fix(jq): recognize every identity-passthrough spelling in a pattern's first-step identity test by newhoggy · Pull Request #3147 · rust-works/succinctly

newhoggy · 2026-09-18T07:46:00Z

Summary

resolve_as_pattern's first-step identity test (jq's path_intact) only recognized a
bare . head as "the source value is the register's own node." Every other
is_identity_passthrough spelling (try . catch 1, if true then . else . end,
. // 1) fell to the null/bool catch-all, wrongly decided the step was not intact, and
either refused (a single pattern) or retried onto the next ?// alternative —
binding a different alternative than jq does, which del/= then write through. The
load-bearing case is a silent wrong delete: del((. // 1) as {a:$v} ?// $v | $v) on
{"a":"s","c":"s"} wrote null (deleting the whole document) where jq deletes one key,
leaving {"c":"s"}.

Fix: add dedicated If/Try/Alternative match arms to the identical computation,
mirroring is_identity_passthrough's own grammar exactly. The Alternative (A // B)
arm additionally requires the register be truthy — A // B only equals . exactly when
A actually produced the value; B runs, and is completely unconstrained, whenever the
register is null/false. This is stricter than the issue's own suggested bound == value
gate (which alone could re-admit a #3129-style value-coincidence fabrication off-register,
per #3120's carried-register mechanism) and stays sound in that case, at the cost of one
confirmed refuse-only divergence from jq (documented and pinned in the new test).

Test plan

cargo build --features cli
cargo test --features cli,simd,regex,serde (full suite, 0 failures)
cargo clippy --all-targets --all-features -- -D warnings
cargo clippy --all-targets --features std,simd,serde,cli,regex,bench-runner,large-tests,mmap-tests -- -D warnings
cargo fmt --check
New regression test (test_alternative_identity_passthrough_pattern_head_is_recognized_3119) pins all 6 rows from the issue's own repro table against /usr/bin/jq 1.7.1 (including both controls), plus an if twin not in the issue but the same gap, plus a confirmed refuse-only off-register divergence from the Alternative arm's extra runtime gate
cargo llvm-cov + omni-dev coverage diff: 98.65% patch coverage (73/74), the one remaining line a defensive panic arm annotated omni-dev: coverage tolerate-line, matching the identical pre-existing pattern elsewhere in this file
End-to-end verified against the pinned oracle: del((. // 1) as {a:$v} ?// $v | $v) on {"a":"s","c":"s"} now matches jq's {"c":"s"} exactly, where it previously silently deleted the whole document

Fixes #3119.

github-actions · 2026-09-18T08:03:07Z

Coverage

Total: 94.02% ⚪ 0.01 pp vs main (not attributable to this diff)

Comparing 54ff9d0..b222790 (merge-base → PR head)

No per-file coverage changes vs main.

🔇 0 ignored region(s), 167 tolerated region(s)

ignore removes the lines from both reports; tolerate keeps them in the reported percentage but scores them against the baseline, so a cross-run flip cannot move a delta. Regions are read from each revision's own source.

