fix(jq): carry the path register into nested pipes and catch handlers (#3133)

[newhoggy]

Fixes #3133
Refs #3120, #3043, #2649, #2979, #2042

Summary

A pipe nested under try/if/, is resolved by resolve_node_sink, which has no PathBranch to carry the path register in, so it started register-less. A $w marker inside it could not re-establish, its navigation raised the resolver's own refusal, and try caught that refusal exactly as jq's try catches its own path errors — but jq had no error to catch, because $w is its register. The write was silently discarded:

$ echo '{"a":{"b":1}}' | jq -c 'del(. as {a:$w} | try ($w | .b))'
{"a":{}}
$ echo '{"a":{"b":1}}' | succinctly jq -c 'del(. as {a:$w} | try ($w | .b))'   # main
{"a":{"b":1}}                                                                  # exit 0

Fix — the register rides the Frame. Frame gains the register's value beside its position (register, an Rc<OwnedValue> — a refcount bump under #2999's structural sharing). resolve_seq_stage sets it on an untracked stage's frame from carried_register; resolve_seq_sink seeds a nested pipe from it when the Pipe arm passes none; the AsPattern arm hands it to resolve_as_pattern. It is cleared wherever at is moved or forgotten (extend by a non-empty path, unknown, at), so the same one-directional invariant covers it. The outer stage then trusts a trackable step out of an untracked stage that carried a register (step_may_reestablish, generalising #3120's step_certified): from an untracked input, only a re-establishment against that very register can produce one.

The catch handler gets the register jq restores at the try's entry. jq's fork point saves and restores the path state — confirmed live: null | path(try (.a | error(null)) catch .b) is ["b"], and with a non-null register the handler's .b refuses. The handler is now a seeded pipe with that register (trackable outright for a null/bool payload identical to it), driven through resolve_seq_stage directly so its untracked output still reaches the stages after the try ([path(.a | (try error(null) catch .) | empty)] stays []). This closes the catch-handler-var row (path(.a as $y | .a | try error("x") catch $y) → ["a"]) and the null-document destructuring row #3120 recorded — for the right reason this time.

A pre-existing write-through the fix would have widened, closed. . as $x on an untracked stage binds a value the stage computed, not a node, yet carried Origin::Snapshot, whose value rule certified a constructed copy against the register: del(.a | {b:{c:1}} | . as $x | $x) on {"a":{"b":{"c":1}}} deleted .a on main where jq refuses — and with the register reaching nested pipes, ... | $x | .b | .c navigated through it too (caught by the #2978 trap test while working on this). Such a bind is Origin::Untracked now (identity_bind_position); a marker source keeps its own origin; a null/bool . loses nothing.

Rows that flip to jq's answer

• $q[0] inside an if body (path(. as {a:$q} ?// $z | if $q then $q[0] else $z end) → ["a",0], del → {"a":[2,3]}) — the destructure-alt-artefact-guard pair the jq: destructuring moves jq's path register — path(. as {a:$q} | $q) is ["a"] and path(. as {a:$q} | .a) raises #2649 CLI test pinned as "MUST stay a refusal" (the guard existed for exactly this artefact; it stays for the artefacts that remain).
• catch-handler-var, untracked-catch-handler-null-document, untracked-nested-if-null-register, literal-then-fold-untracked-init (already stale) — six REFUSE_ONLY sweep entries removed.
• The four jq: a destructuring bind in a pipe nested under try has no register, and try swallows the refusal — del(... | try ($x as {b:$q} | $q)) silently discards the write #3133 rows plus the source-position twin, all written as jq writes; the sibling-copy control (.a as $y | .c | 5 | try ($y | .b)) still writes nothing, as in jq.

Two refuse-only residuals recorded: path(.a | try error(.) catch .) (jq ["a"]; a payload equal to the register cannot be told from a rebuilt copy, which jq refuses) and (if true then $x else . end) as $y on an untracked stage (the condition is not evaluated).

Acceptance oracle

• scripts/jq-bind-origin-oracle-sweep.sh: 25 new rows (nested-*, catch-*, computed-identity-bind-*); agree=301 fabricate=0 mismatch=0 refuse-only=36 refuse-only-NEW=0.
• scripts/jq-bind-origin-fuzz.py, 3 seeds × 6000 against a merge-base build: see the test plan.

Review round (/code-review 3144, standard effort)

Four findings, three fixed in a follow-up commit: a caught break's payload is jq's {"__jq":N} label object (modelled as null), so the new null/bool seed made the handler trackable on a null register and (.a | label $out | try (break $out) catch .b) = 1 wrote where jq refuses — the seed now takes a payload_may_be_node flag; the entry register was not gated to jq mode, so the same shape wrote in yq mode, where real yq's lexer rejects try and there is no oracle (both the Try arm and resolve_seq_stage's with_register are jq-only now); and two stale comment claims (the register is not tied to a provable at, and resolve_catch_sink no longer streams through resolve_against_cow_sink). The fourth — the same silent discard surviving in a fold's UPDATE/EXTRACT body, which resolves under a register-less frame — is pre-existing, filed as #3145 and recorded in limitations.md. Suggest a human run /code-review ultra for the deepest pass if wanted; not a merge gate here.

Test plan

• cargo build --features cli
• cargo test --features cli,simd,regex,serde
• cargo clippy --all-targets --all-features -- -D warnings
• cargo clippy --all-targets --features std,simd,serde,cli,regex,bench-runner,large-tests,mmap-tests -- -D warnings
• cargo fmt --all -- --check
• Every row diffed against /usr/bin/jq 1.7.1 (unit matrices, CLI rows, sweep)
• Sweep clean; fuzz 3 × 6000 at zero fabricate / zero mismatch with --baseline
• Unit: test_nested_try_body_keeps_the_register_3133 (replaces the fix(jq): check a destructuring bind on an untracked stage against the carried register (#3043, #3120) #3130 characterization), test_catch_handler_runs_with_the_entry_register_3133, test_identity_bind_on_untracked_stage_is_untracked_3133, test_as_pattern_in_catch_handler_checks_the_entry_register_3133; the catch-handler-var row moved to the jq: widening TrackedVar's gate needs a bind-time path — provenance alone fabricates paths for equal-valued siblings #2042 accepting matrix; two jq: destructuring moves jq's path register — path(. as {a:$q} | $q) is ["a"] and path(. as {a:$q} | .a) raises #2649 CLI pins moved to accept assertions
• cargo llvm-cov --features cli,simd,regex,serde --workspace — every instrumented added line in eval.rs covered except one debug_assert! pattern line
• /code-review 3144 (standard effort): three fixes, one follow-up filed (jq: a fold UPDATE/EXTRACT body nested under try/if has no register — del(foreach .a as $v (.; try ($v | .b); .)) silently discards the write #3145); full verification, sweep and fuzz rerun after

[github-actions]

Coverage

Total: 93.92% ⚪ 0.01 pp vs main (not attributable to this diff)

Comparing 444c459..d20e122 (merge-base → PR head)

No per-file coverage changes vs main.

🔇 0 ignored region(s), 167 tolerated region(s)

ignore removes the lines from both reports; tolerate keeps them in the reported percentage but scores them against the baseline, so a cross-run flip cannot move a delta. Regions are read from each revision's own source.

