# EXAMPLE 1 — OUTPUT `patch-set-2026-08-25.md` --- ## 1. HEADER | | | |---|---| | Findings supplied | 5 | | Patched | 4 | | Unresolved | 1 | | Batch scope | full — 5 findings, under the 15 cap | | Route | FULL (structured Finding Cards + code) | | Constraints applied | none supplied — followed existing code conventions | --- ## 2. CLEAN PATCH RATE ``` 0.75 [#########---] target 0.80 ``` 3 of 4 patches carry NONE side effects. Below the 0.80 target by one patch; the single side effect is named in PATCH #2 and is a deliberate contract change, not a defect. Proceeding under the 0.5–0.8 band after re-examining the one side effect. --- ## 3. PATCHES ``` ── PATCH #1 | RESOLVES FINDING #1 (CRITICAL) ────────────── Location: fetch_rows, line 13 Change: - before: q = "SELECT id, total, status FROM reports WHERE user_id = %s AND status = '%s'" % (user_id, status) rows = c.execute(q).fetchall() + after: q = "SELECT id, total, status FROM reports WHERE user_id = ? AND status = ?" rows = c.execute(q, (user_id, status)).fetchall() Reasoning: sqlite3 parameter binding removes the interpolation entirely. The smallest change that resolves the finding — no helper, no new function, no signature change. Verifies: grep the module for `%` and `.format(` inside any string passed to execute(); this line no longer matches. Confidence: HIGH Side effects: NONE ``` ``` ── PATCH #2 | RESOLVES FINDING #2 (HIGH) ────────────────── Location: summarize, line 22 Change: - before: avg = total / len(rows) + after: avg = total / len(rows) if rows else 0 Reasoning: guards the division at the point of failure. An early return would duplicate the dict literal; the inline guard is smaller. Verifies: call summarize() for a user with no rows in the requested status — returns {"count": 0, "total": 0, "avg": 0} instead of raising. Confidence: HIGH Side effects: the empty case now returns avg 0 instead of raising ZeroDivisionError. Any caller relying on the exception to detect "no data" will stop seeing it. Callers testing count == 0 are unaffected. ``` ``` ── PATCH #3 | RESOLVES FINDING #3 (MEDIUM) ──────────────── Location: write_report, lines 27-29 Change: - before: f = open(path, "w") f.write(str(data)) f.close() + after: with open(path, "w") as f: f.write(str(data)) Reasoning: the context manager closes on the exception path, which is exactly what the finding cites. Three lines become two. Verifies: no bare open( remains in the module; the write is inside a with block. Confidence: HIGH Side effects: NONE ``` ``` ── PATCH #4 | RESOLVES FINDING #4 (HIGH) ────────────────── Location: purge_old, lines 34-36 Change: - before: c.execute("DELETE FROM reports WHERE created_at < date('now', '-%d days')" % days) return True + after: c.execute( "DELETE FROM reports WHERE created_at < date('now', ?)", ("-%d days" % days,), ) c.commit() return True Reasoning: two defects in one finding, so one patch: the interval string is bound as a parameter, and the missing commit is added. Splitting them would leave the module in a state where the delete is parameterised but still discarded. Verifies: call purge_old(30), reopen the connection, confirm the rows are gone. Statically: the execute() call has no % formatting and a commit() follows it. Confidence: MEDIUM ⚠️ Assumes sqlite3's documented behaviour that date('now', ?) accepts the modifier as a bound parameter, and that the connection is not in autocommit mode (isolation_level is left at its default in _conn(), so it is not). Side effects: NONE Tag: [DEPENDENCY-QUESTIONED] The card declares BLOCKED BY #1 and expects #1's "parameterisation helper" to be reused here. No such helper exists or is created — #1's fix is local to fetch_rows and shares no code with purge_old. The two are INDEPENDENT in the supplied code. Following the code. ``` --- ## 4. APPLY ORDER 1. **PATCH #1** — INDEPENDENT 2. **PATCH #2** — INDEPENDENT 3. **PATCH #3** — INDEPENDENT 4. **PATCH #4** — INDEPENDENT (declared BLOCKED BY #1; see `[DEPENDENCY-QUESTIONED]`) All four touch separate functions. Any order applies cleanly; the order above matches descending severity. --- ## 5. INTRODUCED RISK **PATCH #2 — convention / correctness, LOW severity.** Returning `avg: 0` for an empty set is indistinguishable from a genuine average of zero. The finding asked for the crash to stop, and it does. If callers must tell the two apart, `None` is the alternative — that is a contract decision, not a defect in this patch. No other patch introduces a new review-category risk. --- ## 6. UNRESOLVED **FINDING #5 — connection lifecycle.** `[REQUIRES-ARCHITECTURE-CHANGE]` `_conn()` is called by `fetch_rows` and `purge_old`, each opening a connection that is never closed. A minimal patch does not exist: closing inside each caller changes their control flow, and the finding itself asks for a context-managed layer or a pool — either rewrites `_conn()` and every call site. That is four functions and a new resource contract, which exceeds the finding's own scope as a patch. **What would unblock it:** a decision on which shape you want — a `@contextmanager` around `_conn()`, or a module-level connection with explicit lifecycle — plus confirmation of whether this module runs single-threaded. `sqlite3` connections are not shareable across threads by default, and that changes the answer. --- ## 7. RESIDUAL SCOPE > This patch set covers the supplied findings and code only. It does not cover > behaviour under production data or load, findings absent from the input, > verification of anything tagged `[REQUIRES STAGING VALIDATION]`, architecture-level > restructuring, or test authorship. **No patch here has been executed or tested** — > each is constructed to resolve its cited finding, which is a different claim. > Patches tagged `[ASSUMPTION]` need confirmation before merge. Any > `[CONSTRAINT-CONFLICT]` patch needs a human decision.