Thanks, Ahmet. We reproduced your two-profile example and shipped the fixes in ArchVerity 3.0.4, now approved on Marketplace (including the separate IDEA 2024.3 package).
Static topic matching now keeps service scopes separate unless a logical cluster scope is explicitly declared. Neither a matching topic name nor matching bootstrap addresses establish a shared physical cluster. The export retains both file/profile/line chains and explicitly marks the missing environment serializer override as UNKNOWN. Equal DTOs, a default value or a fallback path do not close the wire-evidence gap.
Accepted runtime bean observations carry service, environment, source revision, configuration fingerprint and observation time. We reject mismatched, expired or future observations, and retain the static candidates alongside runtime provenance. Resolving a bean reference alone does not prove serializer compatibility or establish a contract for another deployment.
We extended regression coverage to nested overrides, defaults and cycles, distinct scopes, regex subscriptions, exact versus opaque Kafka factory bindings, and retry/DLT imports when names repeat. The public ArchVerity-Demo repository contains the kafka-profile-lab project: 12 isolated recipes with expected exports, positive/negative controls and launch instructions.
These checks validate static conclusions and evidence handling. Physical broker identity, actual serialized bytes and deployment compatibility still require deployment-specific evidence. Thanks for the concrete case; it exposed a boundary we needed to enforce.
Distinguishing proven mismatches from unknowns is the design decision that makes a tool like this usable. Most cross-repo analysers collapse "I checked and these disagree" with "I could not resolve this", and the second category is large in any real Spring codebase: runtime-resolved topics, config-driven URLs, DTOs built reflectively. Reporting those as findings trains people to ignore the output within a week.
Kafka is the harder half of what you are modelling. An HTTP contract at least has a caller that names the endpoint, while a topic has producers and consumers that never reference each other in code, so the only evidence is configuration plus a serialised shape. Keeping the evidence attached to the finding is what makes that reviewable instead of a guess.