File	Kind	Lines	Rev	Reason
src/bin/succinctly/jq_runner.rs	tolerate	1499-1511	both	unreachable: try_parse_meta_op only fires under ParserMode::Yq (src/jq/parser.rs), and rewrite_namespaced_calls is only reached via ModuleProcessor::process_program, which jq_runner's own jq-mode run is the sole caller of -- so a MetaAssign node can never reach this function (#798)
src/bin/succinctly/jq_runner.rs	tolerate	2124	both	unreachable by construction: every error this wrapper receives today is a decode or nesting-depth failure the evaluator raised itself, never error(v); kept so a future one is rendered rather than dropped (#2999)
src/bin/succinctly/jq_runner.rs	tolerate	2125	both	see the arm above (#2999)
src/bin/succinctly/jq_runner.rs	tolerate	2682-2685	both	unreachable in a single-process run by construction: run_id_for (the sole source of an origin id) always inserts a run_origins entry for the id it hands back -- from a real load's canonical path, or its own literal-path fallback on a resolve failure -- and a def body only ever gets stamped with an origin after its module loaded successfully, so at always names a file that existed and was readable moments earlier. Reaching this arm needs that same file to vanish (or become unreadable) in the narrow window between that load and this re-read, entirely outside this process's control (#2964)
src/bin/succinctly/jq_runner.rs	tolerate	2942	both	unreachable: widening the shadow-candidate set never rejects a program the first parse accepted -- a newly covered name only wraps an already-successful dedicated parse, and a failing one would have propagated its error in the first parse too, so the retry budget is charged at the identical sites in both (#2395)
src/bin/succinctly/jq_runner.rs	tolerate	9148	both	unreachable in a passing suite by design -- the fixed b\
src/bin/succinctly/main.rs	tolerate	1430	both	the CLI suites drive yq through the syq multi-call arm above; this arm is the same call reached only when spelled succinctly yq (#2999)
src/bin/succinctly/yq_runner.rs	tolerate	1652	both	unreachable: bytes already parsed successfully by every caller (#1350)
src/bin/succinctly/yq_runner.rs	tolerate	3318	both	unreachable: path is always the raw output of the path(TARGET) builtin evaluated a few lines up in resolve_one_meta_assign -- path/1 is a jq/yq language invariant that always answers an array of path components (see Expr::Builtin(Builtin::PathNoArg) => Ok(Some(OwnedValue::Array(..))) in eval_generic.rs), never any other shape (#798)
src/bin/succinctly/yq_runner.rs	tolerate	3420	both	unreachable: resolve_meta_assign_writes runs expr through this before any evaluation begins (see its own doc comment), and Expr::Shared is never constructed by the parser -- only at eval time, by function-call argument substitution (substitute_func_param in eval.rs) -- so a pre-evaluation AST can never contain one here (#798)
src/bin/succinctly/yq_runner.rs	tolerate	4052	both	unreachable: every arm of the match result { .. } above that assigns docs (L3492-3622) constructs Ok(..) -- none ever produces Err, so this if let's implicit else can't be taken; symmetric to L1625's ? (#798)
src/jq/document.rs	tolerate	1125-1132	both	unreachable: both implementors (StandardJson, YamlValue) override this to decode once; the default exists as the contract a future implementor inherits, and is deliberately the two-call sequence it replaces (#965)
src/jq/eval.rs	tolerate	1142	both	unreachable: def is always a collect_alias_groups anchor path, which step_to_expr never fails on (#1351)
src/jq/eval.rs	tolerate	1163	both	unreachable: redirect_paths with Redirect::SINGLE always contributes exactly one output per input, so a 1-element paths always pops Some (#1351)
src/jq/eval.rs	tolerate	1172	both	unreachable: a concrete setpath/delpaths path's components are always Field/Index -- step_to_expr never produces another shape (#1351)
src/jq/eval.rs	tolerate	1176	both	unreachable: the map above never yields None, since it only ever matches Field/Index (#1351)
src/jq/eval.rs	tolerate	4388	both	unreachable: is_escape() is exactly `Error
src/jq/eval.rs	tolerate	4389	both	unreachable: see the if let above -- push_owned_values never answers None for an is_escape() result (#2180)
src/jq/eval.rs	tolerate	5599	both	unreachable today: to_owned's only failures are is_decode_failure()-tagged, and suppresses() answers false for those whatever optional is -- the same defensive-but-dead arm eval_generic's own Builtin::Path materialization documents under #2280 (#2908)
src/jq/eval.rs	tolerate	6339	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval.rs	tolerate	7488	both	unreachable: optional is never true here. eval_each is entered with a forced true at exactly one site (Expr::Optional over an IndexExpr/SliceExpr), and both of those evaluate their target (eval_index_expr) and their key (eval_each(key, .., false)) with a hardcoded false, so only the final index/slice step ever sees it -- nothing carries it down to an Expr::Object (#2180)
src/jq/eval.rs	tolerate	10804	both	unreachable: every entry point supplies path context, so path never evaluates without one; pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval.rs	tolerate	10934	both	unreachable: only ever constructed by builtin_sort_keys's own eval_update_no_vivify call, whose enclosing eval_update_impl already runs to_owned on the whole document up front (#2855) -- a decode failure anywhere raises there, before this filter ever sees a value to re-decode; confirmed live, sort_keys(.a)/sort_keys(..) on a document with a decode-failure subtree both raise from the outer to_owned
src/jq/eval.rs	tolerate	22000	both	unreachable: escape_with_prefix! sets terminal before Demand::Stop; already returned above (#2138)
src/jq/eval.rs	tolerate	22369	both	unreachable: escape! sets terminal before Demand::Stop; already returned above (#2546)
src/jq/eval.rs	tolerate	30250	both	reachable only on a genuine allocation failure: Vec::try_reserve(1) on a vector that has spare capacity, or can grow, cannot fail -- this is the whole purpose of the branch, converting an OOM into a catchable error rather than an abort (ADR-0018's 'would take the host process down' exception). The pre-#2267 form of the same guard, out.try_reserve(branches.len()) in resolve_index_expr/resolve_slice_expr, was 0-hit for the identical reason (#2267)
src/jq/eval.rs	tolerate	30251	both	see the line above -- the Demand::Stop half of the same allocation-failure-only branch (#2267)
src/jq/eval.rs	tolerate	30257	both	reachable only when the try_reserve above failed, i.e. only on a genuine allocation failure (#2267)
src/jq/eval.rs	tolerate	32505	both	unreachable: is_primitive admits only Identity/Field/Index/Slice, and of those only a Slice's computed bounds can halt -- all four have their own arm in resolve_node_sink/resolve_node_eager, so none reaches this function. Pre-existing; #2694 only wrapped the return in Some (#2694)
src/jq/eval.rs	tolerate	32539	both	unreachable, as this arm's own comment above says: indexing or slicing a value yields zero or one result, so is_primitive never produces more than one -- kept as a named error rather than a panic. Pre-existing; #2694 only wrapped the enclosing return in Some (#2694)
src/jq/eval.rs	tolerate	34780	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval.rs	tolerate	35812	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval.rs	tolerate	35836	both	unreachable: every arm of the loop's last iteration returns -- a walk refusal, an exhausted walk, and a step outcome that never retries on the last alternative (#2979, #2872)
src/jq/eval.rs	tolerate	36383	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval.rs	tolerate	36403	both	unreachable: every path through the loop's last iteration returns -- a walk refusal, an exhausted walk, and a step outcome that never retries on the last alternative (#2979, #2872)
src/jq/eval.rs	tolerate	39072	both	unreachable in a passing suite by design -- a panic-message format argument for the #682 single-valued-tail pin, evaluated only if that assert's own condition is false (#2190)
src/jq/eval.rs	tolerate	39149	both	unreachable: the only caller reaches this after classify_static_component answered Field for this same value, which it does only for an object (#2190)
src/jq/eval.rs	tolerate	39193	both	unreachable: both callers establish the container first -- navigate_static_component_ref via classify_static_component's Index arm, and walk_path's Expr::Iterate arm by matching on the container itself (#2190)
src/jq/eval.rs	tolerate	41594	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval.rs	tolerate	41771	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval.rs	tolerate	43090	both	unreachable: stop_with_escape's only write is slot.set(Some(control)) with the control it was handed, which is always the Control::Error built one line above (#2180)
src/jq/eval.rs	tolerate	43441	both	unreachable: on_update records a step_outcome before every Demand::Stop it answers, and the fallback match runs only when it recorded none (#2872)
src/jq/eval.rs	tolerate	43464	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval.rs	tolerate	43980	both	unreachable by construction: the per-fork match only ever hands stop_with_downstream a non-Exhausted flow, so terminal can never hold Exhausted. foreach_forks' identical arm is 0-hit for the same reason and is only unflagged because it predates this diff (#2899)
src/jq/eval.rs	tolerate	46729	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval.rs	tolerate	48702	both	pre-existing zero-hit line; #2999 changed only which null constant it names
src/jq/eval.rs	tolerate	51336	both	defensive, unreachable via ordinary JSON parsing (#3068)
src/jq/eval.rs	tolerate	51339	both	defensive, unreachable via ordinary JSON parsing (#3068)
src/jq/eval.rs	tolerate	51380	both	optional is never true through either caller of this function -- confirmed live (eprintln! probe): `[1,2,3]
