Fix: the last entry in a mapping file swallowed the file's closing tables (22 junk mappings, 22 junk registry controls)

[emmanuelgjr]

Plan ID: — (data integrity; found while scoping #35) Ticket: — Wave: —
Constraints honored:

• C4: only rows parsed from non-mapping tables are removed. No authored mapping, relationship or severity changes.
• C2: docs/data.js, backlinks.js and frameworks-registry.js are regenerated, and one hard-coded number in the About paragraph is updated. Approval needed.
• C1: the About paragraph edit is the mapping count only; attribution untouched.

#37 has merged; this PR now targets main directly.

The bug

extractSection() ended an entry's section only at the next ### heading. The last entry in each mapping file therefore ran on through the file's ## closing sections: the summary matrix, references, changelog. Two kinds of non-mapping data got stored:

1. 22 mapping rows on DSGAI21, all from dsgai-2026/DSGAI_AIUC1.md and dsgai-2026/DSGAI_NHI.md:

Framework	control_id values stored as controls
AIUC-1 (9)	Primary DSGAI entries, DSGAI02, DSGAI03, DSGAI06, …, DSGAI05, DSGAI20, DSGAI12, DSGAI19, DSGAI20, … Date, 2026-03-27
OWASP NHI Top 10 (13)	DSGAI entries most affected, DSGAI21, DSGAI03, DSGAI06, DSGAI16, … Date, 2026-03-27

Plus the 352 backlink lines built from them.

2. Cross-references on the three last-in-file entries. LLM10 claimed LLM01–LLM09, ASI10 claimed ASI01–ASI09, and DSGAI21 claimed 18 extra DSGAI ids, all mentioned only in the closing summary. No other entry changes, which fits the cause.

The same 22 junk rows had been extracted into the registries as kind: control items: 9 in aiuc-1.json, 13 in owasp-nhi.json. They're removed here where no mapping references them. inventory_completeness.included follows, and matches what inventory-completeness.js computes. Each registry gets a changelog entry.

Impact

Measured against main after #37, #94 (AISVS 1.0, 26th framework) and #96:

	main	this PR
mappings	3,803	3,781 (-0.6%)
DSGAI-2026 mappings	1,788	1,766
controls (kind: control)	1,563	1,541 (-1.4%)
registry items	1,705	1,683

Both moves are under the playbook's 2% escalation threshold and fully explained above. Webapp: the About paragraph's hard-coded count becomes "26 industry frameworks with 3,781 individual control mappings" (was 3,803 on main) (C2). The first version of this PR said 3,497 → 3,475; #94 has since added a framework, so the merge commit recomputed it from the data.

Guard

New test in scripts/generate.test.mjs: no mapping or registry control_id may be shaped like a changelog or summary cell (Date, Version, an ISO date, a list of entry ids, "… entries most affected"). It reports 44 such rows/items against the previous data and 0 now.

Found, not fixed

• The NHI registry now has no clean NHI-1…NHI-10 items. The junk items were the only ones carrying those titles, under ids like DSGAI21. Proper NHI ids arrive with Swapped control_id / control_name: 576 mapping rows hold prose where an identifier belongs #35; details are on that issue.
• scripts/inventory-completeness.js reverts a fix(ACC-02): version currency — update what is safe, flag what is not #23 change Corrected in 767982d: I had this backwards. fix(ACC-02): version currency — update what is safe, flag what is not #23 moved SP 800-218A's url to the final DOI, but never reran the script, so inventory_completeness.source kept the old csrc URL. The script's source = url was correcting that, and my first commit restored the stale value. 767982d applies the script's output. It changes that one line only, and both URLs resolve to the final publication.

Deliberately NOT changed

• The Swapped control_id / control_name: 576 mapping rows hold prose where an identifier belongs #35 id/name swap. It needs per-framework decisions, now written up on Swapped control_id / control_name: 576 mapping rows hold prose where an identifier belongs #35.
• The prose-id fence baselines in exports.test.mjs: none of the removed rows were counted in them.

Verify

$ node scripts/validate.js     0 error(s), 84 warning(s), 312 passed  (before: same)
$ npm run stats:check          ✓ current
$ npm test                     52/52 ×2  (was 51; +1 guard)
$ node scripts/generate.js && git diff --exit-code (CI path list)  → clean after commit
diff of data/entries by (framework, control_id): 22 removed, 0 added, all on DSGAI21

🤖 Generated with Claude Code

https://claude.ai/code/session_014SfR2YzLxRH54DAVzDk8gR