fix(jq): forward demand across path()'s reindex bridge, not just collect

[newhoggy]

Summary

• eval_each_generic's lazy Builtin::Path arm sent a document the reindex bridge would not round-trip identically (a number literal past REINDEX_LITERAL_LEN_CAP = 256 chars, or a NaN spelling) to eval_on_owned, which collects every path before a wrapping consumer (limit, first, label/break) ever sees one — over-running jq's own generator order exactly on the documents that select this route ([limit(1; path((.a|stderr),(.b|stderr)))] wrote 12 instead of jq's 1). This was the last of the two shapes jq: two path() shapes still collect after #2908 — the reindex-bridge route and a generator in index position #2925 recorded as still collecting after jq: path()'s own consumer side still collects, so a bound outside path() can't stop the fold (#2694 residual) #2908 — the sibling shape (a generator in index position) had already closed with jq: eager path-resolution vs jq's lazy generator can over/under-fire target side effects when a downstream write fails partway #2267.
• Fix: swap the entry point to eval_each_owned_bridged instead of eval_on_owned — the demand-forwarding twin eval.rs's own eval_each already uses for isempty/any/all/IN via bridge_to_each_owned_flow.
• Not the demoting eval_each_owned: this arm already reroot_markers's the expression against the same root before crossing the bridge (jq: a root-bound $x matches a rebuilt equal-valued copy — TrackedVar's value witness writes where jq refuses #2642/jq: a $var bound from a navigated position refuses at that same node (.a as $y | .a | ($y.b) = 9) #3037), and the demoting entry's RootWitness::Owned catch-all in marker_needs_demotion would silently re-demote a marker jq: a $var bound from a navigated position refuses at that same node (.a as $y | .a | ($y.b) = 9) #3037's promotion just proved is the root's own node — a real behavior difference from the prior 2026-09-16 triage's suggested snippet, which predates the eval_each_owned_bridged split (introduced the next day, jq: #2642 fabrication still live when the bind and the rebuild both run inside eval.rs (input builtins, |= RHS, fold UPDATE) #3036/jq: a $var bound from a navigated position refuses at that same node (.a as $y | .a | ($y.b) = 9) #3037's root-witness work). Verified this matters by tracing marker_needs_demotion's _ => true catch-all under RootWitness::Owned.
• Extends path_results_stream_to_their_consumer_2908 with the over-cap rows the old residual-guard comment predicted, confirmed failing on pre-fix main (assert_eq mismatch "123" vs "1") and passing post-fix, matching jq 1.7.1 on every row including the 256/257-character cap boundary and yq mode.
• Updates three stale doc sites: the arm's own comment, docs/compliance/jq/limitations.md's "two shapes still collect" paragraph (also drops its stale "any Float" wording — bridge-identity since jq/yq: a computed float read back out of a container regains literal spelling in tostring (1.0 vs 1) #2902 — and cross-references the separate, still-open #3025 value-fidelity gap this fix does not touch), and builtin_path's reachability note in eval.rs.

Test plan

• cargo build --features cli
• cargo test --features cli,simd,regex,serde (full suite: 8955 passed, 0 failed)
• cargo clippy --all-targets --all-features -- -D warnings
• cargo clippy --all-targets --features std,simd,serde,cli,regex,bench-runner,large-tests,mmap-tests -- -D warnings
• New test rows confirmed failing against pre-fix main (temporarily reverted just the source fix via a tagged git stash, reran, restored) before confirming they pass post-fix
• Live-diffed every new row against /usr/bin/jq 1.7.1 before writing it into the test table
• cargo llvm-cov --features cli,simd,regex,serde --workspace --lcov + omni-dev coverage diff

Fixes #2925

[github-actions]

Coverage

Total: 93.95% ⚪ 0 pp vs main

Comparing c0f0bbe..cde7afa (merge-base → PR head)

No per-file coverage changes vs main.

🔇 0 ignored region(s), 175 tolerated region(s)

ignore removes the lines from both reports; tolerate keeps them in the reported percentage but scores them against the baseline, so a cross-run flip cannot move a delta. Regions are read from each revision's own source.