src/jq/eval.rs	tolerate	51389	both	every array literal written in filter source, and every array-element JSON parses, decodes to NumberLiteral (#1035), not a bare Int -- Int is for internally-synthesized values spliced post-parse; probed a computed element ([1970,(0+0),..]) and it still decoded as NumberLiteral here, so this arm has no known real producer (#3068)
src/jq/eval.rs	tolerate	51404	both	optional is never true through this call path -- see the array-length check above (#3068)
src/jq/eval.rs	tolerate	51419	both	optional is never true through either caller of this function, same as the array-length check above (#3068)
src/jq/eval.rs	tolerate	53184	both	unreachable from combinations, whose own empty-input return runs first; pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval.rs	tolerate	54279	both	confirmed live (eprintln! probe): optional is always false in builtin_abs regardless of whether the filter writes abs?, since that suppression happens entirely outside builtin dispatch here -- the same 'optional is never true here' shape eval.rs already documents elsewhere (#2180) (#3041)
src/jq/eval.rs	tolerate	56257	both	unreachable: the sink is a plain collector that always answers Demand::Continue (#2872)
src/jq/eval.rs	tolerate	56367	both	unreachable: optional: false makes index_one_owned answer Ok(Some)/Err only (#2872)
src/jq/eval.rs	tolerate	56513	both	unreachable: pattern_has_computed_key is false for Pattern::Var, so the loop walker above always takes it (#2872)
src/jq/eval.rs	tolerate	56560	both	unreachable: every caller gates on pattern_has_computed_key being false (#2872)
src/jq/eval.rs	tolerate	57612	both	unreachable in practice: a def with more than 32 parameters; the fallback exists so ScopeMask's one-bit-per-parameter u64 is a performance ceiling rather than a correctness limit (#2633)
src/jq/eval.rs	tolerate	57638	both	unreachable: bind_def_call only calls this for a non-empty params, and install_def_calls only builds a DefCall whose args.len() equals params.len(), so the zip is never empty here (#2560)
src/jq/eval.rs	tolerate	57658	both	unreachable in practice: needs more than 32 duplicated-name parameters; see the non-duplicate path's own note (#2633)
src/jq/eval.rs	tolerate	57679	both	unreachable: name was just read from params, so the zip over (params, args) has a matching pair unless args is shorter than params, which install_def_calls' own arity guard rules out (#2560)
src/jq/eval.rs	tolerate	57699	both	unreachable: params is non-empty here (bind_def_call's own guard) and its first entry is never skipped, so at least one substitution always ran (#2560)
src/jq/eval.rs	tolerate	57760	both	unreachable: same arity invariant as bind_def_call_params' own copy of this loop -- name came from params, so the zip has a matching pair unless args is shorter, which install_def_calls rules out (#2560)
src/jq/eval.rs	tolerate	59078	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
src/jq/eval.rs	tolerate	59100	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
src/jq/eval.rs	tolerate	59118	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
src/jq/eval.rs	tolerate	59188	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
src/jq/eval.rs	tolerate	59202	both	substitute_func_param_impl's FuncDef arm always returns FuncDef (#2555)
src/jq/eval.rs	tolerate	66358	both	unreachable in a passing suite by design -- this is the failure message for the assertion the test exists to make (#2190)
src/jq/eval.rs	tolerate	78404	both	unreachable in a passing suite by design -- this test's own diagnostic (#3071)
src/jq/eval.rs	tolerate	83845	both	unreachable in a passing suite by design -- this test's own diagnostic (#3071)
src/jq/eval.rs	tolerate	89648	both	unreachable in a passing suite by design -- this test's own diagnostic (#3071)
src/jq/eval.rs	tolerate	96204	both	unreachable in a passing suite by design -- every filter this helper is called with parses to an AsPattern (#2649)
src/jq/eval.rs	tolerate	96248	both	unreachable in a passing suite by design -- a literal-key pattern's walk either completes or refuses with an error (#2872)
src/jq/eval.rs	tolerate	96257	both	unreachable in a passing suite by design -- every call site passes the origin of a binding this same test already proved carries a marker (#2649)
src/jq/eval.rs	tolerate	96585	both	unreachable in a passing suite by design -- the assertion above is the test (#2872)
src/jq/eval.rs	tolerate	97232	both	unreachable in a passing suite by design -- every row here is a shape jq accepts, confirmed live (#2649)
src/jq/eval.rs	tolerate	97300	both	unreachable in a passing suite by design -- every row here is a shape jq refuses, confirmed live (#2649)
src/jq/eval.rs	tolerate	97685	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the let-else pattern fails to match (#2072)
src/jq/eval.rs	tolerate	97696	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the let-else pattern fails to match (#2072)
src/jq/eval.rs	tolerate	97717	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the match doesn't hit the expected arm above (#2072)
src/jq/eval.rs	tolerate	97733	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the match doesn't hit the expected arm above (#2072)
src/jq/eval.rs	tolerate	97818	both	unreachable in a passing suite by design -- every expression this closure receives is built by marker above (#3037)
src/jq/eval.rs	tolerate	97896	both	unreachable in a passing suite by design -- rewrite_markers rebuilds the same node kind it was given (#3037)
src/jq/eval.rs	tolerate	101474	both	unreachable in a passing suite by design -- this is the failure message for the assertion this test exists to make (#2937)
src/jq/eval.rs	tolerate	101628	both	every pinned filter below yields an owned value; kept so a cursor answer still renders rather than panics (#2999)
src/jq/eval.rs	tolerate	101629	both	unreachable in a passing suite by design -- the failure message for the assertions this helper serves (#2999)
src/jq/eval_generic.rs	tolerate	3723	both	unreachable: the sole remaining caller (retain_truthy_generic's Many arm) runs to_owned on an item before keeping it, so re-converting a kept item here cannot fail; the ManyCursor caller that made this reachable went with the truthiness walk (#2692, re-establishing #2661's premise)
src/jq/eval_generic.rs	tolerate	7081	both	unreachable in a passing suite by design -- this is the panic message for the #2368 pin itself, only formatted if the assert's own condition is false (#2368)
src/jq/eval_generic.rs	tolerate	8940	both	the CLI evaluates every program that uses input/inputs on the eager route (jq_runner's can_use_lazy_path excludes them), so this guard never fires today -- #2968's identical guards on the arms above are equally unfired; kept for the day the lazy path admits such a program (#1309)
src/jq/eval_generic.rs	tolerate	8957	both	the CLI evaluates every program that uses input/inputs on the eager route (jq_runner's can_use_lazy_path excludes them), so this guard never fires today -- #2968's identical guards on the arms above are equally unfired; kept for the day the lazy path admits such a program (#1309)
src/jq/eval_generic.rs	tolerate	10142	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval_generic.rs	tolerate	11634	both	unreachable: every producer that reaches this empty-exprs tail (each_lazy_keys_iterate_sink's sorted/!sorted arms, each_lazy_index_range_iterate_sink, each_lazy_seq_iterate_sink) yields OneCursorValue/OneCursor/Owned, never a cursorless GenericItem::One -- so cursor is always Some here; kept for exhaustiveness/symmetry with the Some arm (#2103)
src/jq/eval_generic.rs	tolerate	14752	both	unreachable: escape_generic!/ensure_owned! set terminal before Demand::Stop; already returned above (#2138)
src/jq/eval_generic.rs	tolerate	15106	both	unreachable: escape! sets terminal before Demand::Stop; already returned above (#2546)
src/jq/eval_generic.rs	tolerate	15698	both	unreachable by construction: key_elements_generic builds every key of a run from the same Option<&Expr> (#2999)
src/jq/eval_generic.rs	tolerate	15708	both	unreachable by construction: key_elements_generic builds every key of a run from the same Option<&Expr> (#2999)
src/jq/eval_generic.rs	tolerate	16221	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval_generic.rs	tolerate	17903	both	unreachable: len_checked and SliceBounds::resolve already bound every index in range to [0, len), so get_cursor cannot miss (#2168)
src/jq/eval_generic.rs	tolerate	20686	both	unreachable by construction: path_context_resolvable admits an any(cond) read only through admits.prefetch, so the rewriter always has one -- the AnyCond arm above carries the identical assertion (#3079)
src/jq/eval_generic.rs	tolerate	20690	both	unreachable by construction, see above
src/jq/eval_generic.rs	tolerate	20691	both	unreachable by construction, see above
src/jq/eval_generic.rs	tolerate	21493	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval_generic.rs	tolerate	21514	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval_generic.rs	tolerate	21857	both	unreachable: malformed_object_member above already proved every key stringifies (the None half), and to_owned_cursor on an untagged key decoded_key_str decoded cannot fail (the Err half) (#2785)
src/jq/eval_generic.rs	tolerate	21938	both	unreachable: map(f) over an array emits exactly one array; kept so a future map shape produces no output rather than a panic (#2785)
src/jq/eval_generic.rs	tolerate	22225	both	unreachable by design -- eval_single's #2368 debug_assert forbids optional=true on Builtin::Reverse, so length never answers None here (#2730)
src/jq/eval_generic.rs	tolerate	22827	both	the CLI evaluates every program that uses input/inputs on the eager route (jq_runner's can_use_lazy_path excludes them), so this guard never fires today -- #2968's identical guards on the arms above are equally unfired; kept for the day the lazy path admits such a program (#1309)