File	Kind	Lines	Rev	Reason
`src/bin/succinctly/jq_runner.rs`	`tolerate`	1499-1511	both	unreachable: `try_parse_meta_op` only fires under `ParserMode::Yq` (src/jq/parser.rs), and `rewrite_namespaced_calls` is only reached via `ModuleProcessor::process_program`, which jq_runner's own jq-mode `run` is the sole caller of -- so a `MetaAssign` node can never reach this function (#798)
`src/bin/succinctly/jq_runner.rs`	`tolerate`	2124	both	unreachable by construction: every error this wrapper receives today is a decode or nesting-depth failure the evaluator raised itself, never error(v); kept so a future one is rendered rather than dropped (#2999)
`src/bin/succinctly/jq_runner.rs`	`tolerate`	2125	both	see the arm above (#2999)
`src/bin/succinctly/jq_runner.rs`	`tolerate`	2682-2685	both	unreachable in a single-process run by construction: `run_id_for` (the sole source of an `origin` id) always inserts a `run_origins` entry for the id it hands back -- from a real load's canonical path, or its own literal-path fallback on a resolve failure -- and a def body only ever gets stamped with an `origin` after its module loaded successfully, so `at` always names a file that existed and was readable moments earlier. Reaching this arm needs that same file to vanish (or become unreadable) in the narrow window between that load and this re-read, entirely outside this process's control (#2964)
`src/bin/succinctly/jq_runner.rs`	`tolerate`	2942	both	unreachable: widening the shadow-candidate set never rejects a program the first parse accepted -- a newly covered name only wraps an already-successful dedicated parse, and a failing one would have propagated its error in the first parse too, so the retry budget is charged at the identical sites in both (#2395)
`src/bin/succinctly/jq_runner.rs`	`tolerate`	9148	both	unreachable in a passing suite by design -- the fixed b\
`src/bin/succinctly/main.rs`	`tolerate`	1430	both	the CLI suites drive yq through the `syq` multi-call arm above; this arm is the same call reached only when spelled `succinctly yq` (#2999)
`src/bin/succinctly/yq_runner.rs`	`tolerate`	1652	both	unreachable: bytes already parsed successfully by every caller (#1350)
`src/bin/succinctly/yq_runner.rs`	`tolerate`	3318	both	unreachable: `path` is always the raw output of the `path(TARGET)` builtin evaluated a few lines up in `resolve_one_meta_assign` -- `path/1` is a jq/yq language invariant that always answers an array of path components (see `Expr::Builtin(Builtin::PathNoArg) => Ok(Some(OwnedValue::Array(..)))` in eval_generic.rs), never any other shape (#798)
`src/bin/succinctly/yq_runner.rs`	`tolerate`	3420	both	unreachable: `resolve_meta_assign_writes` runs `expr` through this before any evaluation begins (see its own doc comment), and `Expr::Shared` is never constructed by the parser -- only at eval time, by function-call argument substitution (`substitute_func_param` in eval.rs) -- so a pre-evaluation AST can never contain one here (#798)
`src/bin/succinctly/yq_runner.rs`	`tolerate`	4052	both	unreachable: every arm of the `match result { .. }` above that assigns `docs` (L3492-3622) constructs `Ok(..)` -- none ever produces `Err`, so this `if let`'s implicit else can't be taken; symmetric to L1625's `?` (#798)
`src/jq/document.rs`	`tolerate`	1125-1132	both	unreachable: both implementors (StandardJson, YamlValue) override this to decode once; the default exists as the contract a future implementor inherits, and is deliberately the two-call sequence it replaces (#965)
`src/jq/eval.rs`	`tolerate`	1142	both	unreachable: def is always a collect_alias_groups anchor path, which step_to_expr never fails on (#1351)
`src/jq/eval.rs`	`tolerate`	1163	both	unreachable: redirect_paths with Redirect::SINGLE always contributes exactly one output per input, so a 1-element paths always pops Some (#1351)
`src/jq/eval.rs`	`tolerate`	1172	both	unreachable: a concrete setpath/delpaths path's components are always Field/Index -- step_to_expr never produces another shape (#1351)
`src/jq/eval.rs`	`tolerate`	1176	both	unreachable: the map above never yields None, since it only ever matches Field/Index (#1351)
`src/jq/eval.rs`	`tolerate`	4388	both	unreachable: `is_escape()` is exactly `Error
`src/jq/eval.rs`	`tolerate`	4389	both	unreachable: see the `if let` above -- `push_owned_values` never answers `None` for an `is_escape()` result (#2180)
`src/jq/eval.rs`	`tolerate`	5599	both	unreachable today: to_owned's only failures are is_decode_failure()-tagged, and suppresses() answers false for those whatever `optional` is -- the same defensive-but-dead arm eval_generic's own Builtin::Path materialization documents under #2280 (#2908)
`src/jq/eval.rs`	`tolerate`	6339	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval.rs`	`tolerate`	7488	both	unreachable: `optional` is never `true` here. `eval_each` is entered with a forced `true` at exactly one site (`Expr::Optional` over an `IndexExpr`/`SliceExpr`), and both of those evaluate their target (`eval_index_expr`) and their key (`eval_each(key, .., false)`) with a hardcoded `false`, so only the final index/slice step ever sees it -- nothing carries it down to an `Expr::Object` (#2180)
`src/jq/eval.rs`	`tolerate`	10804	both	unreachable: every entry point supplies path context, so `path` never evaluates without one; pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval.rs`	`tolerate`	10934	both	unreachable: only ever constructed by builtin_sort_keys's own eval_update_no_vivify call, whose enclosing eval_update_impl already runs to_owned on the whole document up front (#2855) -- a decode failure anywhere raises there, before this filter ever sees a value to re-decode; confirmed live, `sort_keys(.a)`/`sort_keys(..)` on a document with a decode-failure subtree both raise from the outer to_owned
`src/jq/eval.rs`	`tolerate`	22000	both	unreachable: escape_with_prefix! sets `terminal` before Demand::Stop; already returned above (#2138)
`src/jq/eval.rs`	`tolerate`	22369	both	unreachable: escape! sets `terminal` before Demand::Stop; already returned above (#2546)
`src/jq/eval.rs`	`tolerate`	30250	both	reachable only on a genuine allocation failure: `Vec::try_reserve(1)` on a vector that has spare capacity, or can grow, cannot fail -- this is the whole purpose of the branch, converting an OOM into a catchable error rather than an abort (ADR-0018's 'would take the host process down' exception). The pre-#2267 form of the same guard, `out.try_reserve(branches.len())` in `resolve_index_expr`/`resolve_slice_expr`, was 0-hit for the identical reason (#2267)
`src/jq/eval.rs`	`tolerate`	30251	both	see the line above -- the `Demand::Stop` half of the same allocation-failure-only branch (#2267)
`src/jq/eval.rs`	`tolerate`	30257	both	reachable only when the `try_reserve` above failed, i.e. only on a genuine allocation failure (#2267)
`src/jq/eval.rs`	`tolerate`	32505	both	unreachable: `is_primitive` admits only Identity/Field/Index/Slice, and of those only a Slice's computed bounds can halt -- all four have their own arm in `resolve_node_sink`/`resolve_node_eager`, so none reaches this function. Pre-existing; #2694 only wrapped the return in `Some` (#2694)
`src/jq/eval.rs`	`tolerate`	32539	both	unreachable, as this arm's own comment above says: indexing or slicing a value yields zero or one result, so `is_primitive` never produces more than one -- kept as a named error rather than a panic. Pre-existing; #2694 only wrapped the enclosing return in `Some` (#2694)
