# Allowlist for scripts/check_ledger_chokepoint.py (D20 ledger chokepoint guard).
#
# Format: path:lineno:reason  (one per line; '#'-prefixed / blank lines ignored)
#
# Use sparingly — the allowlist is for documented pre-existing violations,
# not a general escape hatch. Every entry below states plainly whether it is
# a checker-precision artifact (not actually a D20 violation) or genuine
# technical debt (a real violation, tracked for a fix) — do NOT add a vague
# shared reason; a reader six months from now must be able to tell which is
# which without re-deriving it.
#
# STALENESS WARNING: this file is keyed on path:lineno. An unrelated edit
# that shifts line numbers in the target file silently detaches the entry —
# _load_allowlist has no fuzzy match, so a stale lineno just stops matching
# and the checker starts re-flagging the (now differently-numbered) site on
# the next run. That is the correct failure mode (the gate re-fires rather
# than staying silently green), but it means an entry can go stale without
# anyone touching this file. Re-verify line numbers here whenever the target
# file changes.
#
# Paths here are repo-root-relative (matched via _allowlist_key(), which
# prefers Path.relative_to(_REPO_ROOT) and falls back to an absolute path
# only for out-of-repo scans like a test's tmp_path fixture). This is what
# makes the entries survive a checkout at a different absolute location —
# including a git worktree of this same repo, whose absolute path prefix
# differs from the main checkout. Do NOT hand-author an absolute-path entry
# here; it will only ever match the one machine+checkout it was written on.

# --- checker-precision artifact: metadata read, not ledger data access ---
yadgar/backend/admin_exec/adr_seed.py:364:reads the `adr` table's AUTO_INCREMENT counter out of information_schema.TABLES (INFORMATION_SCHEMA is MariaDB's metadata catalog, not the ledger). The table actually queried is information_schema.TABLES; `adr` appears only as a quoted string VALUE in a WHERE predicate (TABLE_NAME = 'adr'), not as SQL FROM/INTO target. This is a metadata read about the ledger table, not an access to its rows — the checker's table-name regex cannot distinguish "adr" as a queried table from "adr" as a filter literal. Pre-existing. Tracked as ledger task 201.

# --- genuine D20 violation: real ledger data access outside MariaStorageEngine ---
yadgar/backend/admin_exec/seed_adr_tier_subsystem.py:164:GENUINE D20 violation — a direct `UPDATE adr SET tier = :tier, subsystem = :subsystem WHERE id = :id` against storage._engine (behind a `# type: ignore[attr-defined]`), bypassing MariaStorageEngine entirely. This is real technical debt, not a checker artifact: the row write must be routed through a MariaStorageEngine method. Pre-existing. Tracked as ledger task 202.