src/jq/eval_generic.rs	tolerate	22833	both	see above: the input-queue deferral never fires from the CLI
src/jq/eval_generic.rs	tolerate	24277	both	unreachable by construction: every shape either guard admits now has an arm above (#2771), and expr_dispatch_catchall_guards_default_conservatively_2549 pins both guards' _ => false defaults directly
src/jq/eval_generic.rs	tolerate	24826	both	unreachable in a passing suite by design -- owned_identity_rule maps a bare Expr::Var to Bound too (for the static gate, which sees a body before its as substitution runs), but every runtime dispatch that reaches this rule (owned_identity_after_stage/owned_identity_placed_by, from owned_identity_leaving_cursor's Bound arm) only ever sees a stage after eval_owned_identity_as's unconditional substitute_bound_var_from call, which always turns $x into Expr::TrackedVar before recursing -- confirmed by running the full suite with this arm replaced by a hard panic!(), which never fired (#2072)
src/jq/eval_generic.rs	tolerate	24844	both	unreachable: this Slice rule's own two execution paths both exclude Expr::Slice before ever reaching owned_identity_placed_by -- eval_owned_identity_stages's catch-all only runs a stage owned_identity_nav_supported refused, and owned_identity_leaving_cursor (identity_from_first, eval_generic.rs:10724) only runs a stage path_context_is_navigational refused -- and both predicates admit Expr::Slice (owned_identity_nav_supported/path_context_is_navigational_at each list Expr::Slice { .. } => true), so a bare slice is always resolved by owned_identity_step's own arm first. Kept in owned_identity_rule's match for exhaustiveness/symmetry with the rule table's other entries, the same reason #2072's Bound arm above is kept unreachable-by-construction (#2966's review of #2834)
src/jq/eval_generic.rs	tolerate	26343	both	optional is never true through this pipe: ? is eval_owned_identity_try, which catches the escape instead, and after #693 only the IndexExpr/SliceExpr special case ever sets it -- kept as any_all_f's scalar_fallback mirror
src/jq/eval_generic.rs	tolerate	26344	both	optional is never true here, see above
src/jq/eval_generic.rs	tolerate	26734	both	unreachable in a passing suite by design -- the failure message for the assertion the tests below make (#2999)
src/jq/eval_generic.rs	tolerate	26851	both	unreachable in a passing suite by design -- the fixture's map(.+1) is always a LazySeq; this arm is the test's own diagnostic (#2666)
src/jq/eval_generic.rs	tolerate	26879	both	unreachable in a passing suite by design -- the fixture's only escape is Control::Error; this arm is the test's own diagnostic (#2666)
src/jq/parser.rs	tolerate	226	both	unreachable: parse_join_expr only calls join_expr with two to four arguments (#3046)
src/jq/parser.rs	tolerate	248	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
src/jq/parser.rs	tolerate	250	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
src/jq/parser.rs	tolerate	252	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
src/jq/parser.rs	tolerate	259	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
src/jq/parser.rs	tolerate	263	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
src/jq/parser.rs	tolerate	279	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
src/jq/parser.rs	tolerate	8949	both	unreachable in a passing suite by design -- this is the panic message for the #3044 pin itself, only formatted if the let-else pattern fails to match (#3044)
src/jq/resolve.rs	tolerate	2261	both	unreachable in practice today: this arm needs builtin_fallback==None (the name was never a shadow candidate) yet is_jq_builtin==true (a real jq builtin at this arity) -- every implemented builtin's own dedicated parse already lowers that shape to Expr::Builtin before resolve.rs ever runs, and #3042/#3046 closed the once-real 'unimplemented builtin' gap this existed for (see JQ_BUILTIN_ROSTER's own doc comment)
src/jq/resolve.rs	tolerate	2263	both	unreachable with the current roster: every JQ_BUILTIN_ROSTER entry of arity >= 1 already has a dedicated parser form (a matches_keyword special case or a Libm1/Libm2/Libm3::ALL entry -- confirmed by cross-referencing the full roster against both), so it is parsed straight to Expr::Builtin and never reaches here as a bare FuncCall. This arm exists for a roster name with no dedicated parse yet and a nonzero arity -- there is none today, so the loop body is reached with an empty args on every pinned-suite run (355 hits on the arm's own condition, 0 in the loop) and would only start executing if such a name were added (#2964)
src/jq/share_stats.rs	tolerate	97	both	process-global env var; exercised by the CLI audit run, not by an in-process test (#2999)
src/jq/value.rs	tolerate	358	both	unreachable by construction: the slow path is entered only after significant_digit_count found 18+ digits over the same mantissa bytes this loop walks (#2936)
src/jq/value.rs	tolerate	382	both	unreachable by construction: 18+ significant digits were counted, so at least one nonzero digit was kept (#2936)
src/jq/value.rs	tolerate	2771	both	unreachable: format_float_with_fraction of a finite double is always RFC 8259 number text, which parse_i64_or_f64 reads (#2936)
src/jq/value.rs	tolerate	4541	both	unreachable in a passing suite by design -- every caller built the value as an array (#2999)
src/jq/value.rs	tolerate	4784	both	unreachable in a passing suite by design -- the value was built as this container a few lines above (#2999)
src/jq/value.rs	tolerate	5603	both	unreachable in a passing suite by design -- the failure message for a malformed oracle table (#2936)
src/json/light.rs	tolerate	7068	both	unreachable in a passing suite by design -- the failure message for the assertion this #2877 test exists to make
src/json/light.rs	tolerate	7150	both	unreachable in a passing suite by design -- the failure message for the assertion this #2877 test exists to make
src/json/light.rs	tolerate	7238	both	unreachable in a passing suite by design -- the failure message for the assertion this #2877 test exists to make
src/json/light.rs	tolerate	7263	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
src/json/light.rs	tolerate	7274	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
src/json/light.rs	tolerate	7355	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
src/util/simd/x86.rs	tolerate	208-258	both	CPU-gated: the avx512f early-return only executes on Zen 4+ / Skylake-X runners, and its absence changes which AMD/Intel branch below executes too (#2449)
src/yaml/index.rs	tolerate	1268	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
src/yaml/index.rs	tolerate	1272	both	unreachable: every fixture field_key_head_foot is called with in this test module is a top-level mapping (#798)
src/yaml/index.rs	tolerate	1283	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this if-let's pattern can never fail to match (#798)
src/yaml/index.rs	tolerate	1285	both	unreachable: every call to field_key_head_foot in this test module passes a key that the fixture's mapping actually has (#798)
src/yaml/index.rs	tolerate	1295	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
src/yaml/index.rs	tolerate	1299	both	unreachable: every fixture seq_item_head_foot is called with in this test module is a top-level sequence (#798)
src/yaml/index.rs	tolerate	1322	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
src/yaml/index.rs	tolerate	1341	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
src/yaml/index.rs	tolerate	1364	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
src/yaml/index.rs	tolerate	1373	both	unreachable: every fixture field_key_head_foot_in_doc is called with in this test module is a top-level mapping (#798)
src/yaml/index.rs	tolerate	1384	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this if-let's pattern can never fail to match (#798)
src/yaml/index.rs	tolerate	1386	both	unreachable: every call to field_key_head_foot_in_doc in this test module passes a key that the fixture's document actually has (#798)
src/yaml/index.rs	tolerate	1397	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
src/yaml/index.rs	tolerate	1401	both	unreachable: every fixture nested_key_head_foot is called with in this test module is a top-level mapping (#798)
src/yaml/index.rs	tolerate	1405	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this let-else's pattern can never fail to match (#798)
src/yaml/index.rs	tolerate	1411	both	unreachable: every fixture nested_key_head_foot is called with has a nested mapping under outer (#798)
src/yaml/index.rs	tolerate	1422	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this if-let's pattern can never fail to match (#798)
src/yaml/index.rs	tolerate	1425	both	unreachable: every call to nested_key_head_foot in this test module passes an outer.inner pair that the fixture actually has (#798)
src/yaml/light.rs	tolerate	3364	both	unreachable: an alias target is never None for a built index (#1374)
src/yaml/light.rs	tolerate	15398	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
src/yaml/light.rs	tolerate	15409	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
src/yaml/light.rs	tolerate	15566	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
src/yaml/parser.rs	tolerate	1583	both	unreachable: every block-sequence open registers a frame at its own depth before any item of it can be parsed (#1079)
src/yaml/parser.rs	tolerate	1613	both	unreachable: this function's sole caller (record_standalone_comment) only invokes it from inside a match on pending_head_lines.last(), so pending_head_lines is already known non-empty here (#798)
src/yaml/parser.rs	tolerate	7999	both	unreachable: every byte here already passed the [0-9.eE+-] charset check above, a strict subset of ASCII, so str::from_utf8 can never fail (#2778)