`src/jq/eval.rs`	`tolerate`	34867	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval.rs`	`tolerate`	35899	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval.rs`	`tolerate`	35923	both	unreachable: every arm of the loop's last iteration returns -- a walk refusal, an exhausted walk, and a step outcome that never retries on the last alternative (#2979, #2872)
`src/jq/eval.rs`	`tolerate`	36470	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval.rs`	`tolerate`	36490	both	unreachable: every path through the loop's last iteration returns -- a walk refusal, an exhausted walk, and a step outcome that never retries on the last alternative (#2979, #2872)
`src/jq/eval.rs`	`tolerate`	39159	both	unreachable in a passing suite by design -- a panic-message format argument for the #682 single-valued-tail pin, evaluated only if that assert's own condition is false (#2190)
`src/jq/eval.rs`	`tolerate`	39236	both	unreachable: the only caller reaches this after classify_static_component answered Field for this same value, which it does only for an object (#2190)
`src/jq/eval.rs`	`tolerate`	39280	both	unreachable: both callers establish the container first -- navigate_static_component_ref via classify_static_component's Index arm, and walk_path's Expr::Iterate arm by matching on the container itself (#2190)
`src/jq/eval.rs`	`tolerate`	41681	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval.rs`	`tolerate`	41858	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval.rs`	`tolerate`	43177	both	unreachable: stop_with_escape's only write is `slot.set(Some(control))` with the control it was handed, which is always the `Control::Error` built one line above (#2180)
`src/jq/eval.rs`	`tolerate`	43528	both	unreachable: on_update records a `step_outcome` before every Demand::Stop it answers, and the fallback match runs only when it recorded none (#2872)
`src/jq/eval.rs`	`tolerate`	43551	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval.rs`	`tolerate`	44067	both	unreachable by construction: the per-fork match only ever hands stop_with_downstream a non-Exhausted flow, so `terminal` can never hold Exhausted. `foreach_forks`' identical arm is 0-hit for the same reason and is only unflagged because it predates this diff (#2899)
`src/jq/eval.rs`	`tolerate`	46816	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval.rs`	`tolerate`	48789	both	pre-existing zero-hit line; #2999 changed only which null constant it names
`src/jq/eval.rs`	`tolerate`	51423	both	defensive, unreachable via ordinary JSON parsing (#3068)
`src/jq/eval.rs`	`tolerate`	51426	both	defensive, unreachable via ordinary JSON parsing (#3068)
`src/jq/eval.rs`	`tolerate`	51467	both	`optional` is never true through either caller of this function -- confirmed live (`eprintln!` probe): `[1,2,3]
`src/jq/eval.rs`	`tolerate`	51476	both	every array literal written in filter source, and every array-element JSON parses, decodes to NumberLiteral (#1035), not a bare Int -- Int is for internally-synthesized values spliced post-parse; probed a computed element ([1970,(0+0),..]) and it still decoded as NumberLiteral here, so this arm has no known real producer (#3068)
`src/jq/eval.rs`	`tolerate`	51491	both	`optional` is never true through this call path -- see the array-length check above (#3068)
`src/jq/eval.rs`	`tolerate`	51506	both	`optional` is never true through either caller of this function, same as the array-length check above (#3068)
`src/jq/eval.rs`	`tolerate`	53271	both	unreachable from `combinations`, whose own empty-input return runs first; pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval.rs`	`tolerate`	54366	both	confirmed live (eprintln! probe): optional is always false in builtin_abs regardless of whether the filter writes abs?, since that suppression happens entirely outside builtin dispatch here -- the same 'optional is never true here' shape eval.rs already documents elsewhere (#2180) (#3041)
`src/jq/eval.rs`	`tolerate`	56344	both	unreachable: the sink is a plain collector that always answers Demand::Continue (#2872)
`src/jq/eval.rs`	`tolerate`	56454	both	unreachable: `optional: false` makes index_one_owned answer Ok(Some)/Err only (#2872)
`src/jq/eval.rs`	`tolerate`	56600	both	unreachable: `pattern_has_computed_key` is false for `Pattern::Var`, so the loop walker above always takes it (#2872)
`src/jq/eval.rs`	`tolerate`	56647	both	unreachable: every caller gates on `pattern_has_computed_key` being false (#2872)
`src/jq/eval.rs`	`tolerate`	57699	both	unreachable in practice: a def with more than 32 parameters; the fallback exists so ScopeMask's one-bit-per-parameter u64 is a performance ceiling rather than a correctness limit (#2633)
`src/jq/eval.rs`	`tolerate`	57725	both	unreachable: bind_def_call only calls this for a non-empty params, and install_def_calls only builds a DefCall whose args.len() equals params.len(), so the zip is never empty here (#2560)
`src/jq/eval.rs`	`tolerate`	57745	both	unreachable in practice: needs more than 32 duplicated-name parameters; see the non-duplicate path's own note (#2633)
`src/jq/eval.rs`	`tolerate`	57766	both	unreachable: `name` was just read from `params`, so the zip over (params, args) has a matching pair unless args is shorter than params, which install_def_calls' own arity guard rules out (#2560)
`src/jq/eval.rs`	`tolerate`	57786	both	unreachable: `params` is non-empty here (bind_def_call's own guard) and its first entry is never skipped, so at least one substitution always ran (#2560)
`src/jq/eval.rs`	`tolerate`	57847	both	unreachable: same arity invariant as bind_def_call_params' own copy of this loop -- `name` came from `params`, so the zip has a matching pair unless args is shorter, which install_def_calls rules out (#2560)
`src/jq/eval.rs`	`tolerate`	59165	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
`src/jq/eval.rs`	`tolerate`	59187	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
`src/jq/eval.rs`	`tolerate`	59205	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
`src/jq/eval.rs`	`tolerate`	59275	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
`src/jq/eval.rs`	`tolerate`	59289	both	substitute_func_param_impl's FuncDef arm always returns FuncDef (#2555)
`src/jq/eval.rs`	`tolerate`	66445	both	unreachable in a passing suite by design -- this is the failure message for the assertion the test exists to make (#2190)
`src/jq/eval.rs`	`tolerate`	78491	both	unreachable in a passing suite by design -- this test's own diagnostic (#3071)
`src/jq/eval.rs`	`tolerate`	83932	both	unreachable in a passing suite by design -- this test's own diagnostic (#3071)
`src/jq/eval.rs`	`tolerate`	89735	both	unreachable in a passing suite by design -- this test's own diagnostic (#3071)
`src/jq/eval.rs`	`tolerate`	96291	both	unreachable in a passing suite by design -- every filter this helper is called with parses to an AsPattern (#2649)
`src/jq/eval.rs`	`tolerate`	96335	both	unreachable in a passing suite by design -- a literal-key pattern's walk either completes or refuses with an error (#2872)
`src/jq/eval.rs`	`tolerate`	96344	both	unreachable in a passing suite by design -- every call site passes the origin of a binding this same test already proved carries a marker (#2649)
`src/jq/eval.rs`	`tolerate`	96672	both	unreachable in a passing suite by design -- the assertion above is the test (#2872)
`src/jq/eval.rs`	`tolerate`	97319	both	unreachable in a passing suite by design -- every row here is a shape jq accepts, confirmed live (#2649)
`src/jq/eval.rs`	`tolerate`	97387	both	unreachable in a passing suite by design -- every row here is a shape jq refuses, confirmed live (#2649)
`src/jq/eval.rs`	`tolerate`	97772	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the let-else pattern fails to match (#2072)
`src/jq/eval.rs`	`tolerate`	97783	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the let-else pattern fails to match (#2072)