File	Kind	Lines	Rev	Reason
src/bin/succinctly/jq_runner.rs	tolerate	1750-1762	both	unreachable: try_parse_meta_op only fires under ParserMode::Yq (src/jq/parser.rs), and rewrite_namespaced_calls is only reached via ModuleProcessor::process_program, which jq_runner's own jq-mode run is the sole caller of -- so a MetaAssign node can never reach this function (#798)
src/bin/succinctly/jq_runner.rs	tolerate	2375	both	unreachable by construction: every error this wrapper receives today is a decode or nesting-depth failure the evaluator raised itself, never error(v); kept so a future one is rendered rather than dropped (#2999)
src/bin/succinctly/jq_runner.rs	tolerate	2376	both	see the arm above (#2999)
src/bin/succinctly/jq_runner.rs	tolerate	2939-2942	both	unreachable in a single-process run by construction: run_id_for (the sole source of an origin id) always inserts a run_origins entry for the id it hands back -- from a real load's canonical path, or its own literal-path fallback on a resolve failure -- and a def body only ever gets stamped with an origin after its module loaded successfully, so at always names a file that existed and was readable moments earlier. Reaching this arm needs that same file to vanish (or become unreadable) in the narrow window between that load and this re-read, entirely outside this process's control (#2964)
src/bin/succinctly/jq_runner.rs	tolerate	3199	both	unreachable: widening the shadow-candidate set never rejects a program the first parse accepted -- a newly covered name only wraps an already-successful dedicated parse, and a failing one would have propagated its error in the first parse too, so the retry budget is charged at the identical sites in both (#2395)
src/bin/succinctly/jq_runner.rs	tolerate	9538	both	unreachable in a passing suite by design -- the fixed b\
src/bin/succinctly/main.rs	tolerate	1430	both	the CLI suites drive yq through the syq multi-call arm above; this arm is the same call reached only when spelled succinctly yq (#2999)
src/bin/succinctly/yq_runner.rs	tolerate	1652	both	unreachable: bytes already parsed successfully by every caller (#1350)
src/bin/succinctly/yq_runner.rs	tolerate	3318	both	unreachable: path is always the raw output of the path(TARGET) builtin evaluated a few lines up in resolve_one_meta_assign -- path/1 is a jq/yq language invariant that always answers an array of path components (see Expr::Builtin(Builtin::PathNoArg) => Ok(Some(OwnedValue::Array(..))) in eval_generic.rs), never any other shape (#798)
src/bin/succinctly/yq_runner.rs	tolerate	3420	both	unreachable: resolve_meta_assign_writes runs expr through this before any evaluation begins (see its own doc comment), and Expr::Shared is never constructed by the parser -- only at eval time, by function-call argument substitution (substitute_func_param in eval.rs) -- so a pre-evaluation AST can never contain one here (#798)
src/bin/succinctly/yq_runner.rs	tolerate	4052	both	unreachable: every arm of the match result { .. } above that assigns docs (L3492-3622) constructs Ok(..) -- none ever produces Err, so this if let's implicit else can't be taken; symmetric to L1625's ? (#798)
src/jq/document.rs	tolerate	1125-1132	both	unreachable: both implementors (StandardJson, YamlValue) override this to decode once; the default exists as the contract a future implementor inherits, and is deliberately the two-call sequence it replaces (#965)
src/jq/eval.rs	tolerate	1142	both	unreachable: def is always a collect_alias_groups anchor path, which step_to_expr never fails on (#1351)
src/jq/eval.rs	tolerate	1163	both	unreachable: redirect_paths with Redirect::SINGLE always contributes exactly one output per input, so a 1-element paths always pops Some (#1351)
src/jq/eval.rs	tolerate	1172	both	unreachable: a concrete setpath/delpaths path's components are always Field/Index -- step_to_expr never produces another shape (#1351)
src/jq/eval.rs	tolerate	1176	both	unreachable: the map above never yields None, since it only ever matches Field/Index (#1351)
src/jq/eval.rs	tolerate	4388	both	unreachable: is_escape() is exactly `Error
src/jq/eval.rs	tolerate	4389	both	unreachable: see the if let above -- push_owned_values never answers None for an is_escape() result (#2180)
src/jq/eval.rs	tolerate	5555	both	unreachable today: to_owned's only failures are is_decode_failure()-tagged, and suppresses() answers false for those whatever optional is -- the same defensive-but-dead arm eval_generic's own Builtin::Path materialization documents under #2280 (#2908)
src/jq/eval.rs	tolerate	6301	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval.rs	tolerate	7446	both	unreachable: optional is never true here. eval_each is entered with a forced true at exactly one site (Expr::Optional over an IndexExpr/SliceExpr), and both of those evaluate their target (eval_index_expr) and their key (eval_each(key, .., false)) with a hardcoded false, so only the final index/slice step ever sees it -- nothing carries it down to an Expr::Object (#2180)
src/jq/eval.rs	tolerate	10732	both	unreachable: every entry point supplies path context, so path never evaluates without one; pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval.rs	tolerate	10862	both	unreachable: only ever constructed by builtin_sort_keys's own eval_update_no_vivify call, whose enclosing eval_update_impl already runs to_owned on the whole document up front (#2855) -- a decode failure anywhere raises there, before this filter ever sees a value to re-decode; confirmed live, sort_keys(.a)/sort_keys(..) on a document with a decode-failure subtree both raise from the outer to_owned
src/jq/eval.rs	tolerate	21925	both	unreachable: escape_with_prefix! sets terminal before Demand::Stop; already returned above (#2138)
src/jq/eval.rs	tolerate	22294	both	unreachable: escape! sets terminal before Demand::Stop; already returned above (#2546)
src/jq/eval.rs	tolerate	30257	both	reachable only on a genuine allocation failure: Vec::try_reserve(1) on a vector that has spare capacity, or can grow, cannot fail -- this is the whole purpose of the branch, converting an OOM into a catchable error rather than an abort (ADR-0018's 'would take the host process down' exception). The pre-#2267 form of the same guard, out.try_reserve(branches.len()) in resolve_index_expr/resolve_slice_expr, was 0-hit for the identical reason (#2267)
src/jq/eval.rs	tolerate	30258	both	see the line above -- the Demand::Stop half of the same allocation-failure-only branch (#2267)
src/jq/eval.rs	tolerate	30264	both	reachable only when the try_reserve above failed, i.e. only on a genuine allocation failure (#2267)
src/jq/eval.rs	tolerate	32544	both	unreachable: is_primitive admits only Identity/Field/Index/Slice, and of those only a Slice's computed bounds can halt -- all four have their own arm in resolve_node_sink/resolve_node_eager, so none reaches this function. Pre-existing; #2694 only wrapped the return in Some (#2694)
src/jq/eval.rs	tolerate	32578	both	unreachable, as this arm's own comment above says: indexing or slicing a value yields zero or one result, so is_primitive never produces more than one -- kept as a named error rather than a panic. Pre-existing; #2694 only wrapped the enclosing return in Some (#2694)
src/jq/eval.rs	tolerate	34999	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval.rs	tolerate	36031	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval.rs	tolerate	36055	both	unreachable: every arm of the loop's last iteration returns -- a walk refusal, an exhausted walk, and a step outcome that never retries on the last alternative (#2979, #2872)
src/jq/eval.rs	tolerate	36602	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval.rs	tolerate	36622	both	unreachable: every path through the loop's last iteration returns -- a walk refusal, an exhausted walk, and a step outcome that never retries on the last alternative (#2979, #2872)
src/jq/eval.rs	tolerate	39313	both	unreachable in a passing suite by design -- a panic-message format argument for the #682 single-valued-tail pin, evaluated only if that assert's own condition is false (#2190)
src/jq/eval.rs	tolerate	39390	both	unreachable: the only caller reaches this after classify_static_component answered Field for this same value, which it does only for an object (#2190)
src/jq/eval.rs	tolerate	39434	both	unreachable: both callers establish the container first -- navigate_static_component_ref via classify_static_component's Index arm, and walk_path's Expr::Iterate arm by matching on the container itself (#2190)
src/jq/eval.rs	tolerate	41828	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval.rs	tolerate	42005	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval.rs	tolerate	43290	both	unreachable: stop_with_escape's only write is slot.set(Some(control)) with the control it was handed, which is always the Control::Error built one line above (#2180)
src/jq/eval.rs	tolerate	43637	both	unreachable: on_update records a step_outcome before every Demand::Stop it answers, and the fallback match runs only when it recorded none (#2872)
src/jq/eval.rs	tolerate	43660	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval.rs	tolerate	44183	both	unreachable by construction: the per-fork match only ever hands stop_with_downstream a non-Exhausted flow, so terminal can never hold Exhausted. foreach_forks' identical arm is 0-hit for the same reason and is only unflagged because it predates this diff (#2899)
src/jq/eval.rs	tolerate	46945	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval.rs	tolerate	48918	both	pre-existing zero-hit line; #2999 changed only which null constant it names
src/jq/eval.rs	tolerate	51552	both	defensive, unreachable via ordinary JSON parsing (#3068)
src/jq/eval.rs	tolerate	51555	both	defensive, unreachable via ordinary JSON parsing (#3068)
src/jq/eval.rs	tolerate	51596	both	optional is never true through either caller of this function -- confirmed live (eprintln! probe): `[1,2,3]
src/jq/eval.rs	tolerate	51605	both	every array literal written in filter source, and every array-element JSON parses, decodes to NumberLiteral (#1035), not a bare Int -- Int is for internally-synthesized values spliced post-parse; probed a computed element ([1970,(0+0),..]) and it still decoded as NumberLiteral here, so this arm has no known real producer (#3068)
