audit.py: blob-filter the branch-drift compare against cherry-picks

spec/audit.py

@@ -88,8 +88,30 @@ def audit_repo(entry, spec):
         # main carries content develop lacks (forward-sync needed); develop merely ahead is normal.
         if branch_main["commit"]["commit"]["tree"]["sha"] != branch_dev["commit"]["commit"]["tree"]["sha"]:
             cmp = gh(f"repos/{slug}/compare/develop...main", ok404=True)
-            if cmp and cmp.get("files"):
-                findings.append(("DRIFT", f"branch: main carries {len(cmp['files'])}+ changed file(s) develop lacks (forward-sync needed)"))
+            if cmp:
+                # The three-dot compare's files[] is blind to cherry-picked promotions (develop may
+                # already hold identical content under different commit SHAs, e.g. promote/* branches)
+                # AND capped at 300 entries - so neither raw files[] nor a filter over it is reliable
+                # (#336). Instead, derive the main-side change set from the merge-base tree (paths
+                # whose blob differs base->main, additions and deletions included - no cap), then drop
+                # paths whose blobs already match at develop: content develop already has is not
+                # "content develop lacks". Three recursive trees calls; if any tree is truncated the
+                # filter is skipped and the compare's unfiltered count kept (conservative, marked).
+                trees = {
+                    "base": gh(f"repos/{slug}/git/trees/{cmp['merge_base_commit']['commit']['tree']['sha']}?recursive=1"),
+                    "develop": gh(f"repos/{slug}/git/trees/{branch_dev['commit']['commit']['tree']['sha']}?recursive=1"),
+                    "main": gh(f"repos/{slug}/git/trees/{branch_main['commit']['commit']['tree']['sha']}?recursive=1"),
+                }
+                if any(t.get("truncated") for t in trees.values()):
+                    if cmp.get("files"):
+                        findings.append(("DRIFT", f"branch: main carries {len(cmp['files'])}+ changed file(s) develop lacks (forward-sync needed; tree too large to blob-filter cherry-pick noise)"))
+                else:
+                    blobs = {name: {e["path"]: e["sha"] for e in t["tree"] if e["type"] == "blob"} for name, t in trees.items()}
+                    changed_on_main = {p for p in set(blobs["base"]) | set(blobs["main"]) if blobs["base"].get(p) != blobs["main"].get(p)}
+                    lacking = sorted(p for p in changed_on_main if blobs["main"].get(p) != blobs["develop"].get(p))
+                    if lacking:
+                        shown = ", ".join(lacking[:8]) + (" ..." if len(lacking) > 8 else "")
+                        findings.append(("DRIFT", f"branch: main carries {len(lacking)} file(s) develop lacks (forward-sync needed): {shown}"))
 
     # --- General settings ---
     expected = dict(spec["settings"])