phpcpd-next relicensed to MIT after its provenance gate counted zero inherited headers

bench/check-provenance.php opens every file in src/ and counts the copyright holders each header names ^[4]. It establishes that no inherited attribution string is left in that directory, and nothing about whether the implementation under the header is new.

The rewrite claim is separate. According to the release post, every file was rewritten from its specification, and each was proved to emit byte-identical output before its attribution changed ^[6]. That comparison is per file, and it ran before the header changed, so the set of files with inherited headers was also the set of files not yet rewritten.

The licence move is not a fix for a violation. The post says attribution alone satisfied BSD-3-Clause and the package was always correct as it stood ^[7]. It describes the relicence as the completion of a plan the project set itself: a tree with no inherited surface left, relicensable in one commit, with the inventory as its evidence ^[9].

Two engines run without flags, Rabin-Karp for exact copies and a SourcererCC token bag for reordered ones ^[10]. The post also lists dead-code detection as a second mode, confidence ranking, an acknowledgment ledger, SARIF output and corpus triage ^[14]. It ties the version number to the size of the change: "It is a major version because a 1.x number would have been a lie about how much moved" ^[15].

The sample Laravel run is where I would slow down. It reports one clone, 30 duplicated lines across two files, six scanned files, 19 excludes, and 33.33% of 90 scanned lines duplicated ^[16]. 30 divided by 90 is 33.33%, so the percentage counts the clone once, while the two copies together account for 60 of those 90 lines ^[17]. A threshold carried over from another tool may be measuring the other quantity. The run took 0.008 seconds and 4.00 MB, six files at 706.9 files per second ^[18]. Six files is not a population. That rate transfers only if your files resemble those six in size and your excludes leave a comparable share of the tree in scope.

The preset that produced those 19 excludes applies itself, prints that it did, and names the flag that disables it ^[20]. It requires two independent signals: laravel/framework in require, plus a structural marker such as artisan or bootstrap/app.php. require-dev is ignored on the grounds that a package which tests against Laravel is not an application built on it ^[19]. Each exclusion encodes a specific failure. Blade templates go because *.blade.php is not analysable PHP source. The database/migrations directory goes because up() and down() boilerplate is duplicate by design. _ide_helper.php and the generated caches go because a generated file is a dense index of the very identifiers an orphan scan searches for, so scanning one can turn a failing gate green ^[21].

Dead-code findings stay out of the exit code: the orphaned-symbol section in the sample run is marked advisory ^[22]. A second script, bench/check-locales.php, reports each translation's coverage and fails on a key English does not have or a placeholder that drifted ^[13]. All of this is the project's own account, and no independent review of the rewrite has been published.