src/jq/eval.rs	tolerate	51620	both	optional is never true through this call path -- see the array-length check above (#3068)
src/jq/eval.rs	tolerate	51635	both	optional is never true through either caller of this function, same as the array-length check above (#3068)
src/jq/eval.rs	tolerate	53400	both	unreachable from combinations, whose own empty-input return runs first; pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval.rs	tolerate	54495	both	confirmed live (eprintln! probe): optional is always false in builtin_abs regardless of whether the filter writes abs?, since that suppression happens entirely outside builtin dispatch here -- the same 'optional is never true here' shape eval.rs already documents elsewhere (#2180) (#3041)
src/jq/eval.rs	tolerate	56473	both	unreachable: the sink is a plain collector that always answers Demand::Continue (#2872)
src/jq/eval.rs	tolerate	56583	both	unreachable: optional: false makes index_one_owned answer Ok(Some)/Err only (#2872)
src/jq/eval.rs	tolerate	56729	both	unreachable: pattern_has_computed_key is false for Pattern::Var, so the loop walker above always takes it (#2872)
src/jq/eval.rs	tolerate	56776	both	unreachable: every caller gates on pattern_has_computed_key being false (#2872)
src/jq/eval.rs	tolerate	57834	both	unreachable in practice: a def with more than 32 parameters; the fallback exists so ScopeMask's one-bit-per-parameter u64 is a performance ceiling rather than a correctness limit (#2633)
src/jq/eval.rs	tolerate	57860	both	unreachable: bind_def_call only calls this for a non-empty params, and install_def_calls only builds a DefCall whose args.len() equals params.len(), so the zip is never empty here (#2560)
src/jq/eval.rs	tolerate	57880	both	unreachable in practice: needs more than 32 duplicated-name parameters; see the non-duplicate path's own note (#2633)
src/jq/eval.rs	tolerate	57901	both	unreachable: name was just read from params, so the zip over (params, args) has a matching pair unless args is shorter than params, which install_def_calls' own arity guard rules out (#2560)
src/jq/eval.rs	tolerate	57921	both	unreachable: params is non-empty here (bind_def_call's own guard) and its first entry is never skipped, so at least one substitution always ran (#2560)
src/jq/eval.rs	tolerate	57982	both	unreachable: same arity invariant as bind_def_call_params' own copy of this loop -- name came from params, so the zip has a matching pair unless args is shorter, which install_def_calls rules out (#2560)
src/jq/eval.rs	tolerate	59300	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
src/jq/eval.rs	tolerate	59322	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
src/jq/eval.rs	tolerate	59340	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
src/jq/eval.rs	tolerate	59410	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
src/jq/eval.rs	tolerate	59424	both	substitute_func_param_impl's FuncDef arm always returns FuncDef (#2555)
src/jq/eval.rs	tolerate	66585	both	unreachable in a passing suite by design -- this is the failure message for the assertion the test exists to make (#2190)
src/jq/eval.rs	tolerate	78646	both	unreachable in a passing suite by design -- this test's own diagnostic (#3071)
src/jq/eval.rs	tolerate	79412-79417	both	the closure is asserted never called below (on_update_calls stays 0) -- Err(_) with optional=true short-circuits fold_step_each before this sink runs (#3122)
src/jq/eval.rs	tolerate	84089	both	unreachable in a passing suite by design -- this test's own diagnostic (#3071)
src/jq/eval.rs	tolerate	89931	both	unreachable in a passing suite by design -- this test's own diagnostic (#3071)
src/jq/eval.rs	tolerate	96487	both	unreachable in a passing suite by design -- every filter this helper is called with parses to an AsPattern (#2649)
src/jq/eval.rs	tolerate	96531	both	unreachable in a passing suite by design -- a literal-key pattern's walk either completes or refuses with an error (#2872)
src/jq/eval.rs	tolerate	96540	both	unreachable in a passing suite by design -- every call site passes the origin of a binding this same test already proved carries a marker (#2649)
src/jq/eval.rs	tolerate	96868	both	unreachable in a passing suite by design -- the assertion above is the test (#2872)
src/jq/eval.rs	tolerate	97515	both	unreachable in a passing suite by design -- every row here is a shape jq accepts, confirmed live (#2649)
src/jq/eval.rs	tolerate	97583	both	unreachable in a passing suite by design -- every row here is a shape jq refuses, confirmed live (#2649)
src/jq/eval.rs	tolerate	97968	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the let-else pattern fails to match (#2072)
src/jq/eval.rs	tolerate	97979	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the let-else pattern fails to match (#2072)
src/jq/eval.rs	tolerate	98000	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the match doesn't hit the expected arm above (#2072)
src/jq/eval.rs	tolerate	98016	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the match doesn't hit the expected arm above (#2072)
src/jq/eval.rs	tolerate	98101	both	unreachable in a passing suite by design -- every expression this closure receives is built by marker above (#3037)
src/jq/eval.rs	tolerate	98179	both	unreachable in a passing suite by design -- rewrite_markers rebuilds the same node kind it was given (#3037)
src/jq/eval.rs	tolerate	98206	both	unreachable in a passing suite by design -- every expression this closure receives is built by marker above (#3122)
src/jq/eval.rs	tolerate	98224	both	unreachable in a passing suite by design -- rewrite_markers rebuilds the same node kind it was given (#3122)
src/jq/eval.rs	tolerate	98292	both	unreachable in a passing suite by design -- fires only if demote_for_reentry's own let-else assertion condition is false (#3122)
src/jq/eval.rs	tolerate	98296	both	unreachable in a passing suite by design -- fires only if demote_for_reentry's own let-else assertion condition is false (#3122)
src/jq/eval.rs	tolerate	98336	both	unreachable in a passing suite by design -- fires only if reroot's own let-else assertion condition is false (#3122)
src/jq/eval.rs	tolerate	98340	both	unreachable in a passing suite by design -- fires only if reroot's own let-else assertion condition is false (#3122)
src/jq/eval.rs	tolerate	99818	both	unreachable in a passing suite by design -- this is the panic message for the assertion above, only formatted if the match doesn't hit the Error arm (#3119)
src/jq/eval.rs	tolerate	102210	both	unreachable in a passing suite by design -- this is the failure message for the assertion this test exists to make (#2937)
src/jq/eval.rs	tolerate	102364	both	every pinned filter below yields an owned value; kept so a cursor answer still renders rather than panics (#2999)
src/jq/eval.rs	tolerate	102365	both	unreachable in a passing suite by design -- the failure message for the assertions this helper serves (#2999)
src/jq/eval_generic.rs	tolerate	3729	both	unreachable: the sole remaining caller (retain_truthy_generic's Many arm) runs to_owned on an item before keeping it, so re-converting a kept item here cannot fail; the ManyCursor caller that made this reachable went with the truthiness walk (#2692, re-establishing #2661's premise)
src/jq/eval_generic.rs	tolerate	7092	both	unreachable in a passing suite by design -- this is the panic message for the #2368 pin itself, only formatted if the assert's own condition is false (#2368)
src/jq/eval_generic.rs	tolerate	8950	both	the CLI evaluates every program that uses input/inputs on the eager route (jq_runner's can_use_lazy_path excludes them), so this guard never fires today -- #2968's identical guards on the arms above are equally unfired; kept for the day the lazy path admits such a program (#1309)
src/jq/eval_generic.rs	tolerate	8967	both	the CLI evaluates every program that uses input/inputs on the eager route (jq_runner's can_use_lazy_path excludes them), so this guard never fires today -- #2968's identical guards on the arms above are equally unfired; kept for the day the lazy path admits such a program (#1309)
src/jq/eval_generic.rs	tolerate	10167	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval_generic.rs	tolerate	11661	both	unreachable: every producer that reaches this empty-exprs tail (each_lazy_keys_iterate_sink's sorted/!sorted arms, each_lazy_index_range_iterate_sink, each_lazy_seq_iterate_sink) yields OneCursorValue/OneCursor/Owned, never a cursorless GenericItem::One -- so cursor is always Some here; kept for exhaustiveness/symmetry with the Some arm (#2103)
src/jq/eval_generic.rs	tolerate	14779	both	unreachable: escape_generic!/ensure_owned! set terminal before Demand::Stop; already returned above (#2138)
src/jq/eval_generic.rs	tolerate	15133	both	unreachable: escape! sets terminal before Demand::Stop; already returned above (#2546)
src/jq/eval_generic.rs	tolerate	15725	both	unreachable by construction: key_elements_generic builds every key of a run from the same Option<&Expr> (#2999)
src/jq/eval_generic.rs	tolerate	15735	both	unreachable by construction: key_elements_generic builds every key of a run from the same Option<&Expr> (#2999)
src/jq/eval_generic.rs	tolerate	16248	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval_generic.rs	tolerate	17930	both	unreachable: len_checked and SliceBounds::resolve already bound every index in range to [0, len), so get_cursor cannot miss (#2168)
src/jq/eval_generic.rs	tolerate	20713	both	unreachable by construction: path_context_resolvable admits an any(cond) read only through admits.prefetch, so the rewriter always has one -- the AnyCond arm above carries the identical assertion (#3079)
src/jq/eval_generic.rs	tolerate	20717	both	unreachable by construction, see above
src/jq/eval_generic.rs	tolerate	20718	both	unreachable by construction, see above
src/jq/eval_generic.rs	tolerate	21522	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval_generic.rs	tolerate	21543	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval_generic.rs	tolerate	21886	both	unreachable: malformed_object_member above already proved every key stringifies (the None half), and to_owned_cursor on an untagged key decoded_key_str decoded cannot fail (the Err half) (#2785)
src/jq/eval_generic.rs	tolerate	21967	both	unreachable: map(f) over an array emits exactly one array; kept so a future map shape produces no output rather than a panic (#2785)