`src/jq/eval.rs`	`tolerate`	97804	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the match doesn't hit the expected arm above (#2072)
`src/jq/eval.rs`	`tolerate`	97820	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the match doesn't hit the expected arm above (#2072)
`src/jq/eval.rs`	`tolerate`	97905	both	unreachable in a passing suite by design -- every expression this closure receives is built by `marker` above (#3037)
`src/jq/eval.rs`	`tolerate`	97983	both	unreachable in a passing suite by design -- `rewrite_markers` rebuilds the same node kind it was given (#3037)
`src/jq/eval.rs`	`tolerate`	99467	head	unreachable in a passing suite by design -- this is the panic message for the assertion above, only formatted if the match doesn't hit the Error arm (#3119)
`src/jq/eval.rs`	`tolerate`	101787	both	unreachable in a passing suite by design -- this is the failure message for the assertion this test exists to make (#2937)
`src/jq/eval.rs`	`tolerate`	101941	both	every pinned filter below yields an owned value; kept so a cursor answer still renders rather than panics (#2999)
`src/jq/eval.rs`	`tolerate`	101942	both	unreachable in a passing suite by design -- the failure message for the assertions this helper serves (#2999)
`src/jq/eval_generic.rs`	`tolerate`	3723	both	unreachable: the sole remaining caller (`retain_truthy_generic`'s `Many` arm) runs `to_owned` on an item before keeping it, so re-converting a kept item here cannot fail; the `ManyCursor` caller that made this reachable went with the truthiness walk (#2692, re-establishing #2661's premise)
`src/jq/eval_generic.rs`	`tolerate`	7081	both	unreachable in a passing suite by design -- this is the panic message for the #2368 pin itself, only formatted if the assert's own condition is false (#2368)
`src/jq/eval_generic.rs`	`tolerate`	8940	both	the CLI evaluates every program that uses input/inputs on the eager route (jq_runner's can_use_lazy_path excludes them), so this guard never fires today -- #2968's identical guards on the arms above are equally unfired; kept for the day the lazy path admits such a program (#1309)
`src/jq/eval_generic.rs`	`tolerate`	8957	both	the CLI evaluates every program that uses input/inputs on the eager route (jq_runner's can_use_lazy_path excludes them), so this guard never fires today -- #2968's identical guards on the arms above are equally unfired; kept for the day the lazy path admits such a program (#1309)
`src/jq/eval_generic.rs`	`tolerate`	10142	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval_generic.rs`	`tolerate`	11634	both	unreachable: every producer that reaches this empty-`exprs` tail (`each_lazy_keys_iterate_sink`'s `sorted`/`!sorted` arms, `each_lazy_index_range_iterate_sink`, `each_lazy_seq_iterate_sink`) yields `OneCursorValue`/`OneCursor`/`Owned`, never a cursorless `GenericItem::One` -- so `cursor` is always `Some` here; kept for exhaustiveness/symmetry with the `Some` arm (#2103)
`src/jq/eval_generic.rs`	`tolerate`	14752	both	unreachable: escape_generic!/ensure_owned! set `terminal` before Demand::Stop; already returned above (#2138)
`src/jq/eval_generic.rs`	`tolerate`	15106	both	unreachable: escape! sets `terminal` before Demand::Stop; already returned above (#2546)
`src/jq/eval_generic.rs`	`tolerate`	15698	both	unreachable by construction: key_elements_generic builds every key of a run from the same Option<&Expr> (#2999)
`src/jq/eval_generic.rs`	`tolerate`	15708	both	unreachable by construction: key_elements_generic builds every key of a run from the same Option<&Expr> (#2999)
`src/jq/eval_generic.rs`	`tolerate`	16221	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval_generic.rs`	`tolerate`	17903	both	unreachable: `len_checked` and `SliceBounds::resolve` already bound every index in `range` to `[0, len)`, so `get_cursor` cannot miss (#2168)
`src/jq/eval_generic.rs`	`tolerate`	20686	both	unreachable by construction: path_context_resolvable admits an any(cond) read only through admits.prefetch, so the rewriter always has one -- the AnyCond arm above carries the identical assertion (#3079)
`src/jq/eval_generic.rs`	`tolerate`	20690	both	unreachable by construction, see above
`src/jq/eval_generic.rs`	`tolerate`	20691	both	unreachable by construction, see above
`src/jq/eval_generic.rs`	`tolerate`	21493	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval_generic.rs`	`tolerate`	21514	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval_generic.rs`	`tolerate`	21857	both	unreachable: `malformed_object_member` above already proved every key stringifies (the `None` half), and `to_owned_cursor` on an untagged key `decoded_key_str` decoded cannot fail (the `Err` half) (#2785)
`src/jq/eval_generic.rs`	`tolerate`	21938	both	unreachable: `map(f)` over an array emits exactly one array; kept so a future `map` shape produces no output rather than a panic (#2785)
`src/jq/eval_generic.rs`	`tolerate`	22225	both	unreachable by design -- eval_single's #2368 debug_assert forbids optional=true on Builtin::Reverse, so length never answers None here (#2730)
`src/jq/eval_generic.rs`	`tolerate`	22827	both	the CLI evaluates every program that uses input/inputs on the eager route (jq_runner's can_use_lazy_path excludes them), so this guard never fires today -- #2968's identical guards on the arms above are equally unfired; kept for the day the lazy path admits such a program (#1309)
`src/jq/eval_generic.rs`	`tolerate`	22833	both	see above: the input-queue deferral never fires from the CLI
`src/jq/eval_generic.rs`	`tolerate`	24277	both	unreachable by construction: every shape either guard admits now has an arm above (#2771), and expr_dispatch_catchall_guards_default_conservatively_2549 pins both guards' `_ => false` defaults directly
`src/jq/eval_generic.rs`	`tolerate`	24826	both	unreachable in a passing suite by design -- `owned_identity_rule` maps a bare `Expr::Var` to `Bound` too (for the static gate, which sees a body before its `as` substitution runs), but every runtime dispatch that reaches this rule (`owned_identity_after_stage`/`owned_identity_placed_by`, from `owned_identity_leaving_cursor`'s `Bound` arm) only ever sees a stage after `eval_owned_identity_as`'s unconditional `substitute_bound_var_from` call, which always turns `$x` into `Expr::TrackedVar` before recursing -- confirmed by running the full suite with this arm replaced by a hard `panic!()`, which never fired (#2072)
`src/jq/eval_generic.rs`	`tolerate`	24844	both	unreachable: this `Slice` rule's own two execution paths both exclude `Expr::Slice` before ever reaching `owned_identity_placed_by` -- `eval_owned_identity_stages`'s catch-all only runs a stage `owned_identity_nav_supported` refused, and `owned_identity_leaving_cursor` (`identity_from_first`, eval_generic.rs:10724) only runs a stage `path_context_is_navigational` refused -- and both predicates admit `Expr::Slice` (`owned_identity_nav_supported`/`path_context_is_navigational_at` each list `Expr::Slice { .. } => true`), so a bare slice is always resolved by `owned_identity_step`'s own arm first. Kept in `owned_identity_rule`'s match for exhaustiveness/symmetry with the rule table's other entries, the same reason #2072's `Bound` arm above is kept unreachable-by-construction (#2966's review of #2834)
`src/jq/eval_generic.rs`	`tolerate`	26343	both	optional is never true through this pipe: `?` is eval_owned_identity_try, which catches the escape instead, and after #693 only the IndexExpr/SliceExpr special case ever sets it -- kept as any_all_f's scalar_fallback mirror
`src/jq/eval_generic.rs`	`tolerate`	26344	both	optional is never true here, see above
