docs(FIX-P5-011): CHANGELOG EC-24 note, CLAUDE.md tree accuracy, field.rs sanitization-scope rustdoc (F5 pass-10)

[Zious11]

Summary

Doc-only F5 pass-10 fixes (cycle-014, D-405). Files: CHANGELOG.md, CLAUDE.md, src/cli/field.rs (rustdoc only).

Finding	Change
N1	CHANGELOG Cf entry cites EC-18..EC-24 and lists the EC-24 kept characters
N2	CLAUDE.md tree: component.rs ~1,800 LOC (+rename)
CR10-001	CLAUDE.md tree comments for user.rs, api.rs, field_resolve.rs, output.rs
CR10-002	field.rs builder rustdoc states only field_id is sanitized

P10-001's main fix is spec-side (BC-X.14.001 Invariant 3 documents the deliberate field-resolver divergence, D-405). Feature request: #904.

Risk

No code behavior change. Blast radius: documentation only.

Demo evidence

N/A (doc-only).

Security review

Skipped: doc-only change.

[Zious11]

Claim audit: PR #905 (head de007141c80130b3970b499bc4fdea987f9395c2)

Verdict: READY. No BLOCKING findings. I checked every changed sentence in git diff b2b8ee3b..HEAD against the code at this head. Every claim holds. Three non-blocking NITs are listed below.

What I checked

CHANGELOG.md, EC-24 note and the EC-18..EC-24 citation

• src/output.rs::classify_default_char (L568-583) drops these: C0, DEL, C1, U+2028/2029, is_cf (the CF_RANGES table at L500, 21 ranges / 170 code points, pinned by the conformance test), U+034F, the Hangul fillers U+115F/1160/3164/FFA0, and the tag block E0000-E007F. Everything else is kept. So "Cf plus a named set of extras" is accurate.
• The following are in no drop branch, so they are kept:
  • U+2800 (So)
  • U+17B4/17B5 (Mn)
  • U+FFFC (So)
  • U+00A0 and U+3000 (Zs). The other Zs points are kept as well: U+200A, U+202F and U+205F appear in the neighbors test, and U+1680 and U+2000-2009 hit no drop branch.
  • U+2065, which is unassigned and falls between the CF ranges 0x2060-0x2064 and 0x2066-0x206F.
• Test coverage of the kept set:
  • test_bc_7_1_006_sanitize_keeps_blank_rendering_non_cf_characters (L1840-1851, tagged "SEC5-001 / EC-24 ... D-400") asserts that 2800, 17B4, 17B5, FFFC, 00A0 and 3000 are kept by all three sanitizers.
  • test_bc_7_1_006_sanitize_cf_range_neighbors_kept asserts that U+2065 is kept.
• The citation range checks out. The test comments carry EC-18/19/20 (L1617), EC-21/22/23 (L1743) and EC-24 (L1840).
• "Category-based, not an open-ended list": this matches the EC-24 test's rustdoc ("the policy is category-based (Cf + named extras)").

CLAUDE.md tree comments

• component.rs: wc -l gives 1,796, so "~1,800" is accurate. ComponentSubcommand::Rename is dispatched at L105, so "rename" is accurate. This also matches the existing Known Size Deviations entry.
• user.rs: handle_list resolves its project through resolve_user_list_project, which wraps config.project_key(cli_project). Both handle_view and the list rows render through output::StyledCell, and active_cell returns a colored StyledCell. Accurate. Dropping "thin wrapper" is also more accurate than before, since the file is 559 LOC with its own resolver.
• api.rs: the module doc and handle_api(method, ..., header, query_param) cover method override, body (inline/file/stdin), headers and -q/--query-param (parse_query_param, append_query_params). Accurate.
• field_resolve.rs: create.rs imports field_resolve and calls detect_flag_field_overlap, CREATE_D2_GOVERNED_KEYS and resolve_edit_fields (L169/181/366). "Shared by edit and create" is accurate.
• output.rs: it defines StyledCell (L44). render_table_with_styles_inner gates fg on SHOULD_COLORIZE.should_colorize() (L124-131), and the file holds sanitize_table_cell, sanitize_terminal_text and sanitize_terminal_line. Accurate.

src/cli/field.rs, builder rustdoc

• field_not_available_for_type_msg: only field_id goes through sanitize_terminal_line. type_name is the user's --type value and is echoed verbatim; it is not the server-resolved name. project_key comes from resolve_m2_project, which means the flag or config. So "user/config echoes" is accurate.
• field_not_available_on_request_type_msg: only field_id is sanitized. rt_query is the raw --request-type value, not the resolved RT name. Accurate.
• field_not_on_edit_screen_msg: only field_id is sanitized. issue_key is the raw --issue value. Accurate.

Findings (all non-blocking)

#	Severity	File:line	Finding	Suggestion
1	NIT	CHANGELOG.md:312-319	U+2065 is listed under the EC-24 residual, but the EC-24 KEEP-pin test (src/output.rs:1845) does not include it. Its keep behavior is pinned only by the neighbors test (src/output.rs test_bc_7_1_006_sanitize_cf_range_neighbors_kept). The claim is true, but the EC-24 tag is not traceable to the EC-24 test.	Optionally add 0x2065 to the EC-24 test's array so the test matches the documented set.
2	NIT	CHANGELOG.md:313	"human decision D-400/D-401": the code cites only D-400 (src/output.rs:1840). D-401 is not referenced anywhere in src/, so it can't be checked from the diff.	Confirm that D-401 exists and is relevant, or cite D-400 alone.
3	NIT	CHANGELOG.md:299	The header calls the extras "a named set of blank-rendering fillers". That set also contains the combining grapheme joiner (U+034F) and the non-Cf, unassigned tag-block code points. Both are invisible rather than "fillers" in the strict sense.	Optionally reword to "a named set of invisible/blank-rendering extras".

Not verified (information wall): the field.rs rustdoc's statement that these echoes are "documented residuals (BC-7.1.006 Canonical Sink Inventory)" points to a spec file that is not in this repo diff. The behavioral part of the claim (which values are or are not sanitized) is verified above.

Doc-only change; no code paths are touched. Demo evidence does not apply.