src/jq/eval_generic.rs	tolerate	22254	both	unreachable by design -- eval_single's #2368 debug_assert forbids optional=true on Builtin::Reverse, so length never answers None here (#2730)
src/jq/eval_generic.rs	tolerate	22858	both	the CLI evaluates every program that uses input/inputs on the eager route (jq_runner's can_use_lazy_path excludes them), so this guard never fires today -- #2968's identical guards on the arms above are equally unfired; kept for the day the lazy path admits such a program (#1309)
src/jq/eval_generic.rs	tolerate	22864	both	see above: the input-queue deferral never fires from the CLI
src/jq/eval_generic.rs	tolerate	24308	both	unreachable by construction: every shape either guard admits now has an arm above (#2771), and expr_dispatch_catchall_guards_default_conservatively_2549 pins both guards' _ => false defaults directly
src/jq/eval_generic.rs	tolerate	24856	both	unreachable in a passing suite by design -- owned_identity_rule maps a bare Expr::Var to Bound too (for the static gate, which sees a body before its as substitution runs), but every runtime dispatch that reaches this rule (owned_identity_after_stage/owned_identity_placed_by, from owned_identity_leaving_cursor's Bound arm) only ever sees a stage after eval_owned_identity_as's unconditional substitute_bound_var_from call, which always turns $x into Expr::TrackedVar before recursing -- confirmed by running the full suite with this arm replaced by a hard panic!(), which never fired (#2072)
src/jq/eval_generic.rs	tolerate	24874	both	unreachable: this Slice rule's own two execution paths both exclude Expr::Slice before ever reaching owned_identity_placed_by -- eval_owned_identity_stages's catch-all only runs a stage owned_identity_nav_supported refused, and owned_identity_leaving_cursor (identity_from_first, eval_generic.rs:10724) only runs a stage path_context_is_navigational refused -- and both predicates admit Expr::Slice (owned_identity_nav_supported/path_context_is_navigational_at each list Expr::Slice { .. } => true), so a bare slice is always resolved by owned_identity_step's own arm first. Kept in owned_identity_rule's match for exhaustiveness/symmetry with the rule table's other entries, the same reason #2072's Bound arm above is kept unreachable-by-construction (#2966's review of #2834)
src/jq/eval_generic.rs	tolerate	26373	both	optional is never true through this pipe: ? is eval_owned_identity_try, which catches the escape instead, and after #693 only the IndexExpr/SliceExpr special case ever sets it -- kept as any_all_f's scalar_fallback mirror
src/jq/eval_generic.rs	tolerate	26374	both	optional is never true here, see above
src/jq/eval_generic.rs	tolerate	26777	both	unreachable in a passing suite by design -- the failure message for the assertion the tests below make (#2999)
src/jq/eval_generic.rs	tolerate	26916	both	unreachable in a passing suite by design -- the fixture's map(.+1) is always a LazySeq; this arm is the test's own diagnostic (#2666)
src/jq/eval_generic.rs	tolerate	26944	both	unreachable in a passing suite by design -- the fixture's only escape is Control::Error; this arm is the test's own diagnostic (#2666)
src/jq/parser.rs	tolerate	226	both	unreachable: parse_join_expr only calls join_expr with two to four arguments (#3046)
src/jq/parser.rs	tolerate	248	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
src/jq/parser.rs	tolerate	250	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
src/jq/parser.rs	tolerate	252	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
src/jq/parser.rs	tolerate	259	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
src/jq/parser.rs	tolerate	263	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
src/jq/parser.rs	tolerate	279	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
src/jq/parser.rs	tolerate	8949	both	unreachable in a passing suite by design -- this is the panic message for the #3044 pin itself, only formatted if the let-else pattern fails to match (#3044)
src/jq/resolve.rs	tolerate	2300	both	unreachable in practice today: this arm needs builtin_fallback==None (the name was never a shadow candidate) yet is_jq_builtin==true (a real jq builtin at this arity) -- every implemented builtin's own dedicated parse already lowers that shape to Expr::Builtin before resolve.rs ever runs, and #3042/#3046 closed the once-real 'unimplemented builtin' gap this existed for (see JQ_BUILTIN_ROSTER's own doc comment)
src/jq/resolve.rs	tolerate	2302	both	unreachable with the current roster: every JQ_BUILTIN_ROSTER entry of arity >= 1 already has a dedicated parser form (a matches_keyword special case or a Libm1/Libm2/Libm3::ALL entry -- confirmed by cross-referencing the full roster against both), so it is parsed straight to Expr::Builtin and never reaches here as a bare FuncCall. This arm exists for a roster name with no dedicated parse yet and a nonzero arity -- there is none today, so the loop body is reached with an empty args on every pinned-suite run (355 hits on the arm's own condition, 0 in the loop) and would only start executing if such a name were added (#2964)
src/jq/share_stats.rs	tolerate	97	both	process-global env var; exercised by the CLI audit run, not by an in-process test (#2999)
src/jq/value.rs	tolerate	358	both	unreachable by construction: the slow path is entered only after significant_digit_count found 18+ digits over the same mantissa bytes this loop walks (#2936)
src/jq/value.rs	tolerate	382	both	unreachable by construction: 18+ significant digits were counted, so at least one nonzero digit was kept (#2936)
src/jq/value.rs	tolerate	2771	both	unreachable: format_float_with_fraction of a finite double is always RFC 8259 number text, which parse_i64_or_f64 reads (#2936)
src/jq/value.rs	tolerate	4541	both	unreachable in a passing suite by design -- every caller built the value as an array (#2999)
src/jq/value.rs	tolerate	4784	both	unreachable in a passing suite by design -- the value was built as this container a few lines above (#2999)
src/jq/value.rs	tolerate	5603	both	unreachable in a passing suite by design -- the failure message for a malformed oracle table (#2936)
src/json/light.rs	tolerate	7068	both	unreachable in a passing suite by design -- the failure message for the assertion this #2877 test exists to make
src/json/light.rs	tolerate	7150	both	unreachable in a passing suite by design -- the failure message for the assertion this #2877 test exists to make
src/json/light.rs	tolerate	7238	both	unreachable in a passing suite by design -- the failure message for the assertion this #2877 test exists to make
src/json/light.rs	tolerate	7263	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
src/json/light.rs	tolerate	7274	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
src/json/light.rs	tolerate	7355	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
src/util/simd/x86.rs	tolerate	208-258	both	CPU-gated: the avx512f early-return only executes on Zen 4+ / Skylake-X runners, and its absence changes which AMD/Intel branch below executes too (#2449)
src/yaml/index.rs	tolerate	1268	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
src/yaml/index.rs	tolerate	1272	both	unreachable: every fixture field_key_head_foot is called with in this test module is a top-level mapping (#798)
src/yaml/index.rs	tolerate	1283	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this if-let's pattern can never fail to match (#798)
src/yaml/index.rs	tolerate	1285	both	unreachable: every call to field_key_head_foot in this test module passes a key that the fixture's mapping actually has (#798)
src/yaml/index.rs	tolerate	1295	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
src/yaml/index.rs	tolerate	1299	both	unreachable: every fixture seq_item_head_foot is called with in this test module is a top-level sequence (#798)
src/yaml/index.rs	tolerate	1322	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
src/yaml/index.rs	tolerate	1341	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
src/yaml/index.rs	tolerate	1364	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
src/yaml/index.rs	tolerate	1373	both	unreachable: every fixture field_key_head_foot_in_doc is called with in this test module is a top-level mapping (#798)
src/yaml/index.rs	tolerate	1384	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this if-let's pattern can never fail to match (#798)
src/yaml/index.rs	tolerate	1386	both	unreachable: every call to field_key_head_foot_in_doc in this test module passes a key that the fixture's document actually has (#798)
src/yaml/index.rs	tolerate	1397	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
src/yaml/index.rs	tolerate	1401	both	unreachable: every fixture nested_key_head_foot is called with in this test module is a top-level mapping (#798)
src/yaml/index.rs	tolerate	1405	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this let-else's pattern can never fail to match (#798)
src/yaml/index.rs	tolerate	1411	both	unreachable: every fixture nested_key_head_foot is called with has a nested mapping under outer (#798)
src/yaml/index.rs	tolerate	1422	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this if-let's pattern can never fail to match (#798)
src/yaml/index.rs	tolerate	1425	both	unreachable: every call to nested_key_head_foot in this test module passes an outer.inner pair that the fixture actually has (#798)
src/yaml/light.rs	tolerate	3364	both	unreachable: an alias target is never None for a built index (#1374)
src/yaml/light.rs	tolerate	15398	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
src/yaml/light.rs	tolerate	15409	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
src/yaml/light.rs	tolerate	15566	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
src/yaml/parser.rs	tolerate	1583	both	unreachable: every block-sequence open registers a frame at its own depth before any item of it can be parsed (#1079)
src/yaml/parser.rs	tolerate	1613	both	unreachable: this function's sole caller (record_standalone_comment) only invokes it from inside a match on pending_head_lines.last(), so pending_head_lines is already known non-empty here (#798)
src/yaml/parser.rs	tolerate	7999	both	unreachable: every byte here already passed the [0-9.eE+-] charset check above, a strict subset of ASCII, so str::from_utf8 can never fail (#2778)