Patch coverage

Patch: 99.66% (296/297 new lines covered)

File	Patch	Uncovered new lines
src/jq/eval.rs	99.66% (296/297)	41053

Uncovered new lines (1)

• src/jq/eval.rs:41053

_{📦 Full per-file coverage summary · run summary}

[github-actions]

Coverage

Total: 94.01% ⚪ 0.01 pp vs main (not attributable to this diff)

Comparing 444c459..d20e122 (merge-base → PR head)

No per-file coverage changes vs main.

🔇 0 ignored region(s), 166 tolerated region(s)

ignore removes the lines from both reports; tolerate keeps them in the reported percentage but scores them against the baseline, so a cross-run flip cannot move a delta. Regions are read from each revision's own source.

File	Kind	Lines	Rev	Reason
src/bin/succinctly/jq_runner.rs	tolerate	1499-1511	both	unreachable: try_parse_meta_op only fires under ParserMode::Yq (src/jq/parser.rs), and rewrite_namespaced_calls is only reached via ModuleProcessor::process_program, which jq_runner's own jq-mode run is the sole caller of -- so a MetaAssign node can never reach this function (#798)
src/bin/succinctly/jq_runner.rs	tolerate	2124	both	unreachable by construction: every error this wrapper receives today is a decode or nesting-depth failure the evaluator raised itself, never error(v); kept so a future one is rendered rather than dropped (#2999)
src/bin/succinctly/jq_runner.rs	tolerate	2125	both	see the arm above (#2999)
src/bin/succinctly/jq_runner.rs	tolerate	2682-2685	both	unreachable in a single-process run by construction: run_id_for (the sole source of an origin id) always inserts a run_origins entry for the id it hands back -- from a real load's canonical path, or its own literal-path fallback on a resolve failure -- and a def body only ever gets stamped with an origin after its module loaded successfully, so at always names a file that existed and was readable moments earlier. Reaching this arm needs that same file to vanish (or become unreadable) in the narrow window between that load and this re-read, entirely outside this process's control (#2964)
src/bin/succinctly/jq_runner.rs	tolerate	2942	both	unreachable: widening the shadow-candidate set never rejects a program the first parse accepted -- a newly covered name only wraps an already-successful dedicated parse, and a failing one would have propagated its error in the first parse too, so the retry budget is charged at the identical sites in both (#2395)
src/bin/succinctly/jq_runner.rs	tolerate	9148	both	unreachable in a passing suite by design -- the fixed b\
src/bin/succinctly/main.rs	tolerate	1430	both	the CLI suites drive yq through the syq multi-call arm above; this arm is the same call reached only when spelled succinctly yq (#2999)
src/bin/succinctly/yq_runner.rs	tolerate	1652	both	unreachable: bytes already parsed successfully by every caller (#1350)
src/bin/succinctly/yq_runner.rs	tolerate	3318	both	unreachable: path is always the raw output of the path(TARGET) builtin evaluated a few lines up in resolve_one_meta_assign -- path/1 is a jq/yq language invariant that always answers an array of path components (see Expr::Builtin(Builtin::PathNoArg) => Ok(Some(OwnedValue::Array(..))) in eval_generic.rs), never any other shape (#798)
src/bin/succinctly/yq_runner.rs	tolerate	3420	both	unreachable: resolve_meta_assign_writes runs expr through this before any evaluation begins (see its own doc comment), and Expr::Shared is never constructed by the parser -- only at eval time, by function-call argument substitution (substitute_func_param in eval.rs) -- so a pre-evaluation AST can never contain one here (#798)
src/bin/succinctly/yq_runner.rs	tolerate	4052	both	unreachable: every arm of the match result { .. } above that assigns docs (L3492-3622) constructs Ok(..) -- none ever produces Err, so this if let's implicit else can't be taken; symmetric to L1625's ? (#798)
src/jq/document.rs	tolerate	1125-1132	both	unreachable: both implementors (StandardJson, YamlValue) override this to decode once; the default exists as the contract a future implementor inherits, and is deliberately the two-call sequence it replaces (#965)
src/jq/eval.rs	tolerate	1142	both	unreachable: def is always a collect_alias_groups anchor path, which step_to_expr never fails on (#1351)
src/jq/eval.rs	tolerate	1163	both	unreachable: redirect_paths with Redirect::SINGLE always contributes exactly one output per input, so a 1-element paths always pops Some (#1351)
src/jq/eval.rs	tolerate	1172	both	unreachable: a concrete setpath/delpaths path's components are always Field/Index -- step_to_expr never produces another shape (#1351)
src/jq/eval.rs	tolerate	1176	both	unreachable: the map above never yields None, since it only ever matches Field/Index (#1351)
src/jq/eval.rs	tolerate	4388	both	unreachable: is_escape() is exactly `Error
src/jq/eval.rs	tolerate	4389	both	unreachable: see the if let above -- push_owned_values never answers None for an is_escape() result (#2180)
src/jq/eval.rs	tolerate	5599	both	unreachable today: to_owned's only failures are is_decode_failure()-tagged, and suppresses() answers false for those whatever optional is -- the same defensive-but-dead arm eval_generic's own Builtin::Path materialization documents under #2280 (#2908)
src/jq/eval.rs	tolerate	6339	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval.rs	tolerate	7488	both	unreachable: optional is never true here. eval_each is entered with a forced true at exactly one site (Expr::Optional over an IndexExpr/SliceExpr), and both of those evaluate their target (eval_index_expr) and their key (eval_each(key, .., false)) with a hardcoded false, so only the final index/slice step ever sees it -- nothing carries it down to an Expr::Object (#2180)
src/jq/eval.rs	tolerate	10804	both	unreachable: every entry point supplies path context, so path never evaluates without one; pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval.rs	tolerate	10934	both	unreachable: only ever constructed by builtin_sort_keys's own eval_update_no_vivify call, whose enclosing eval_update_impl already runs to_owned on the whole document up front (#2855) -- a decode failure anywhere raises there, before this filter ever sees a value to re-decode; confirmed live, sort_keys(.a)/sort_keys(..) on a document with a decode-failure subtree both raise from the outer to_owned
src/jq/eval.rs	tolerate	22000	both	unreachable: escape_with_prefix! sets terminal before Demand::Stop; already returned above (#2138)
src/jq/eval.rs	tolerate	22369	both	unreachable: escape! sets terminal before Demand::Stop; already returned above (#2546)
src/jq/eval.rs	tolerate	30250	both	reachable only on a genuine allocation failure: Vec::try_reserve(1) on a vector that has spare capacity, or can grow, cannot fail -- this is the whole purpose of the branch, converting an OOM into a catchable error rather than an abort (ADR-0018's 'would take the host process down' exception). The pre-#2267 form of the same guard, out.try_reserve(branches.len()) in resolve_index_expr/resolve_slice_expr, was 0-hit for the identical reason (#2267)
src/jq/eval.rs	tolerate	30251	both	see the line above -- the Demand::Stop half of the same allocation-failure-only branch (#2267)
src/jq/eval.rs	tolerate	30257	both	reachable only when the try_reserve above failed, i.e. only on a genuine allocation failure (#2267)
src/jq/eval.rs	tolerate	32505	both	unreachable: is_primitive admits only Identity/Field/Index/Slice, and of those only a Slice's computed bounds can halt -- all four have their own arm in resolve_node_sink/resolve_node_eager, so none reaches this function. Pre-existing; #2694 only wrapped the return in Some (#2694)
