Closes #432. Closes #435.

#432. A CycloneDX document with "description":"\ud800" (an escaped unpaired UTF-16 surrogate) was refused as ErrAmbiguousJSON, although ADR-0039 claimed only two classes, and the advice pointed the user at a repeated member that is not there.

The decision, on the specification's text. CycloneDX and SPDX JSON are defined over JSON Schema draft-07, which defers to RFC 7159/8259. RFC 8259 §8.2: a JSON text is interoperable only "when all the strings represented in a JSON text are composed entirely of Unicode characters (however escaped)"; the grammar "allows member names and string values to contain bit sequences that cannot encode Unicode characters; for example, "\uDEAD""; and "the behavior of software that receives JSON texts containing such values is unpredictable". A document its own format says readers will not agree on does not have one reading, so Bomly keeps refusing it and names it as a third class. The spec text is quoted beside the code.

Mechanics (classifyStrictRefusal in internal/sbom/strict.go): decided by what the readers disagree about, never by matching a message. json.Valid still separates malformed; errors.Is(…, jsontext.ErrDuplicateName) says whether a name was repeated; a second scan with AllowDuplicateNames(true) and AllowInvalidUTF8(true) — which retains no names and copies no values, so none of the memory shapes the bounds exist for — confirms text validity was the only objection; utf8.Valid on the raw bytes then separates invalid bytes from an escape that names no character. All on the error path. The main decoder line is unchanged (TestStrictPreflightReadsInPlace still pins bytes.NewBuffer).

User-facing: the detector's advice now says "emits each object member once and writes every string as Unicode text, without unpaired surrogate escapes", and each refusal names its class before the library's location.

#435: the hand-instrumented preflight stays (option 1). The residual — one oversized member name held once by the decoder, at most 1× an input already capped and resident — is the floor for any reader; the durable close is an upstream jsontext token-size option. Recorded in ADR-0039's dated amendment together with the third class.

Tests: TestIngestRejectsEscapedLoneSurrogates, TestStrictIngestAcceptsEscapedCharacters (a paired surrogate and a BMP escape still import), TestStrictRefusalsNameTheirClass (table over the three classes); the fuzz target's determinism check now covers all four sentinels.

Docs: ADR-0039 amendment, docs/SBOM.md third bullet and corrected advice, dev-docs/SECURITY_ASSURANCE.md row and evidence.

make verify passes.

🤖 Generated with Claude Code