Patch coverage

Patch: 100% (6/6 new lines covered)

File	Patch	Uncovered new lines
src/jq/eval_generic.rs	100% (6/6)	—

_{📦 Full per-file coverage summary · run summary}

[github-actions]

Coverage

Total: 94.05% ⚪ 0 pp vs main

Comparing c0f0bbe..cde7afa (merge-base → PR head)

No per-file coverage changes vs main.

🔇 0 ignored region(s), 174 tolerated region(s)

ignore removes the lines from both reports; tolerate keeps them in the reported percentage but scores them against the baseline, so a cross-run flip cannot move a delta. Regions are read from each revision's own source.

File	Kind	Lines	Rev	Reason
src/bin/succinctly/jq_runner.rs	tolerate	1750-1762	both	unreachable: try_parse_meta_op only fires under ParserMode::Yq (src/jq/parser.rs), and rewrite_namespaced_calls is only reached via ModuleProcessor::process_program, which jq_runner's own jq-mode run is the sole caller of -- so a MetaAssign node can never reach this function (#798)
src/bin/succinctly/jq_runner.rs	tolerate	2375	both	unreachable by construction: every error this wrapper receives today is a decode or nesting-depth failure the evaluator raised itself, never error(v); kept so a future one is rendered rather than dropped (#2999)
src/bin/succinctly/jq_runner.rs	tolerate	2376	both	see the arm above (#2999)
src/bin/succinctly/jq_runner.rs	tolerate	2939-2942	both	unreachable in a single-process run by construction: run_id_for (the sole source of an origin id) always inserts a run_origins entry for the id it hands back -- from a real load's canonical path, or its own literal-path fallback on a resolve failure -- and a def body only ever gets stamped with an origin after its module loaded successfully, so at always names a file that existed and was readable moments earlier. Reaching this arm needs that same file to vanish (or become unreadable) in the narrow window between that load and this re-read, entirely outside this process's control (#2964)
src/bin/succinctly/jq_runner.rs	tolerate	3199	both	unreachable: widening the shadow-candidate set never rejects a program the first parse accepted -- a newly covered name only wraps an already-successful dedicated parse, and a failing one would have propagated its error in the first parse too, so the retry budget is charged at the identical sites in both (#2395)
src/bin/succinctly/jq_runner.rs	tolerate	9538	both	unreachable in a passing suite by design -- the fixed b\
src/bin/succinctly/main.rs	tolerate	1430	both	the CLI suites drive yq through the syq multi-call arm above; this arm is the same call reached only when spelled succinctly yq (#2999)
src/bin/succinctly/yq_runner.rs	tolerate	1652	both	unreachable: bytes already parsed successfully by every caller (#1350)
src/bin/succinctly/yq_runner.rs	tolerate	3318	both	unreachable: path is always the raw output of the path(TARGET) builtin evaluated a few lines up in resolve_one_meta_assign -- path/1 is a jq/yq language invariant that always answers an array of path components (see Expr::Builtin(Builtin::PathNoArg) => Ok(Some(OwnedValue::Array(..))) in eval_generic.rs), never any other shape (#798)
src/bin/succinctly/yq_runner.rs	tolerate	3420	both	unreachable: resolve_meta_assign_writes runs expr through this before any evaluation begins (see its own doc comment), and Expr::Shared is never constructed by the parser -- only at eval time, by function-call argument substitution (substitute_func_param in eval.rs) -- so a pre-evaluation AST can never contain one here (#798)
src/bin/succinctly/yq_runner.rs	tolerate	4052	both	unreachable: every arm of the match result { .. } above that assigns docs (L3492-3622) constructs Ok(..) -- none ever produces Err, so this if let's implicit else can't be taken; symmetric to L1625's ? (#798)
src/jq/document.rs	tolerate	1125-1132	both	unreachable: both implementors (StandardJson, YamlValue) override this to decode once; the default exists as the contract a future implementor inherits, and is deliberately the two-call sequence it replaces (#965)
src/jq/eval.rs	tolerate	1142	both	unreachable: def is always a collect_alias_groups anchor path, which step_to_expr never fails on (#1351)
src/jq/eval.rs	tolerate	1163	both	unreachable: redirect_paths with Redirect::SINGLE always contributes exactly one output per input, so a 1-element paths always pops Some (#1351)
src/jq/eval.rs	tolerate	1172	both	unreachable: a concrete setpath/delpaths path's components are always Field/Index -- step_to_expr never produces another shape (#1351)
src/jq/eval.rs	tolerate	1176	both	unreachable: the map above never yields None, since it only ever matches Field/Index (#1351)
src/jq/eval.rs	tolerate	4388	both	unreachable: is_escape() is exactly `Error
src/jq/eval.rs	tolerate	4389	both	unreachable: see the if let above -- push_owned_values never answers None for an is_escape() result (#2180)
src/jq/eval.rs	tolerate	5555	both	unreachable today: to_owned's only failures are is_decode_failure()-tagged, and suppresses() answers false for those whatever optional is -- the same defensive-but-dead arm eval_generic's own Builtin::Path materialization documents under #2280 (#2908)
src/jq/eval.rs	tolerate	6301	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval.rs	tolerate	7446	both	unreachable: optional is never true here. eval_each is entered with a forced true at exactly one site (Expr::Optional over an IndexExpr/SliceExpr), and both of those evaluate their target (eval_index_expr) and their key (eval_each(key, .., false)) with a hardcoded false, so only the final index/slice step ever sees it -- nothing carries it down to an Expr::Object (#2180)
src/jq/eval.rs	tolerate	10732	both	unreachable: every entry point supplies path context, so path never evaluates without one; pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval.rs	tolerate	10862	both	unreachable: only ever constructed by builtin_sort_keys's own eval_update_no_vivify call, whose enclosing eval_update_impl already runs to_owned on the whole document up front (#2855) -- a decode failure anywhere raises there, before this filter ever sees a value to re-decode; confirmed live, sort_keys(.a)/sort_keys(..) on a document with a decode-failure subtree both raise from the outer to_owned
src/jq/eval.rs	tolerate	21925	both	unreachable: escape_with_prefix! sets terminal before Demand::Stop; already returned above (#2138)
src/jq/eval.rs	tolerate	22294	both	unreachable: escape! sets terminal before Demand::Stop; already returned above (#2546)
src/jq/eval.rs	tolerate	30257	both	reachable only on a genuine allocation failure: Vec::try_reserve(1) on a vector that has spare capacity, or can grow, cannot fail -- this is the whole purpose of the branch, converting an OOM into a catchable error rather than an abort (ADR-0018's 'would take the host process down' exception). The pre-#2267 form of the same guard, out.try_reserve(branches.len()) in resolve_index_expr/resolve_slice_expr, was 0-hit for the identical reason (#2267)
src/jq/eval.rs	tolerate	30258	both	see the line above -- the Demand::Stop half of the same allocation-failure-only branch (#2267)
src/jq/eval.rs	tolerate	30264	both	reachable only when the try_reserve above failed, i.e. only on a genuine allocation failure (#2267)
src/jq/eval.rs	tolerate	32544	both	unreachable: is_primitive admits only Identity/Field/Index/Slice, and of those only a Slice's computed bounds can halt -- all four have their own arm in resolve_node_sink/resolve_node_eager, so none reaches this function. Pre-existing; #2694 only wrapped the return in Some (#2694)
src/jq/eval.rs	tolerate	32578	both	unreachable, as this arm's own comment above says: indexing or slicing a value yields zero or one result, so is_primitive never produces more than one -- kept as a named error rather than a panic. Pre-existing; #2694 only wrapped the enclosing return in Some (#2694)
