fix: all three critical findings and three of nine high

[Lumi-node]

From the four-lane review of a4d7dae. Full report: https://claude.ai/code/artifact/8b1df379-403b-4c2c-a866-29c541c25a45

Every fix was confirmed to fail against the unfixed code, not merely to pass against the fixed one.

Critical

The diagram subsystem was unreachable by any user. catalog diagram imported diagram_repo from drydock.diagram.mermaid — a function that had never existed in any commit — behind an except ImportError that reported "diagram module not available", blaming a module that was present and importable the whole time. All four generators were unit-tested, correct, and reachable by nothing.

diagram_repo is now written, and drydock diagram <path> exists as a top-level command — docs/concepts/diagrams.md had documented it across 290 lines, and drawing a picture of a directory shouldn't require ingesting it into a catalog first. That makes component_diagram reachable for the first time. All four kinds validated through mermaid-cli, not a regex. --kind now validates against one list shared by help text, error message and dispatch; the markdown branch goes through _emit so -o is no longer accepted and dropped.

The suite's only cross-cutting invariant was switched off. test_all_import_refs_no_spaces asserts a property across every parser and file, and its docstring says it "would have caught Bug B". It couldn't — the assertion sat inside except Exception: pass, and AssertionError is an Exception. Reintroducing the literal Bug B shape now fails the suite; before this it passed.

docs/concepts/diagrams.md documented a command that didn't exist. Every command on the page now runs.

High

architecture layer count flipped between identical runs (9 8 8 9 9 9 9 9)	_depths() iterates sorted — the memoized cycle break no longer depends on set order
boundaries bridge membership varied with hash seed	Sorted iteration; ordering extracted to rank_bridges with a total key
git found zero stable files in a stable repo	Absolute thresholds against a percentile-derived busy line; new moderate category closes the dead zone. Now 186 stable of 198, summing exactly

The git one is worth spelling out: change_ratio = changes / max_changes was purely relative, so with a 90-day maximum of 3 changes a file touched once scored 0.33, cleared the > 0.3 bar and was reported as "high changes, concentrated risk" — 87 files on this repo, from the analyzer whose entire purpose is finding stable extraction candidates.

On the tests

Two of the new regression tests were vacuous on first writing and passed against the unfixed code. Both were rewritten until they actually failed:

• The determinism tests had to move into subprocesses with varying PYTHONHASHSEED — set order is stable within a single process, so an in-process loop cannot observe hash-order nondeterminism at all.
• The depths fixture had to become dense enough that neighbour order could vary; a ring where each node has one neighbour has no order to vary.
• The bridge test never reproduced synthetically, so rather than ship something that couldn't fail, the ordering was extracted into rank_bridges and tested directly under shuffling.

Verification

549 tests pass on 3.10–3.13. Container smoke 14/14 plus the new diagram command. No new lint findings.

Six high findings remain, documented with repros in SESSIONS/2026-08-22.md.