`src/jq/eval_generic.rs`	`tolerate`	26734	both	unreachable in a passing suite by design -- the failure message for the assertion the tests below make (#2999)
`src/jq/eval_generic.rs`	`tolerate`	26851	both	unreachable in a passing suite by design -- the fixture's map(.+1) is always a LazySeq; this arm is the test's own diagnostic (#2666)
`src/jq/eval_generic.rs`	`tolerate`	26879	both	unreachable in a passing suite by design -- the fixture's only escape is Control::Error; this arm is the test's own diagnostic (#2666)
`src/jq/parser.rs`	`tolerate`	226	both	unreachable: parse_join_expr only calls join_expr with two to four arguments (#3046)
`src/jq/parser.rs`	`tolerate`	248	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
`src/jq/parser.rs`	`tolerate`	250	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
`src/jq/parser.rs`	`tolerate`	252	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
`src/jq/parser.rs`	`tolerate`	259	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
`src/jq/parser.rs`	`tolerate`	263	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
`src/jq/parser.rs`	`tolerate`	279	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
`src/jq/parser.rs`	`tolerate`	8949	both	unreachable in a passing suite by design -- this is the panic message for the #3044 pin itself, only formatted if the let-else pattern fails to match (#3044)
`src/jq/resolve.rs`	`tolerate`	2261	both	unreachable in practice today: this arm needs builtin_fallback==None (the name was never a shadow candidate) yet is_jq_builtin==true (a real jq builtin at this arity) -- every implemented builtin's own dedicated parse already lowers that shape to Expr::Builtin before resolve.rs ever runs, and #3042/#3046 closed the once-real 'unimplemented builtin' gap this existed for (see JQ_BUILTIN_ROSTER's own doc comment)
`src/jq/resolve.rs`	`tolerate`	2263	both	unreachable with the current roster: every `JQ_BUILTIN_ROSTER` entry of arity >= 1 already has a dedicated parser form (a `matches_keyword` special case or a `Libm1`/`Libm2`/`Libm3::ALL` entry -- confirmed by cross-referencing the full roster against both), so it is parsed straight to `Expr::Builtin` and never reaches here as a bare `FuncCall`. This arm exists for a roster name with no dedicated parse yet and a nonzero arity -- there is none today, so the loop body is reached with an empty `args` on every pinned-suite run (355 hits on the arm's own condition, 0 in the loop) and would only start executing if such a name were added (#2964)
`src/jq/share_stats.rs`	`tolerate`	97	both	process-global env var; exercised by the CLI audit run, not by an in-process test (#2999)
`src/jq/value.rs`	`tolerate`	358	both	unreachable by construction: the slow path is entered only after `significant_digit_count` found 18+ digits over the same mantissa bytes this loop walks (#2936)
`src/jq/value.rs`	`tolerate`	382	both	unreachable by construction: 18+ significant digits were counted, so at least one nonzero digit was kept (#2936)
`src/jq/value.rs`	`tolerate`	2771	both	unreachable: `format_float_with_fraction` of a finite double is always RFC 8259 number text, which `parse_i64_or_f64` reads (#2936)
`src/jq/value.rs`	`tolerate`	4541	both	unreachable in a passing suite by design -- every caller built the value as an array (#2999)
`src/jq/value.rs`	`tolerate`	4784	both	unreachable in a passing suite by design -- the value was built as this container a few lines above (#2999)
`src/jq/value.rs`	`tolerate`	5603	both	unreachable in a passing suite by design -- the failure message for a malformed oracle table (#2936)
`src/json/light.rs`	`tolerate`	7068	both	unreachable in a passing suite by design -- the failure message for the assertion this #2877 test exists to make
`src/json/light.rs`	`tolerate`	7150	both	unreachable in a passing suite by design -- the failure message for the assertion this #2877 test exists to make
`src/json/light.rs`	`tolerate`	7238	both	unreachable in a passing suite by design -- the failure message for the assertion this #2877 test exists to make
`src/json/light.rs`	`tolerate`	7263	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
`src/json/light.rs`	`tolerate`	7274	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
`src/json/light.rs`	`tolerate`	7355	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
`src/yaml/index.rs`	`tolerate`	1268	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
`src/yaml/index.rs`	`tolerate`	1272	both	unreachable: every fixture field_key_head_foot is called with in this test module is a top-level mapping (#798)
`src/yaml/index.rs`	`tolerate`	1283	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this if-let's pattern can never fail to match (#798)
`src/yaml/index.rs`	`tolerate`	1285	both	unreachable: every call to field_key_head_foot in this test module passes a key that the fixture's mapping actually has (#798)
`src/yaml/index.rs`	`tolerate`	1295	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
`src/yaml/index.rs`	`tolerate`	1299	both	unreachable: every fixture seq_item_head_foot is called with in this test module is a top-level sequence (#798)
`src/yaml/index.rs`	`tolerate`	1322	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
`src/yaml/index.rs`	`tolerate`	1341	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
`src/yaml/index.rs`	`tolerate`	1364	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
`src/yaml/index.rs`	`tolerate`	1373	both	unreachable: every fixture field_key_head_foot_in_doc is called with in this test module is a top-level mapping (#798)
`src/yaml/index.rs`	`tolerate`	1384	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this if-let's pattern can never fail to match (#798)
`src/yaml/index.rs`	`tolerate`	1386	both	unreachable: every call to field_key_head_foot_in_doc in this test module passes a key that the fixture's document actually has (#798)
`src/yaml/index.rs`	`tolerate`	1397	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
`src/yaml/index.rs`	`tolerate`	1401	both	unreachable: every fixture nested_key_head_foot is called with in this test module is a top-level mapping (#798)
`src/yaml/index.rs`	`tolerate`	1405	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this let-else's pattern can never fail to match (#798)
`src/yaml/index.rs`	`tolerate`	1411	both	unreachable: every fixture nested_key_head_foot is called with has a nested mapping under `outer` (#798)
`src/yaml/index.rs`	`tolerate`	1422	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this if-let's pattern can never fail to match (#798)
`src/yaml/index.rs`	`tolerate`	1425	both	unreachable: every call to nested_key_head_foot in this test module passes an outer.inner pair that the fixture actually has (#798)
`src/yaml/light.rs`	`tolerate`	3364	both	unreachable: an alias target is never None for a built index (#1374)
`src/yaml/light.rs`	`tolerate`	15398	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
`src/yaml/light.rs`	`tolerate`	15409	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
`src/yaml/light.rs`	`tolerate`	15566	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
`src/yaml/parser.rs`	`tolerate`	1583	both	unreachable: every block-sequence open registers a frame at its own depth before any item of it can be parsed (#1079)
`src/yaml/parser.rs`	`tolerate`	1613	both	unreachable: this function's sole caller (record_standalone_comment) only invokes it from inside a match on `pending_head_lines.last()`, so pending_head_lines is already known non-empty here (#798)
`src/yaml/parser.rs`	`tolerate`	7999	both	unreachable: every byte here already passed the `[0-9.eE+-]` charset check above, a strict subset of ASCII, so `str::from_utf8` can never fail (#2778)