src/jq/eval.rs	tolerate	34999	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval.rs	tolerate	36031	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval.rs	tolerate	36055	both	unreachable: every arm of the loop's last iteration returns -- a walk refusal, an exhausted walk, and a step outcome that never retries on the last alternative (#2979, #2872)
src/jq/eval.rs	tolerate	36602	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval.rs	tolerate	36622	both	unreachable: every path through the loop's last iteration returns -- a walk refusal, an exhausted walk, and a step outcome that never retries on the last alternative (#2979, #2872)
src/jq/eval.rs	tolerate	39313	both	unreachable in a passing suite by design -- a panic-message format argument for the #682 single-valued-tail pin, evaluated only if that assert's own condition is false (#2190)
src/jq/eval.rs	tolerate	39390	both	unreachable: the only caller reaches this after classify_static_component answered Field for this same value, which it does only for an object (#2190)
src/jq/eval.rs	tolerate	39434	both	unreachable: both callers establish the container first -- navigate_static_component_ref via classify_static_component's Index arm, and walk_path's Expr::Iterate arm by matching on the container itself (#2190)
src/jq/eval.rs	tolerate	41828	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval.rs	tolerate	42005	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval.rs	tolerate	43290	both	unreachable: stop_with_escape's only write is slot.set(Some(control)) with the control it was handed, which is always the Control::Error built one line above (#2180)
src/jq/eval.rs	tolerate	43637	both	unreachable: on_update records a step_outcome before every Demand::Stop it answers, and the fallback match runs only when it recorded none (#2872)
src/jq/eval.rs	tolerate	43660	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval.rs	tolerate	44183	both	unreachable by construction: the per-fork match only ever hands stop_with_downstream a non-Exhausted flow, so terminal can never hold Exhausted. foreach_forks' identical arm is 0-hit for the same reason and is only unflagged because it predates this diff (#2899)
src/jq/eval.rs	tolerate	46945	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval.rs	tolerate	48918	both	pre-existing zero-hit line; #2999 changed only which null constant it names
src/jq/eval.rs	tolerate	51552	both	defensive, unreachable via ordinary JSON parsing (#3068)
src/jq/eval.rs	tolerate	51555	both	defensive, unreachable via ordinary JSON parsing (#3068)
src/jq/eval.rs	tolerate	51596	both	optional is never true through either caller of this function -- confirmed live (eprintln! probe): `[1,2,3]
src/jq/eval.rs	tolerate	51605	both	every array literal written in filter source, and every array-element JSON parses, decodes to NumberLiteral (#1035), not a bare Int -- Int is for internally-synthesized values spliced post-parse; probed a computed element ([1970,(0+0),..]) and it still decoded as NumberLiteral here, so this arm has no known real producer (#3068)
src/jq/eval.rs	tolerate	51620	both	optional is never true through this call path -- see the array-length check above (#3068)
src/jq/eval.rs	tolerate	51635	both	optional is never true through either caller of this function, same as the array-length check above (#3068)
src/jq/eval.rs	tolerate	53400	both	unreachable from combinations, whose own empty-input return runs first; pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval.rs	tolerate	54495	both	confirmed live (eprintln! probe): optional is always false in builtin_abs regardless of whether the filter writes abs?, since that suppression happens entirely outside builtin dispatch here -- the same 'optional is never true here' shape eval.rs already documents elsewhere (#2180) (#3041)
src/jq/eval.rs	tolerate	56473	both	unreachable: the sink is a plain collector that always answers Demand::Continue (#2872)
src/jq/eval.rs	tolerate	56583	both	unreachable: optional: false makes index_one_owned answer Ok(Some)/Err only (#2872)
src/jq/eval.rs	tolerate	56729	both	unreachable: pattern_has_computed_key is false for Pattern::Var, so the loop walker above always takes it (#2872)
src/jq/eval.rs	tolerate	56776	both	unreachable: every caller gates on pattern_has_computed_key being false (#2872)
src/jq/eval.rs	tolerate	57834	both	unreachable in practice: a def with more than 32 parameters; the fallback exists so ScopeMask's one-bit-per-parameter u64 is a performance ceiling rather than a correctness limit (#2633)
src/jq/eval.rs	tolerate	57860	both	unreachable: bind_def_call only calls this for a non-empty params, and install_def_calls only builds a DefCall whose args.len() equals params.len(), so the zip is never empty here (#2560)
src/jq/eval.rs	tolerate	57880	both	unreachable in practice: needs more than 32 duplicated-name parameters; see the non-duplicate path's own note (#2633)
src/jq/eval.rs	tolerate	57901	both	unreachable: name was just read from params, so the zip over (params, args) has a matching pair unless args is shorter than params, which install_def_calls' own arity guard rules out (#2560)
src/jq/eval.rs	tolerate	57921	both	unreachable: params is non-empty here (bind_def_call's own guard) and its first entry is never skipped, so at least one substitution always ran (#2560)
src/jq/eval.rs	tolerate	57982	both	unreachable: same arity invariant as bind_def_call_params' own copy of this loop -- name came from params, so the zip has a matching pair unless args is shorter, which install_def_calls rules out (#2560)
src/jq/eval.rs	tolerate	59300	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
src/jq/eval.rs	tolerate	59322	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
src/jq/eval.rs	tolerate	59340	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
src/jq/eval.rs	tolerate	59410	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
src/jq/eval.rs	tolerate	59424	both	substitute_func_param_impl's FuncDef arm always returns FuncDef (#2555)
src/jq/eval.rs	tolerate	66585	both	unreachable in a passing suite by design -- this is the failure message for the assertion the test exists to make (#2190)
src/jq/eval.rs	tolerate	78646	both	unreachable in a passing suite by design -- this test's own diagnostic (#3071)
src/jq/eval.rs	tolerate	79412-79417	both	the closure is asserted never called below (on_update_calls stays 0) -- Err(_) with optional=true short-circuits fold_step_each before this sink runs (#3122)
src/jq/eval.rs	tolerate	84089	both	unreachable in a passing suite by design -- this test's own diagnostic (#3071)
src/jq/eval.rs	tolerate	89931	both	unreachable in a passing suite by design -- this test's own diagnostic (#3071)
src/jq/eval.rs	tolerate	96487	both	unreachable in a passing suite by design -- every filter this helper is called with parses to an AsPattern (#2649)
src/jq/eval.rs	tolerate	96531	both	unreachable in a passing suite by design -- a literal-key pattern's walk either completes or refuses with an error (#2872)
src/jq/eval.rs	tolerate	96540	both	unreachable in a passing suite by design -- every call site passes the origin of a binding this same test already proved carries a marker (#2649)
src/jq/eval.rs	tolerate	96868	both	unreachable in a passing suite by design -- the assertion above is the test (#2872)
src/jq/eval.rs	tolerate	97515	both	unreachable in a passing suite by design -- every row here is a shape jq accepts, confirmed live (#2649)
src/jq/eval.rs	tolerate	97583	both	unreachable in a passing suite by design -- every row here is a shape jq refuses, confirmed live (#2649)
src/jq/eval.rs	tolerate	97968	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the let-else pattern fails to match (#2072)
src/jq/eval.rs	tolerate	97979	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the let-else pattern fails to match (#2072)
src/jq/eval.rs	tolerate	98000	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the match doesn't hit the expected arm above (#2072)