src/jq/eval.rs	tolerate	32539	both	unreachable, as this arm's own comment above says: indexing or slicing a value yields zero or one result, so is_primitive never produces more than one -- kept as a named error rather than a panic. Pre-existing; #2694 only wrapped the enclosing return in Some (#2694)
src/jq/eval.rs	tolerate	34780	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval.rs	tolerate	35812	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval.rs	tolerate	35836	both	unreachable: every arm of the loop's last iteration returns -- a walk refusal, an exhausted walk, and a step outcome that never retries on the last alternative (#2979, #2872)
src/jq/eval.rs	tolerate	36383	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval.rs	tolerate	36403	both	unreachable: every path through the loop's last iteration returns -- a walk refusal, an exhausted walk, and a step outcome that never retries on the last alternative (#2979, #2872)
src/jq/eval.rs	tolerate	39072	both	unreachable in a passing suite by design -- a panic-message format argument for the #682 single-valued-tail pin, evaluated only if that assert's own condition is false (#2190)
src/jq/eval.rs	tolerate	39149	both	unreachable: the only caller reaches this after classify_static_component answered Field for this same value, which it does only for an object (#2190)
src/jq/eval.rs	tolerate	39193	both	unreachable: both callers establish the container first -- navigate_static_component_ref via classify_static_component's Index arm, and walk_path's Expr::Iterate arm by matching on the container itself (#2190)
src/jq/eval.rs	tolerate	41594	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval.rs	tolerate	41771	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval.rs	tolerate	43090	both	unreachable: stop_with_escape's only write is slot.set(Some(control)) with the control it was handed, which is always the Control::Error built one line above (#2180)
src/jq/eval.rs	tolerate	43441	both	unreachable: on_update records a step_outcome before every Demand::Stop it answers, and the fallback match runs only when it recorded none (#2872)
src/jq/eval.rs	tolerate	43464	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval.rs	tolerate	43980	both	unreachable by construction: the per-fork match only ever hands stop_with_downstream a non-Exhausted flow, so terminal can never hold Exhausted. foreach_forks' identical arm is 0-hit for the same reason and is only unflagged because it predates this diff (#2899)
src/jq/eval.rs	tolerate	46729	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval.rs	tolerate	48702	both	pre-existing zero-hit line; #2999 changed only which null constant it names
src/jq/eval.rs	tolerate	51336	both	defensive, unreachable via ordinary JSON parsing (#3068)
src/jq/eval.rs	tolerate	51339	both	defensive, unreachable via ordinary JSON parsing (#3068)
src/jq/eval.rs	tolerate	51380	both	optional is never true through either caller of this function -- confirmed live (eprintln! probe): `[1,2,3]
src/jq/eval.rs	tolerate	51389	both	every array literal written in filter source, and every array-element JSON parses, decodes to NumberLiteral (#1035), not a bare Int -- Int is for internally-synthesized values spliced post-parse; probed a computed element ([1970,(0+0),..]) and it still decoded as NumberLiteral here, so this arm has no known real producer (#3068)
src/jq/eval.rs	tolerate	51404	both	optional is never true through this call path -- see the array-length check above (#3068)
src/jq/eval.rs	tolerate	51419	both	optional is never true through either caller of this function, same as the array-length check above (#3068)
src/jq/eval.rs	tolerate	53184	both	unreachable from combinations, whose own empty-input return runs first; pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval.rs	tolerate	54279	both	confirmed live (eprintln! probe): optional is always false in builtin_abs regardless of whether the filter writes abs?, since that suppression happens entirely outside builtin dispatch here -- the same 'optional is never true here' shape eval.rs already documents elsewhere (#2180) (#3041)
src/jq/eval.rs	tolerate	56257	both	unreachable: the sink is a plain collector that always answers Demand::Continue (#2872)
src/jq/eval.rs	tolerate	56367	both	unreachable: optional: false makes index_one_owned answer Ok(Some)/Err only (#2872)
src/jq/eval.rs	tolerate	56513	both	unreachable: pattern_has_computed_key is false for Pattern::Var, so the loop walker above always takes it (#2872)
src/jq/eval.rs	tolerate	56560	both	unreachable: every caller gates on pattern_has_computed_key being false (#2872)
src/jq/eval.rs	tolerate	57612	both	unreachable in practice: a def with more than 32 parameters; the fallback exists so ScopeMask's one-bit-per-parameter u64 is a performance ceiling rather than a correctness limit (#2633)
src/jq/eval.rs	tolerate	57638	both	unreachable: bind_def_call only calls this for a non-empty params, and install_def_calls only builds a DefCall whose args.len() equals params.len(), so the zip is never empty here (#2560)
src/jq/eval.rs	tolerate	57658	both	unreachable in practice: needs more than 32 duplicated-name parameters; see the non-duplicate path's own note (#2633)
src/jq/eval.rs	tolerate	57679	both	unreachable: name was just read from params, so the zip over (params, args) has a matching pair unless args is shorter than params, which install_def_calls' own arity guard rules out (#2560)
src/jq/eval.rs	tolerate	57699	both	unreachable: params is non-empty here (bind_def_call's own guard) and its first entry is never skipped, so at least one substitution always ran (#2560)
src/jq/eval.rs	tolerate	57760	both	unreachable: same arity invariant as bind_def_call_params' own copy of this loop -- name came from params, so the zip has a matching pair unless args is shorter, which install_def_calls rules out (#2560)
src/jq/eval.rs	tolerate	59078	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
src/jq/eval.rs	tolerate	59100	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
src/jq/eval.rs	tolerate	59118	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
src/jq/eval.rs	tolerate	59188	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
src/jq/eval.rs	tolerate	59202	both	substitute_func_param_impl's FuncDef arm always returns FuncDef (#2555)
src/jq/eval.rs	tolerate	66358	both	unreachable in a passing suite by design -- this is the failure message for the assertion the test exists to make (#2190)
src/jq/eval.rs	tolerate	78404	both	unreachable in a passing suite by design -- this test's own diagnostic (#3071)
src/jq/eval.rs	tolerate	83845	both	unreachable in a passing suite by design -- this test's own diagnostic (#3071)
src/jq/eval.rs	tolerate	89648	both	unreachable in a passing suite by design -- this test's own diagnostic (#3071)
src/jq/eval.rs	tolerate	96204	both	unreachable in a passing suite by design -- every filter this helper is called with parses to an AsPattern (#2649)
src/jq/eval.rs	tolerate	96248	both	unreachable in a passing suite by design -- a literal-key pattern's walk either completes or refuses with an error (#2872)
src/jq/eval.rs	tolerate	96257	both	unreachable in a passing suite by design -- every call site passes the origin of a binding this same test already proved carries a marker (#2649)
src/jq/eval.rs	tolerate	96585	both	unreachable in a passing suite by design -- the assertion above is the test (#2872)
src/jq/eval.rs	tolerate	97232	both	unreachable in a passing suite by design -- every row here is a shape jq accepts, confirmed live (#2649)
