[morluto]

Summary

Reject impossible Ghidra seed reports before reporting successful seed application. A report for one committed function could previously claim 100 functions created.

Problem and expected behavior

Successful Java seed processing classifies each admitted entry exactly once. The handshake accepted outcome totals unrelated to entry counts, and profile binding did not constrain classified outcomes by committed seed kind.

Change and scope

The shared report schema requires outcome conservation. Profile binding bounds classified function, code and label outcomes by their committed counts. Aggregate unmapped entries retain unknown kind. No Java producer or execution authority changes; maintainer scope decision is not applicable to this admission fix.

Contract and boundary impact

• Semantic owner: ghidraSeedReportSchema and ghidraSeedFailure; their existing handshake consumers inherit admission.
• CLI/MCP schemas, supported platforms, target selection, cleanup and package/generated metadata: unchanged.
• Evidence: impossible created-count claims are refused; completely unmapped and partially mapped producer reports remain admitted.

Evidence and regression coverage

Exact base a6e02657e6c1533f6e21e728570aeb8601b78368 admitted one entry with function_created:100 and projected “100 functions created.” Five new admission cases failed before the fix. Controls cover conserved reports, per-kind bounds and unknown unmapped kind. No issue is linked because this came from the authorized source audit.

Validation performed

• Standard npm run typecheck — passed on the complete isolated branch using the repository script and project configuration.
• Standalone tsc --project .cache/theme-typecheck.json --noEmit — passed, no emitted files.
• Source suites GhidraAnalysisSeeds, GhidraSessionValues, GhidraClientWire, GhidraDisabledAnalyzers — 77 passed on this isolated branch.
• Scoped formatting, lint and git diff --check — passed; existing parser-complexity lint warning remains.

Compatibility, safety, and release

Internal report admission tightens to the Java producer contract; no caller migration. Source/inert handshake evidence only; no real Ghidra or target/project execution. No generated or package metadata changes.

Author readiness

Human owner:

• I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
• I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
• I declare this PR ready for initial maintainer review.