src/jq/eval.rs	tolerate	98016	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the match doesn't hit the expected arm above (#2072)
src/jq/eval.rs	tolerate	98101	both	unreachable in a passing suite by design -- every expression this closure receives is built by marker above (#3037)
src/jq/eval.rs	tolerate	98179	both	unreachable in a passing suite by design -- rewrite_markers rebuilds the same node kind it was given (#3037)
src/jq/eval.rs	tolerate	98206	both	unreachable in a passing suite by design -- every expression this closure receives is built by marker above (#3122)
src/jq/eval.rs	tolerate	98224	both	unreachable in a passing suite by design -- rewrite_markers rebuilds the same node kind it was given (#3122)
src/jq/eval.rs	tolerate	98292	both	unreachable in a passing suite by design -- fires only if demote_for_reentry's own let-else assertion condition is false (#3122)
src/jq/eval.rs	tolerate	98296	both	unreachable in a passing suite by design -- fires only if demote_for_reentry's own let-else assertion condition is false (#3122)
src/jq/eval.rs	tolerate	98336	both	unreachable in a passing suite by design -- fires only if reroot's own let-else assertion condition is false (#3122)
src/jq/eval.rs	tolerate	98340	both	unreachable in a passing suite by design -- fires only if reroot's own let-else assertion condition is false (#3122)
src/jq/eval.rs	tolerate	99818	both	unreachable in a passing suite by design -- this is the panic message for the assertion above, only formatted if the match doesn't hit the Error arm (#3119)
src/jq/eval.rs	tolerate	102210	both	unreachable in a passing suite by design -- this is the failure message for the assertion this test exists to make (#2937)
src/jq/eval.rs	tolerate	102364	both	every pinned filter below yields an owned value; kept so a cursor answer still renders rather than panics (#2999)
src/jq/eval.rs	tolerate	102365	both	unreachable in a passing suite by design -- the failure message for the assertions this helper serves (#2999)
src/jq/eval_generic.rs	tolerate	3729	both	unreachable: the sole remaining caller (retain_truthy_generic's Many arm) runs to_owned on an item before keeping it, so re-converting a kept item here cannot fail; the ManyCursor caller that made this reachable went with the truthiness walk (#2692, re-establishing #2661's premise)
src/jq/eval_generic.rs	tolerate	7092	both	unreachable in a passing suite by design -- this is the panic message for the #2368 pin itself, only formatted if the assert's own condition is false (#2368)
src/jq/eval_generic.rs	tolerate	8950	both	the CLI evaluates every program that uses input/inputs on the eager route (jq_runner's can_use_lazy_path excludes them), so this guard never fires today -- #2968's identical guards on the arms above are equally unfired; kept for the day the lazy path admits such a program (#1309)
src/jq/eval_generic.rs	tolerate	8967	both	the CLI evaluates every program that uses input/inputs on the eager route (jq_runner's can_use_lazy_path excludes them), so this guard never fires today -- #2968's identical guards on the arms above are equally unfired; kept for the day the lazy path admits such a program (#1309)
src/jq/eval_generic.rs	tolerate	10167	both	unreachable: every Demand::Stop the sink answers is preceded by outcome = Some(..), handled just above (#2872)
src/jq/eval_generic.rs	tolerate	11661	both	unreachable: every producer that reaches this empty-exprs tail (each_lazy_keys_iterate_sink's sorted/!sorted arms, each_lazy_index_range_iterate_sink, each_lazy_seq_iterate_sink) yields OneCursorValue/OneCursor/Owned, never a cursorless GenericItem::One -- so cursor is always Some here; kept for exhaustiveness/symmetry with the Some arm (#2103)
src/jq/eval_generic.rs	tolerate	14779	both	unreachable: escape_generic!/ensure_owned! set terminal before Demand::Stop; already returned above (#2138)
src/jq/eval_generic.rs	tolerate	15133	both	unreachable: escape! sets terminal before Demand::Stop; already returned above (#2546)
src/jq/eval_generic.rs	tolerate	15725	both	unreachable by construction: key_elements_generic builds every key of a run from the same Option<&Expr> (#2999)
src/jq/eval_generic.rs	tolerate	15735	both	unreachable by construction: key_elements_generic builds every key of a run from the same Option<&Expr> (#2999)
src/jq/eval_generic.rs	tolerate	16248	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval_generic.rs	tolerate	17930	both	unreachable: len_checked and SliceBounds::resolve already bound every index in range to [0, len), so get_cursor cannot miss (#2168)
src/jq/eval_generic.rs	tolerate	20713	both	unreachable by construction: path_context_resolvable admits an any(cond) read only through admits.prefetch, so the rewriter always has one -- the AnyCond arm above carries the identical assertion (#3079)
src/jq/eval_generic.rs	tolerate	20717	both	unreachable by construction, see above
src/jq/eval_generic.rs	tolerate	20718	both	unreachable by construction, see above
src/jq/eval_generic.rs	tolerate	21522	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval_generic.rs	tolerate	21543	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
src/jq/eval_generic.rs	tolerate	21886	both	unreachable: malformed_object_member above already proved every key stringifies (the None half), and to_owned_cursor on an untagged key decoded_key_str decoded cannot fail (the Err half) (#2785)
src/jq/eval_generic.rs	tolerate	21967	both	unreachable: map(f) over an array emits exactly one array; kept so a future map shape produces no output rather than a panic (#2785)
src/jq/eval_generic.rs	tolerate	22254	both	unreachable by design -- eval_single's #2368 debug_assert forbids optional=true on Builtin::Reverse, so length never answers None here (#2730)
src/jq/eval_generic.rs	tolerate	22858	both	the CLI evaluates every program that uses input/inputs on the eager route (jq_runner's can_use_lazy_path excludes them), so this guard never fires today -- #2968's identical guards on the arms above are equally unfired; kept for the day the lazy path admits such a program (#1309)
src/jq/eval_generic.rs	tolerate	22864	both	see above: the input-queue deferral never fires from the CLI
src/jq/eval_generic.rs	tolerate	24308	both	unreachable by construction: every shape either guard admits now has an arm above (#2771), and expr_dispatch_catchall_guards_default_conservatively_2549 pins both guards' _ => false defaults directly
src/jq/eval_generic.rs	tolerate	24856	both	unreachable in a passing suite by design -- owned_identity_rule maps a bare Expr::Var to Bound too (for the static gate, which sees a body before its as substitution runs), but every runtime dispatch that reaches this rule (owned_identity_after_stage/owned_identity_placed_by, from owned_identity_leaving_cursor's Bound arm) only ever sees a stage after eval_owned_identity_as's unconditional substitute_bound_var_from call, which always turns $x into Expr::TrackedVar before recursing -- confirmed by running the full suite with this arm replaced by a hard panic!(), which never fired (#2072)
src/jq/eval_generic.rs	tolerate	24874	both	unreachable: this Slice rule's own two execution paths both exclude Expr::Slice before ever reaching owned_identity_placed_by -- eval_owned_identity_stages's catch-all only runs a stage owned_identity_nav_supported refused, and owned_identity_leaving_cursor (identity_from_first, eval_generic.rs:10724) only runs a stage path_context_is_navigational refused -- and both predicates admit Expr::Slice (owned_identity_nav_supported/path_context_is_navigational_at each list Expr::Slice { .. } => true), so a bare slice is always resolved by owned_identity_step's own arm first. Kept in owned_identity_rule's match for exhaustiveness/symmetry with the rule table's other entries, the same reason #2072's Bound arm above is kept unreachable-by-construction (#2966's review of #2834)