src/jq/eval.rs	tolerate	97300	both	unreachable in a passing suite by design -- every row here is a shape jq refuses, confirmed live (#2649)
src/jq/eval.rs	tolerate	97685	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the let-else pattern fails to match (#2072)
src/jq/eval.rs	tolerate	97696	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the let-else pattern fails to match (#2072)
src/jq/eval.rs	tolerate	97717	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the match doesn't hit the expected arm above (#2072)
src/jq/eval.rs	tolerate	97733	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the match doesn't hit the expected arm above (#2072)
src/jq/eval.rs	tolerate	97818	both	unreachable in a passing suite by design -- every expression this closure receives is built by marker above (#3037)
src/jq/eval.rs	tolerate	97896	both	unreachable in a passing suite by design -- rewrite_markers rebuilds the same node kind it was given (#3037)
src/jq/eval.rs	tolerate	101474	both	unreachable in a passing suite by design -- this is the failure message for the assertion this test exists to make (#2937)
src/jq/eval.rs	tolerate	101628	both	every pinned filter below yields an owned value; kept so a cursor answer still renders rather than panics (#2999)
src/jq/eval.rs	tolerate	101629	both	unreachable in a passing suite by design -- the failure message for the assertions this helper serves (#2999)
src/jq/eval_generic.rs	tolerate	3723	both	unreachable: the sole remaining caller (retain_truthy_generic's Many arm) runs to_owned on an item before keeping it, so re-converting a kept item here cannot fail; the ManyCursor caller that made this reachable went with the truthiness walk (#2692, re-establishing #2661's premise)
src/jq/eval_generic.rs	tolerate	7081	both	unreachable in a passing suite by design -- this is the panic message for the #2368 pin itself, only formatted if the assert's own condition is false (#2368)
src/jq/eval_generic.rs	tolerate	8940	both	the CLI evaluates every program that uses input/inputs on the eager route (jq_runner's can_use_lazy_path excludes them), so this guard never fires today -- #2968's identical guards on the arms above are equally unfired; kept for the day the lazy path admits such a program (#1309)
src/jq/eval_generic.rs	tolerate	8957	both	the CLI evaluates every program that uses input/inputs on the eager route (jq_runner's can_use_lazy_path excludes them), so this guard never fires today -- #2968's identical guards on the arms above are equally unfired; kept for the day the lazy path admits such a program (#1309)
src/jq/eval_generic.rs	tolerate	10142	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval_generic.rs	tolerate	11634	both	unreachable: every producer that reaches this empty-exprs tail (each_lazy_keys_iterate_sink's sorted/!sorted arms, each_lazy_index_range_iterate_sink, each_lazy_seq_iterate_sink) yields OneCursorValue/OneCursor/Owned, never a cursorless GenericItem::One -- so cursor is always Some here; kept for exhaustiveness/symmetry with the Some arm (#2103)
src/jq/eval_generic.rs	tolerate	14752	both	unreachable: escape_generic!/ensure_owned! set terminal before Demand::Stop; already returned above (#2138)
src/jq/eval_generic.rs	tolerate	15106	both	unreachable: escape! sets terminal before Demand::Stop; already returned above (#2546)
src/jq/eval_generic.rs	tolerate	15698	both	unreachable by construction: key_elements_generic builds every key of a run from the same Option<&Expr> (#2999)
src/jq/eval_generic.rs	tolerate	15708	both	unreachable by construction: key_elements_generic builds every key of a run from the same Option<&Expr> (#2999)
src/jq/eval_generic.rs	tolerate	16221	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval_generic.rs	tolerate	17903	both	unreachable: len_checked and SliceBounds::resolve already bound every index in range to [0, len), so get_cursor cannot miss (#2168)
src/jq/eval_generic.rs	tolerate	20686	both	unreachable by construction: path_context_resolvable admits an any(cond) read only through admits.prefetch, so the rewriter always has one -- the AnyCond arm above carries the identical assertion (#3079)
src/jq/eval_generic.rs	tolerate	20690	both	unreachable by construction, see above
src/jq/eval_generic.rs	tolerate	20691	both	unreachable by construction, see above
src/jq/eval_generic.rs	tolerate	21493	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval_generic.rs	tolerate	21514	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval_generic.rs	tolerate	21857	both	unreachable: malformed_object_member above already proved every key stringifies (the None half), and to_owned_cursor on an untagged key decoded_key_str decoded cannot fail (the Err half) (#2785)
src/jq/eval_generic.rs	tolerate	21938	both	unreachable: map(f) over an array emits exactly one array; kept so a future map shape produces no output rather than a panic (#2785)
src/jq/eval_generic.rs	tolerate	22225	both	unreachable by design -- eval_single's #2368 debug_assert forbids optional=true on Builtin::Reverse, so length never answers None here (#2730)
src/jq/eval_generic.rs	tolerate	22827	both	the CLI evaluates every program that uses input/inputs on the eager route (jq_runner's can_use_lazy_path excludes them), so this guard never fires today -- #2968's identical guards on the arms above are equally unfired; kept for the day the lazy path admits such a program (#1309)
src/jq/eval_generic.rs	tolerate	22833	both	see above: the input-queue deferral never fires from the CLI
src/jq/eval_generic.rs	tolerate	24277	both	unreachable by construction: every shape either guard admits now has an arm above (#2771), and expr_dispatch_catchall_guards_default_conservatively_2549 pins both guards' _ => false defaults directly
src/jq/eval_generic.rs	tolerate	24826	both	unreachable in a passing suite by design -- owned_identity_rule maps a bare Expr::Var to Bound too (for the static gate, which sees a body before its as substitution runs), but every runtime dispatch that reaches this rule (owned_identity_after_stage/owned_identity_placed_by, from owned_identity_leaving_cursor's Bound arm) only ever sees a stage after eval_owned_identity_as's unconditional substitute_bound_var_from call, which always turns $x into Expr::TrackedVar before recursing -- confirmed by running the full suite with this arm replaced by a hard panic!(), which never fired (#2072)
src/jq/eval_generic.rs	tolerate	24844	both	unreachable: this Slice rule's own two execution paths both exclude Expr::Slice before ever reaching owned_identity_placed_by -- eval_owned_identity_stages's catch-all only runs a stage owned_identity_nav_supported refused, and owned_identity_leaving_cursor (identity_from_first, eval_generic.rs:10724) only runs a stage path_context_is_navigational refused -- and both predicates admit Expr::Slice (owned_identity_nav_supported/path_context_is_navigational_at each list Expr::Slice { .. } => true), so a bare slice is always resolved by owned_identity_step's own arm first. Kept in owned_identity_rule's match for exhaustiveness/symmetry with the rule table's other entries, the same reason #2072's Bound arm above is kept unreachable-by-construction (#2966's review of #2834)
src/jq/eval_generic.rs	tolerate	26343	both	optional is never true through this pipe: ? is eval_owned_identity_try, which catches the escape instead, and after #693 only the IndexExpr/SliceExpr special case ever sets it -- kept as any_all_f's scalar_fallback mirror
src/jq/eval_generic.rs	tolerate	26344	both	optional is never true here, see above
