` fact table per ecosystem, approved like the `[[dispatch]]` facts were, not in
-  a constant here. Proposed, not done. After that, within-tier order is phase 3's -- a model reading the code the ties cannot --
+  a constant here. **Approved and done 2026-09-11** (b821ac6), with the maintainer's second decision in
+  the same row: vendored trees are OUT -- of the targets and of the graph -- because a bundled library is
+  a separate unit, analysed as one or not at all ("divide and rule"; libraries ship as their own DLLs).
+  Test paths stay in scope and are not product. Both re-measured; and the baseline Joern is 4.0.625 from
+  here (the closure exclusion gated off, both plugins building clean), measured separately first so the
+  two changes are not confounded. After that, within-tier order is phase 3's -- a model reading the code the ties cannot --
   or one more exact path fact (`distance`), and the gate stays unmet until one of them moves it.
 
 - **Phase 3 — the LLM ranker.** Same evidence, ordered by a model. Gate: beats phase 2 leave-one-repository-out.