Patch coverage

Patch: 99.32% (146/147 new lines covered)

File	Patch	Uncovered new lines
`src/jq/eval.rs`	99.32% (146/147)	99467

Uncovered new lines (1)

src/jq/eval.rs:99467

_{📦 Full per-file coverage summary · run summary}

github-actions · 2026-09-18T08:11:30Z

Coverage

Total: 93.92% ⚪ 0.01 pp vs main (not attributable to this diff)

Comparing 54ff9d0..b222790 (merge-base → PR head)

No per-file coverage changes vs main.

🔇 0 ignored region(s), 168 tolerated region(s)

ignore removes the lines from both reports; tolerate keeps them in the reported percentage but scores them against the baseline, so a cross-run flip cannot move a delta. Regions are read from each revision's own source.

File	Kind	Lines	Rev	Reason
`src/bin/succinctly/jq_runner.rs`	`tolerate`	1499-1511	both	unreachable: `try_parse_meta_op` only fires under `ParserMode::Yq` (src/jq/parser.rs), and `rewrite_namespaced_calls` is only reached via `ModuleProcessor::process_program`, which jq_runner's own jq-mode `run` is the sole caller of -- so a `MetaAssign` node can never reach this function (#798)
`src/bin/succinctly/jq_runner.rs`	`tolerate`	2124	both	unreachable by construction: every error this wrapper receives today is a decode or nesting-depth failure the evaluator raised itself, never error(v); kept so a future one is rendered rather than dropped (#2999)
`src/bin/succinctly/jq_runner.rs`	`tolerate`	2125	both	see the arm above (#2999)
`src/bin/succinctly/jq_runner.rs`	`tolerate`	2682-2685	both	unreachable in a single-process run by construction: `run_id_for` (the sole source of an `origin` id) always inserts a `run_origins` entry for the id it hands back -- from a real load's canonical path, or its own literal-path fallback on a resolve failure -- and a def body only ever gets stamped with an `origin` after its module loaded successfully, so `at` always names a file that existed and was readable moments earlier. Reaching this arm needs that same file to vanish (or become unreadable) in the narrow window between that load and this re-read, entirely outside this process's control (#2964)
`src/bin/succinctly/jq_runner.rs`	`tolerate`	2942	both	unreachable: widening the shadow-candidate set never rejects a program the first parse accepted -- a newly covered name only wraps an already-successful dedicated parse, and a failing one would have propagated its error in the first parse too, so the retry budget is charged at the identical sites in both (#2395)
`src/bin/succinctly/jq_runner.rs`	`tolerate`	9148	both	unreachable in a passing suite by design -- the fixed b\
`src/bin/succinctly/main.rs`	`tolerate`	1430	both	the CLI suites drive yq through the `syq` multi-call arm above; this arm is the same call reached only when spelled `succinctly yq` (#2999)
`src/bin/succinctly/yq_runner.rs`	`tolerate`	1652	both	unreachable: bytes already parsed successfully by every caller (#1350)
`src/bin/succinctly/yq_runner.rs`	`tolerate`	3318	both	unreachable: `path` is always the raw output of the `path(TARGET)` builtin evaluated a few lines up in `resolve_one_meta_assign` -- `path/1` is a jq/yq language invariant that always answers an array of path components (see `Expr::Builtin(Builtin::PathNoArg) => Ok(Some(OwnedValue::Array(..)))` in eval_generic.rs), never any other shape (#798)
`src/bin/succinctly/yq_runner.rs`	`tolerate`	3420	both	unreachable: `resolve_meta_assign_writes` runs `expr` through this before any evaluation begins (see its own doc comment), and `Expr::Shared` is never constructed by the parser -- only at eval time, by function-call argument substitution (`substitute_func_param` in eval.rs) -- so a pre-evaluation AST can never contain one here (#798)
`src/bin/succinctly/yq_runner.rs`	`tolerate`	4052	both	unreachable: every arm of the `match result { .. }` above that assigns `docs` (L3492-3622) constructs `Ok(..)` -- none ever produces `Err`, so this `if let`'s implicit else can't be taken; symmetric to L1625's `?` (#798)
`src/jq/document.rs`	`tolerate`	1125-1132	both	unreachable: both implementors (StandardJson, YamlValue) override this to decode once; the default exists as the contract a future implementor inherits, and is deliberately the two-call sequence it replaces (#965)
`src/jq/eval.rs`	`tolerate`	1142	both	unreachable: def is always a collect_alias_groups anchor path, which step_to_expr never fails on (#1351)
`src/jq/eval.rs`	`tolerate`	1163	both	unreachable: redirect_paths with Redirect::SINGLE always contributes exactly one output per input, so a 1-element paths always pops Some (#1351)
`src/jq/eval.rs`	`tolerate`	1172	both	unreachable: a concrete setpath/delpaths path's components are always Field/Index -- step_to_expr never produces another shape (#1351)
`src/jq/eval.rs`	`tolerate`	1176	both	unreachable: the map above never yields None, since it only ever matches Field/Index (#1351)
`src/jq/eval.rs`	`tolerate`	4388	both	unreachable: `is_escape()` is exactly `Error
`src/jq/eval.rs`	`tolerate`	4389	both	unreachable: see the `if let` above -- `push_owned_values` never answers `None` for an `is_escape()` result (#2180)
`src/jq/eval.rs`	`tolerate`	5599	both	unreachable today: to_owned's only failures are is_decode_failure()-tagged, and suppresses() answers false for those whatever `optional` is -- the same defensive-but-dead arm eval_generic's own Builtin::Path materialization documents under #2280 (#2908)
`src/jq/eval.rs`	`tolerate`	6339	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval.rs`	`tolerate`	7488	both	unreachable: `optional` is never `true` here. `eval_each` is entered with a forced `true` at exactly one site (`Expr::Optional` over an `IndexExpr`/`SliceExpr`), and both of those evaluate their target (`eval_index_expr`) and their key (`eval_each(key, .., false)`) with a hardcoded `false`, so only the final index/slice step ever sees it -- nothing carries it down to an `Expr::Object` (#2180)
`src/jq/eval.rs`	`tolerate`	10804	both	unreachable: every entry point supplies path context, so `path` never evaluates without one; pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval.rs`	`tolerate`	10934	both	unreachable: only ever constructed by builtin_sort_keys's own eval_update_no_vivify call, whose enclosing eval_update_impl already runs to_owned on the whole document up front (#2855) -- a decode failure anywhere raises there, before this filter ever sees a value to re-decode; confirmed live, `sort_keys(.a)`/`sort_keys(..)` on a document with a decode-failure subtree both raise from the outer to_owned
`src/jq/eval.rs`	`tolerate`	22000	both	unreachable: escape_with_prefix! sets `terminal` before Demand::Stop; already returned above (#2138)
`src/jq/eval.rs`	`tolerate`	22369	both	unreachable: escape! sets `terminal` before Demand::Stop; already returned above (#2546)
`src/jq/eval.rs`	`tolerate`	30250	both	reachable only on a genuine allocation failure: `Vec::try_reserve(1)` on a vector that has spare capacity, or can grow, cannot fail -- this is the whole purpose of the branch, converting an OOM into a catchable error rather than an abort (ADR-0018's 'would take the host process down' exception). The pre-#2267 form of the same guard, `out.try_reserve(branches.len())` in `resolve_index_expr`/`resolve_slice_expr`, was 0-hit for the identical reason (#2267)
`src/jq/eval.rs`	`tolerate`	30251	both	see the line above -- the `Demand::Stop` half of the same allocation-failure-only branch (#2267)
`src/jq/eval.rs`	`tolerate`	30257	both	reachable only when the `try_reserve` above failed, i.e. only on a genuine allocation failure (#2267)
`src/jq/eval.rs`	`tolerate`	32505	both	unreachable: `is_primitive` admits only Identity/Field/Index/Slice, and of those only a Slice's computed bounds can halt -- all four have their own arm in `resolve_node_sink`/`resolve_node_eager`, so none reaches this function. Pre-existing; #2694 only wrapped the return in `Some` (#2694)
`src/jq/eval.rs`	`tolerate`	32539	both	unreachable, as this arm's own comment above says: indexing or slicing a value yields zero or one result, so `is_primitive` never produces more than one -- kept as a named error rather than a panic. Pre-existing; #2694 only wrapped the enclosing return in `Some` (#2694)