src/jq/eval_generic.rs	tolerate	26734	both	unreachable in a passing suite by design -- the failure message for the assertion the tests below make (#2999)
src/jq/eval_generic.rs	tolerate	26851	both	unreachable in a passing suite by design -- the fixture's map(.+1) is always a LazySeq; this arm is the test's own diagnostic (#2666)
src/jq/eval_generic.rs	tolerate	26879	both	unreachable in a passing suite by design -- the fixture's only escape is Control::Error; this arm is the test's own diagnostic (#2666)
src/jq/parser.rs	tolerate	226	both	unreachable: parse_join_expr only calls join_expr with two to four arguments (#3046)
src/jq/parser.rs	tolerate	248	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
src/jq/parser.rs	tolerate	250	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
src/jq/parser.rs	tolerate	252	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
src/jq/parser.rs	tolerate	259	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
src/jq/parser.rs	tolerate	263	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
src/jq/parser.rs	tolerate	279	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
src/jq/parser.rs	tolerate	8949	both	unreachable in a passing suite by design -- this is the panic message for the #3044 pin itself, only formatted if the let-else pattern fails to match (#3044)
src/jq/resolve.rs	tolerate	2261	both	unreachable in practice today: this arm needs builtin_fallback==None (the name was never a shadow candidate) yet is_jq_builtin==true (a real jq builtin at this arity) -- every implemented builtin's own dedicated parse already lowers that shape to Expr::Builtin before resolve.rs ever runs, and #3042/#3046 closed the once-real 'unimplemented builtin' gap this existed for (see JQ_BUILTIN_ROSTER's own doc comment)
src/jq/resolve.rs	tolerate	2263	both	unreachable with the current roster: every JQ_BUILTIN_ROSTER entry of arity >= 1 already has a dedicated parser form (a matches_keyword special case or a Libm1/Libm2/Libm3::ALL entry -- confirmed by cross-referencing the full roster against both), so it is parsed straight to Expr::Builtin and never reaches here as a bare FuncCall. This arm exists for a roster name with no dedicated parse yet and a nonzero arity -- there is none today, so the loop body is reached with an empty args on every pinned-suite run (355 hits on the arm's own condition, 0 in the loop) and would only start executing if such a name were added (#2964)
src/jq/share_stats.rs	tolerate	97	both	process-global env var; exercised by the CLI audit run, not by an in-process test (#2999)
src/jq/value.rs	tolerate	358	both	unreachable by construction: the slow path is entered only after significant_digit_count found 18+ digits over the same mantissa bytes this loop walks (#2936)
src/jq/value.rs	tolerate	382	both	unreachable by construction: 18+ significant digits were counted, so at least one nonzero digit was kept (#2936)
src/jq/value.rs	tolerate	2771	both	unreachable: format_float_with_fraction of a finite double is always RFC 8259 number text, which parse_i64_or_f64 reads (#2936)
src/jq/value.rs	tolerate	4541	both	unreachable in a passing suite by design -- every caller built the value as an array (#2999)
src/jq/value.rs	tolerate	4784	both	unreachable in a passing suite by design -- the value was built as this container a few lines above (#2999)
src/jq/value.rs	tolerate	5603	both	unreachable in a passing suite by design -- the failure message for a malformed oracle table (#2936)
src/json/light.rs	tolerate	7068	both	unreachable in a passing suite by design -- the failure message for the assertion this #2877 test exists to make
src/json/light.rs	tolerate	7150	both	unreachable in a passing suite by design -- the failure message for the assertion this #2877 test exists to make
src/json/light.rs	tolerate	7238	both	unreachable in a passing suite by design -- the failure message for the assertion this #2877 test exists to make
src/json/light.rs	tolerate	7263	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
src/json/light.rs	tolerate	7274	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
src/json/light.rs	tolerate	7355	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
src/yaml/index.rs	tolerate	1268	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
src/yaml/index.rs	tolerate	1272	both	unreachable: every fixture field_key_head_foot is called with in this test module is a top-level mapping (#798)
src/yaml/index.rs	tolerate	1283	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this if-let's pattern can never fail to match (#798)
src/yaml/index.rs	tolerate	1285	both	unreachable: every call to field_key_head_foot in this test module passes a key that the fixture's mapping actually has (#798)
src/yaml/index.rs	tolerate	1295	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
src/yaml/index.rs	tolerate	1299	both	unreachable: every fixture seq_item_head_foot is called with in this test module is a top-level sequence (#798)
src/yaml/index.rs	tolerate	1322	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
src/yaml/index.rs	tolerate	1341	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
src/yaml/index.rs	tolerate	1364	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
src/yaml/index.rs	tolerate	1373	both	unreachable: every fixture field_key_head_foot_in_doc is called with in this test module is a top-level mapping (#798)
src/yaml/index.rs	tolerate	1384	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this if-let's pattern can never fail to match (#798)
src/yaml/index.rs	tolerate	1386	both	unreachable: every call to field_key_head_foot_in_doc in this test module passes a key that the fixture's document actually has (#798)
src/yaml/index.rs	tolerate	1397	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
src/yaml/index.rs	tolerate	1401	both	unreachable: every fixture nested_key_head_foot is called with in this test module is a top-level mapping (#798)
src/yaml/index.rs	tolerate	1405	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this let-else's pattern can never fail to match (#798)
src/yaml/index.rs	tolerate	1411	both	unreachable: every fixture nested_key_head_foot is called with has a nested mapping under outer (#798)
src/yaml/index.rs	tolerate	1422	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this if-let's pattern can never fail to match (#798)
src/yaml/index.rs	tolerate	1425	both	unreachable: every call to nested_key_head_foot in this test module passes an outer.inner pair that the fixture actually has (#798)
src/yaml/light.rs	tolerate	3364	both	unreachable: an alias target is never None for a built index (#1374)
src/yaml/light.rs	tolerate	15398	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
src/yaml/light.rs	tolerate	15409	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
src/yaml/light.rs	tolerate	15566	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
src/yaml/parser.rs	tolerate	1583	both	unreachable: every block-sequence open registers a frame at its own depth before any item of it can be parsed (#1079)
src/yaml/parser.rs	tolerate	1613	both	unreachable: this function's sole caller (record_standalone_comment) only invokes it from inside a match on pending_head_lines.last(), so pending_head_lines is already known non-empty here (#798)
src/yaml/parser.rs	tolerate	7999	both	unreachable: every byte here already passed the [0-9.eE+-] charset check above, a strict subset of ASCII, so str::from_utf8 can never fail (#2778)

Patch coverage

Patch: 99.66% (296/297 new lines covered)

File	Patch	Uncovered new lines
src/jq/eval.rs	99.66% (296/297)	41053

Uncovered new lines (1)

• src/jq/eval.rs:41053

_{📦 Full per-file coverage summary · run summary}