src/jq/eval_generic.rs	tolerate	26373	both	optional is never true through this pipe: ? is eval_owned_identity_try, which catches the escape instead, and after #693 only the IndexExpr/SliceExpr special case ever sets it -- kept as any_all_f's scalar_fallback mirror
src/jq/eval_generic.rs	tolerate	26374	both	optional is never true here, see above
src/jq/eval_generic.rs	tolerate	26777	both	unreachable in a passing suite by design -- the failure message for the assertion the tests below make (#2999)
src/jq/eval_generic.rs	tolerate	26916	both	unreachable in a passing suite by design -- the fixture's map(.+1) is always a LazySeq; this arm is the test's own diagnostic (#2666)
src/jq/eval_generic.rs	tolerate	26944	both	unreachable in a passing suite by design -- the fixture's only escape is Control::Error; this arm is the test's own diagnostic (#2666)
src/jq/parser.rs	tolerate	226	both	unreachable: parse_join_expr only calls join_expr with two to four arguments (#3046)
src/jq/parser.rs	tolerate	248	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
src/jq/parser.rs	tolerate	250	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
src/jq/parser.rs	tolerate	252	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
src/jq/parser.rs	tolerate	259	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
src/jq/parser.rs	tolerate	263	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
src/jq/parser.rs	tolerate	279	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
src/jq/parser.rs	tolerate	8949	both	unreachable in a passing suite by design -- this is the panic message for the #3044 pin itself, only formatted if the let-else pattern fails to match (#3044)
src/jq/resolve.rs	tolerate	2300	both	unreachable in practice today: this arm needs builtin_fallback==None (the name was never a shadow candidate) yet is_jq_builtin==true (a real jq builtin at this arity) -- every implemented builtin's own dedicated parse already lowers that shape to Expr::Builtin before resolve.rs ever runs, and #3042/#3046 closed the once-real 'unimplemented builtin' gap this existed for (see JQ_BUILTIN_ROSTER's own doc comment)
src/jq/resolve.rs	tolerate	2302	both	unreachable with the current roster: every JQ_BUILTIN_ROSTER entry of arity >= 1 already has a dedicated parser form (a matches_keyword special case or a Libm1/Libm2/Libm3::ALL entry -- confirmed by cross-referencing the full roster against both), so it is parsed straight to Expr::Builtin and never reaches here as a bare FuncCall. This arm exists for a roster name with no dedicated parse yet and a nonzero arity -- there is none today, so the loop body is reached with an empty args on every pinned-suite run (355 hits on the arm's own condition, 0 in the loop) and would only start executing if such a name were added (#2964)
src/jq/share_stats.rs	tolerate	97	both	process-global env var; exercised by the CLI audit run, not by an in-process test (#2999)
src/jq/value.rs	tolerate	358	both	unreachable by construction: the slow path is entered only after significant_digit_count found 18+ digits over the same mantissa bytes this loop walks (#2936)
src/jq/value.rs	tolerate	382	both	unreachable by construction: 18+ significant digits were counted, so at least one nonzero digit was kept (#2936)
src/jq/value.rs	tolerate	2771	both	unreachable: format_float_with_fraction of a finite double is always RFC 8259 number text, which parse_i64_or_f64 reads (#2936)
src/jq/value.rs	tolerate	4541	both	unreachable in a passing suite by design -- every caller built the value as an array (#2999)
src/jq/value.rs	tolerate	4784	both	unreachable in a passing suite by design -- the value was built as this container a few lines above (#2999)
src/jq/value.rs	tolerate	5603	both	unreachable in a passing suite by design -- the failure message for a malformed oracle table (#2936)
src/json/light.rs	tolerate	7068	both	unreachable in a passing suite by design -- the failure message for the assertion this #2877 test exists to make
src/json/light.rs	tolerate	7150	both	unreachable in a passing suite by design -- the failure message for the assertion this #2877 test exists to make
src/json/light.rs	tolerate	7238	both	unreachable in a passing suite by design -- the failure message for the assertion this #2877 test exists to make
src/json/light.rs	tolerate	7263	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
src/json/light.rs	tolerate	7274	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
src/json/light.rs	tolerate	7355	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
src/yaml/index.rs	tolerate	1268	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
src/yaml/index.rs	tolerate	1272	both	unreachable: every fixture field_key_head_foot is called with in this test module is a top-level mapping (#798)
src/yaml/index.rs	tolerate	1283	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this if-let's pattern can never fail to match (#798)
src/yaml/index.rs	tolerate	1285	both	unreachable: every call to field_key_head_foot in this test module passes a key that the fixture's mapping actually has (#798)
src/yaml/index.rs	tolerate	1295	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
src/yaml/index.rs	tolerate	1299	both	unreachable: every fixture seq_item_head_foot is called with in this test module is a top-level sequence (#798)
src/yaml/index.rs	tolerate	1322	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
src/yaml/index.rs	tolerate	1341	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
src/yaml/index.rs	tolerate	1364	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
src/yaml/index.rs	tolerate	1373	both	unreachable: every fixture field_key_head_foot_in_doc is called with in this test module is a top-level mapping (#798)
src/yaml/index.rs	tolerate	1384	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this if-let's pattern can never fail to match (#798)
src/yaml/index.rs	tolerate	1386	both	unreachable: every call to field_key_head_foot_in_doc in this test module passes a key that the fixture's document actually has (#798)
src/yaml/index.rs	tolerate	1397	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
src/yaml/index.rs	tolerate	1401	both	unreachable: every fixture nested_key_head_foot is called with in this test module is a top-level mapping (#798)
src/yaml/index.rs	tolerate	1405	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this let-else's pattern can never fail to match (#798)
src/yaml/index.rs	tolerate	1411	both	unreachable: every fixture nested_key_head_foot is called with has a nested mapping under outer (#798)
src/yaml/index.rs	tolerate	1422	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this if-let's pattern can never fail to match (#798)
src/yaml/index.rs	tolerate	1425	both	unreachable: every call to nested_key_head_foot in this test module passes an outer.inner pair that the fixture actually has (#798)
src/yaml/light.rs	tolerate	3364	both	unreachable: an alias target is never None for a built index (#1374)
src/yaml/light.rs	tolerate	15398	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
src/yaml/light.rs	tolerate	15409	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
src/yaml/light.rs	tolerate	15566	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
src/yaml/parser.rs	tolerate	1583	both	unreachable: every block-sequence open registers a frame at its own depth before any item of it can be parsed (#1079)
src/yaml/parser.rs	tolerate	1613	both	unreachable: this function's sole caller (record_standalone_comment) only invokes it from inside a match on pending_head_lines.last(), so pending_head_lines is already known non-empty here (#798)
src/yaml/parser.rs	tolerate	7999	both	unreachable: every byte here already passed the [0-9.eE+-] charset check above, a strict subset of ASCII, so str::from_utf8 can never fail (#2778)

Patch coverage

Patch: 100% (6/6 new lines covered)

File	Patch	Uncovered new lines
src/jq/eval_generic.rs	100% (6/6)	—

_{📦 Full per-file coverage summary · run summary}