`src/jq/eval.rs`	`tolerate`	34867	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval.rs`	`tolerate`	35899	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval.rs`	`tolerate`	35923	both	unreachable: every arm of the loop's last iteration returns -- a walk refusal, an exhausted walk, and a step outcome that never retries on the last alternative (#2979, #2872)
`src/jq/eval.rs`	`tolerate`	36470	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval.rs`	`tolerate`	36490	both	unreachable: every path through the loop's last iteration returns -- a walk refusal, an exhausted walk, and a step outcome that never retries on the last alternative (#2979, #2872)
`src/jq/eval.rs`	`tolerate`	39159	both	unreachable in a passing suite by design -- a panic-message format argument for the #682 single-valued-tail pin, evaluated only if that assert's own condition is false (#2190)
`src/jq/eval.rs`	`tolerate`	39236	both	unreachable: the only caller reaches this after classify_static_component answered Field for this same value, which it does only for an object (#2190)
`src/jq/eval.rs`	`tolerate`	39280	both	unreachable: both callers establish the container first -- navigate_static_component_ref via classify_static_component's Index arm, and walk_path's Expr::Iterate arm by matching on the container itself (#2190)
`src/jq/eval.rs`	`tolerate`	41681	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval.rs`	`tolerate`	41858	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval.rs`	`tolerate`	43177	both	unreachable: stop_with_escape's only write is `slot.set(Some(control))` with the control it was handed, which is always the `Control::Error` built one line above (#2180)
`src/jq/eval.rs`	`tolerate`	43528	both	unreachable: on_update records a `step_outcome` before every Demand::Stop it answers, and the fallback match runs only when it recorded none (#2872)
`src/jq/eval.rs`	`tolerate`	43551	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval.rs`	`tolerate`	44067	both	unreachable by construction: the per-fork match only ever hands stop_with_downstream a non-Exhausted flow, so `terminal` can never hold Exhausted. `foreach_forks`' identical arm is 0-hit for the same reason and is only unflagged because it predates this diff (#2899)
`src/jq/eval.rs`	`tolerate`	46816	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval.rs`	`tolerate`	48789	both	pre-existing zero-hit line; #2999 changed only which null constant it names
`src/jq/eval.rs`	`tolerate`	51423	both	defensive, unreachable via ordinary JSON parsing (#3068)
`src/jq/eval.rs`	`tolerate`	51426	both	defensive, unreachable via ordinary JSON parsing (#3068)
`src/jq/eval.rs`	`tolerate`	51467	both	`optional` is never true through either caller of this function -- confirmed live (`eprintln!` probe): `[1,2,3]
`src/jq/eval.rs`	`tolerate`	51476	both	every array literal written in filter source, and every array-element JSON parses, decodes to NumberLiteral (#1035), not a bare Int -- Int is for internally-synthesized values spliced post-parse; probed a computed element ([1970,(0+0),..]) and it still decoded as NumberLiteral here, so this arm has no known real producer (#3068)
`src/jq/eval.rs`	`tolerate`	51491	both	`optional` is never true through this call path -- see the array-length check above (#3068)
`src/jq/eval.rs`	`tolerate`	51506	both	`optional` is never true through either caller of this function, same as the array-length check above (#3068)
`src/jq/eval.rs`	`tolerate`	53271	both	unreachable from `combinations`, whose own empty-input return runs first; pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval.rs`	`tolerate`	54366	both	confirmed live (eprintln! probe): optional is always false in builtin_abs regardless of whether the filter writes abs?, since that suppression happens entirely outside builtin dispatch here -- the same 'optional is never true here' shape eval.rs already documents elsewhere (#2180) (#3041)
`src/jq/eval.rs`	`tolerate`	56344	both	unreachable: the sink is a plain collector that always answers Demand::Continue (#2872)
`src/jq/eval.rs`	`tolerate`	56454	both	unreachable: `optional: false` makes index_one_owned answer Ok(Some)/Err only (#2872)
`src/jq/eval.rs`	`tolerate`	56600	both	unreachable: `pattern_has_computed_key` is false for `Pattern::Var`, so the loop walker above always takes it (#2872)
`src/jq/eval.rs`	`tolerate`	56647	both	unreachable: every caller gates on `pattern_has_computed_key` being false (#2872)
`src/jq/eval.rs`	`tolerate`	57699	both	unreachable in practice: a def with more than 32 parameters; the fallback exists so ScopeMask's one-bit-per-parameter u64 is a performance ceiling rather than a correctness limit (#2633)
`src/jq/eval.rs`	`tolerate`	57725	both	unreachable: bind_def_call only calls this for a non-empty params, and install_def_calls only builds a DefCall whose args.len() equals params.len(), so the zip is never empty here (#2560)
`src/jq/eval.rs`	`tolerate`	57745	both	unreachable in practice: needs more than 32 duplicated-name parameters; see the non-duplicate path's own note (#2633)
`src/jq/eval.rs`	`tolerate`	57766	both	unreachable: `name` was just read from `params`, so the zip over (params, args) has a matching pair unless args is shorter than params, which install_def_calls' own arity guard rules out (#2560)
`src/jq/eval.rs`	`tolerate`	57786	both	unreachable: `params` is non-empty here (bind_def_call's own guard) and its first entry is never skipped, so at least one substitution always ran (#2560)
`src/jq/eval.rs`	`tolerate`	57847	both	unreachable: same arity invariant as bind_def_call_params' own copy of this loop -- `name` came from `params`, so the zip has a matching pair unless args is shorter, which install_def_calls rules out (#2560)
`src/jq/eval.rs`	`tolerate`	59165	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
`src/jq/eval.rs`	`tolerate`	59187	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
`src/jq/eval.rs`	`tolerate`	59205	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
`src/jq/eval.rs`	`tolerate`	59275	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
`src/jq/eval.rs`	`tolerate`	59289	both	substitute_func_param_impl's FuncDef arm always returns FuncDef (#2555)
`src/jq/eval.rs`	`tolerate`	66445	both	unreachable in a passing suite by design -- this is the failure message for the assertion the test exists to make (#2190)
`src/jq/eval.rs`	`tolerate`	78491	both	unreachable in a passing suite by design -- this test's own diagnostic (#3071)
`src/jq/eval.rs`	`tolerate`	83932	both	unreachable in a passing suite by design -- this test's own diagnostic (#3071)
`src/jq/eval.rs`	`tolerate`	89735	both	unreachable in a passing suite by design -- this test's own diagnostic (#3071)
`src/jq/eval.rs`	`tolerate`	96291	both	unreachable in a passing suite by design -- every filter this helper is called with parses to an AsPattern (#2649)
`src/jq/eval.rs`	`tolerate`	96335	both	unreachable in a passing suite by design -- a literal-key pattern's walk either completes or refuses with an error (#2872)
`src/jq/eval.rs`	`tolerate`	96344	both	unreachable in a passing suite by design -- every call site passes the origin of a binding this same test already proved carries a marker (#2649)
`src/jq/eval.rs`	`tolerate`	96672	both	unreachable in a passing suite by design -- the assertion above is the test (#2872)
`src/jq/eval.rs`	`tolerate`	97319	both	unreachable in a passing suite by design -- every row here is a shape jq accepts, confirmed live (#2649)
`src/jq/eval.rs`	`tolerate`	97387	both	unreachable in a passing suite by design -- every row here is a shape jq refuses, confirmed live (#2649)
`src/jq/eval.rs`	`tolerate`	97772	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the let-else pattern fails to match (#2072)
`src/jq/eval.rs`	`tolerate`	97783	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the let-else pattern fails to match (#2072)
`src/jq/eval.rs`	`tolerate`	97804	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the match doesn't hit the expected arm above (#2072)
`src/jq/eval.rs`	`tolerate`	97820	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the match doesn't hit the expected arm above (#2072)
