refactor(go): state the degradation notice once per batch

A degraded analysis is a property of the whole analysis -- the approximation
is somewhere in the SDG and nothing can say which pairs ran through it -- so
it is one diagnostic under a key no pair claims, which is taint_verdict's own
mechanism for a diagnostic it cannot attribute. The verdict is unchanged
(nothing certified, batch not complete); filing per pair said the same thing
m*n times, measured at 6 identical copies on a 3x2 batch and 400 on a 40x10.

Refs #436

Author: sinha108

cldk/analysis/go/backend.py

@@ -551,10 +551,18 @@ def taint(
         dsts = [self.resolve_value(name, within=within) for name, within in sinks]
         cuts, cut_callables = resolve_sanitizers(sanitizers, resolve_callable=self.resolve_callable, edge_vars_in=self._edge_vars_in)
         rows, blocked = self._taint_walk(srcs, dsts, cuts=cuts, cut_callables=cut_callables, depth=depth, max_paths=max_paths)
-        # A degraded analysis cannot certify an absence (trap 4). The diagnostic is filed under
-        # *every* requested pair, not under one key of this method's devising: ``taint_verdict``
-        # reads the keys to decide ``exhausted``, and a key no requested pair claims would cost
-        # every pair its certification for want of anything able to attribute it.
+        # A degraded analysis cannot certify an absence (trap 4), and the condition is a property of
+        # the **whole analysis** rather than of any one pair: the approximation is somewhere in the
+        # SDG, and nothing here can say which pairs' routes ran through it.
+        #
+        # So it is filed under one key that **no requested pair claims**, which is exactly the
+        # mechanism :func:`~cldk.analysis.commons.graphs.taint_verdict` already has for a diagnostic
+        # it cannot attribute: an unclaimed key lands in ``unresolved`` and empties ``exhausted``
+        # for the batch. That is the intended outcome here, not a side effect — a batch-wide
+        # approximation must cost every pair its certification.
+        #
+        # Filing it per pair instead gives the identical verdict and m*n copies of one message (400
+        # of them on a 40x10 batch, measured), so the single key is the same answer said once.
         degraded = self.get_degraded()
         if degraded:
             codes = sorted({d.code for d in degraded})
@@ -563,11 +571,12 @@ def taint(
                 message=(
                     f"this analysis carries {len(degraded)} degradation marker(s) ({', '.join(codes)}), so part of the "
                     "SDG is approximated: a path returned here is a real may-flow, but the absence of one is not a "
-                    "proof. See get_degraded() for the affected packages and callables."
+                    "proof, and no pair in this batch is certified. See get_degraded() for the affected packages "
+                    "and callables."
                 ),
             )
-            per_pair = {(a.ref, b.ref): [note] for a in srcs for b in dsts}
-            blocked = {k: list(blocked.get(k, [])) + v for k, v in per_pair.items()} | {k: v for k, v in blocked.items() if k not in per_pair}
+            blocked = dict(blocked)
+            blocked[("", "")] = [note]
         return taint_verdict(sources, sinks, srcs, dsts, rows=rows, blocked=blocked, depth=depth, max_paths=max_paths)
 
     @abstractmethod

tests/analysis/go/test_go_dataflow.py

@@ -204,6 +204,28 @@ def test_trap4_a_degraded_analysis_cannot_certify_an_absence(backend, monkeypatc
     assert found.paths and found.exhausted == []
 
 
+def test_the_degradation_notice_is_stated_once_per_batch_not_once_per_pair(backend, monkeypatch):
+    """The condition is a property of the whole analysis — the approximation is somewhere in the
+    SDG and nothing can say which pairs ran through it — so it is one diagnostic, filed under a key
+    no pair claims, which is ``taint_verdict``'s own mechanism for a diagnostic it cannot attribute.
+
+    The verdict is identical either way; filing per pair would say the same thing m×n times (400
+    copies on a 40×10 batch), which buries the ledger a caller is meant to read.
+    """
+    from cldk.models.go import GoDegraded
+
+    monkeypatch.setattr(type(backend), "get_degraded", lambda self: [GoDegraded(code="no_vta")])
+    batch = backend.taint(
+        sources=[("id", "sqlRepo.Find"), ("id", "sqlRepo.SanitizedFind"), ("user", "sqlRepo.Count")],
+        sinks=[(SINK_ARG, SINK), ("db", SINK)],
+    )
+    assert len(batch.unresolved) == 1, "one batch-wide condition produced more than one diagnostic"
+    assert batch.unresolved[0].code == "analysis_degraded"
+    # The verdict is what matters, and it is the strict one: nothing certified, batch not complete.
+    assert batch.exhausted == [] and batch.complete is False
+    assert batch.paths, "the witnesses are still reported -- a degraded graph is not a refusal"
+
+
 # ======================================================================================
 # Addressing: the spellings spec §7 requires, and the ambiguities that must raise.
 # ======================================================================================