Reports
Analyses of one part of the system, with the evidence they were drawn from and the limits of that evidence.
A report answers a question somebody asked once — where the slow queries are, what a dependency actually costs, why a build takes eleven minutes. It is dated in its title and left alone afterwards.
Reports and audits are not the same thing
An audit walks a checklist and grades what it finds. A report starts from a question with no checklist behind it, and the shape of the answer is not known until the work is done.
The practical difference is what happens when the code moves on. An audit's
value is the comparison against today, so it is kept unchanged. A report's value
is the recommendations, so once they are acted on it is mostly history — the
Findings section still tells you why the code looks the way it does.
What every report owes the reader
Where the evidence came from. Counted, not asserted: file and line for anything specific, and the command or query behind the numbers. A finding nobody can re-derive is an opinion.
What the evidence cannot support. Static analysis cannot tell you which query is actually slow, only which one is shaped badly. A report that reasons from source rather than from measurements says so, in the report, not in the covering message — the message is gone by the time somebody reads this.
Hosting
Where the deployables actually run — one Hetzner box, Docker Compose behind Caddy, and no cloud platform in the path.
Go API query analysis, measured
Running the checks the source-read report asked for against production. Four of its findings were wrong, one of its fixes was broken, and the two costs that matter are not in it.