`src/jq/eval.rs`	`tolerate`	97905	both	unreachable in a passing suite by design -- every expression this closure receives is built by `marker` above (#3037)
`src/jq/eval.rs`	`tolerate`	97983	both	unreachable in a passing suite by design -- `rewrite_markers` rebuilds the same node kind it was given (#3037)
`src/jq/eval.rs`	`tolerate`	99467	head	unreachable in a passing suite by design -- this is the panic message for the assertion above, only formatted if the match doesn't hit the Error arm (#3119)
`src/jq/eval.rs`	`tolerate`	101787	both	unreachable in a passing suite by design -- this is the failure message for the assertion this test exists to make (#2937)
`src/jq/eval.rs`	`tolerate`	101941	both	every pinned filter below yields an owned value; kept so a cursor answer still renders rather than panics (#2999)
`src/jq/eval.rs`	`tolerate`	101942	both	unreachable in a passing suite by design -- the failure message for the assertions this helper serves (#2999)
`src/jq/eval_generic.rs`	`tolerate`	3723	both	unreachable: the sole remaining caller (`retain_truthy_generic`'s `Many` arm) runs `to_owned` on an item before keeping it, so re-converting a kept item here cannot fail; the `ManyCursor` caller that made this reachable went with the truthiness walk (#2692, re-establishing #2661's premise)
`src/jq/eval_generic.rs`	`tolerate`	7081	both	unreachable in a passing suite by design -- this is the panic message for the #2368 pin itself, only formatted if the assert's own condition is false (#2368)
`src/jq/eval_generic.rs`	`tolerate`	8940	both	the CLI evaluates every program that uses input/inputs on the eager route (jq_runner's can_use_lazy_path excludes them), so this guard never fires today -- #2968's identical guards on the arms above are equally unfired; kept for the day the lazy path admits such a program (#1309)
`src/jq/eval_generic.rs`	`tolerate`	8957	both	the CLI evaluates every program that uses input/inputs on the eager route (jq_runner's can_use_lazy_path excludes them), so this guard never fires today -- #2968's identical guards on the arms above are equally unfired; kept for the day the lazy path admits such a program (#1309)
`src/jq/eval_generic.rs`	`tolerate`	10142	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval_generic.rs`	`tolerate`	11634	both	unreachable: every producer that reaches this empty-`exprs` tail (`each_lazy_keys_iterate_sink`'s `sorted`/`!sorted` arms, `each_lazy_index_range_iterate_sink`, `each_lazy_seq_iterate_sink`) yields `OneCursorValue`/`OneCursor`/`Owned`, never a cursorless `GenericItem::One` -- so `cursor` is always `Some` here; kept for exhaustiveness/symmetry with the `Some` arm (#2103)
`src/jq/eval_generic.rs`	`tolerate`	14752	both	unreachable: escape_generic!/ensure_owned! set `terminal` before Demand::Stop; already returned above (#2138)
`src/jq/eval_generic.rs`	`tolerate`	15106	both	unreachable: escape! sets `terminal` before Demand::Stop; already returned above (#2546)
`src/jq/eval_generic.rs`	`tolerate`	15698	both	unreachable by construction: key_elements_generic builds every key of a run from the same Option<&Expr> (#2999)
`src/jq/eval_generic.rs`	`tolerate`	15708	both	unreachable by construction: key_elements_generic builds every key of a run from the same Option<&Expr> (#2999)
`src/jq/eval_generic.rs`	`tolerate`	16221	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval_generic.rs`	`tolerate`	17903	both	unreachable: `len_checked` and `SliceBounds::resolve` already bound every index in `range` to `[0, len)`, so `get_cursor` cannot miss (#2168)
`src/jq/eval_generic.rs`	`tolerate`	20686	both	unreachable by construction: path_context_resolvable admits an any(cond) read only through admits.prefetch, so the rewriter always has one -- the AnyCond arm above carries the identical assertion (#3079)
`src/jq/eval_generic.rs`	`tolerate`	20690	both	unreachable by construction, see above
`src/jq/eval_generic.rs`	`tolerate`	20691	both	unreachable by construction, see above
`src/jq/eval_generic.rs`	`tolerate`	21493	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval_generic.rs`	`tolerate`	21514	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval_generic.rs`	`tolerate`	21857	both	unreachable: `malformed_object_member` above already proved every key stringifies (the `None` half), and `to_owned_cursor` on an untagged key `decoded_key_str` decoded cannot fail (the `Err` half) (#2785)
`src/jq/eval_generic.rs`	`tolerate`	21938	both	unreachable: `map(f)` over an array emits exactly one array; kept so a future `map` shape produces no output rather than a panic (#2785)
`src/jq/eval_generic.rs`	`tolerate`	22225	both	unreachable by design -- eval_single's #2368 debug_assert forbids optional=true on Builtin::Reverse, so length never answers None here (#2730)
`src/jq/eval_generic.rs`	`tolerate`	22827	both	the CLI evaluates every program that uses input/inputs on the eager route (jq_runner's can_use_lazy_path excludes them), so this guard never fires today -- #2968's identical guards on the arms above are equally unfired; kept for the day the lazy path admits such a program (#1309)
`src/jq/eval_generic.rs`	`tolerate`	22833	both	see above: the input-queue deferral never fires from the CLI
`src/jq/eval_generic.rs`	`tolerate`	24277	both	unreachable by construction: every shape either guard admits now has an arm above (#2771), and expr_dispatch_catchall_guards_default_conservatively_2549 pins both guards' `_ => false` defaults directly
`src/jq/eval_generic.rs`	`tolerate`	24826	both	unreachable in a passing suite by design -- `owned_identity_rule` maps a bare `Expr::Var` to `Bound` too (for the static gate, which sees a body before its `as` substitution runs), but every runtime dispatch that reaches this rule (`owned_identity_after_stage`/`owned_identity_placed_by`, from `owned_identity_leaving_cursor`'s `Bound` arm) only ever sees a stage after `eval_owned_identity_as`'s unconditional `substitute_bound_var_from` call, which always turns `$x` into `Expr::TrackedVar` before recursing -- confirmed by running the full suite with this arm replaced by a hard `panic!()`, which never fired (#2072)
`src/jq/eval_generic.rs`	`tolerate`	24844	both	unreachable: this `Slice` rule's own two execution paths both exclude `Expr::Slice` before ever reaching `owned_identity_placed_by` -- `eval_owned_identity_stages`'s catch-all only runs a stage `owned_identity_nav_supported` refused, and `owned_identity_leaving_cursor` (`identity_from_first`, eval_generic.rs:10724) only runs a stage `path_context_is_navigational` refused -- and both predicates admit `Expr::Slice` (`owned_identity_nav_supported`/`path_context_is_navigational_at` each list `Expr::Slice { .. } => true`), so a bare slice is always resolved by `owned_identity_step`'s own arm first. Kept in `owned_identity_rule`'s match for exhaustiveness/symmetry with the rule table's other entries, the same reason #2072's `Bound` arm above is kept unreachable-by-construction (#2966's review of #2834)
`src/jq/eval_generic.rs`	`tolerate`	26343	both	optional is never true through this pipe: `?` is eval_owned_identity_try, which catches the escape instead, and after #693 only the IndexExpr/SliceExpr special case ever sets it -- kept as any_all_f's scalar_fallback mirror
`src/jq/eval_generic.rs`	`tolerate`	26344	both	optional is never true here, see above
`src/jq/eval_generic.rs`	`tolerate`	26734	both	unreachable in a passing suite by design -- the failure message for the assertion the tests below make (#2999)
`src/jq/eval_generic.rs`	`tolerate`	26851	both	unreachable in a passing suite by design -- the fixture's map(.+1) is always a LazySeq; this arm is the test's own diagnostic (#2666)
`src/jq/eval_generic.rs`	`tolerate`	26879	both	unreachable in a passing suite by design -- the fixture's only escape is Control::Error; this arm is the test's own diagnostic (#2666)
`src/jq/parser.rs`	`tolerate`	226	both	unreachable: parse_join_expr only calls join_expr with two to four arguments (#3046)
`src/jq/parser.rs`	`tolerate`	248	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
`src/jq/parser.rs`	`tolerate`	250	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
`src/jq/parser.rs`	`tolerate`	252	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
`src/jq/parser.rs`	`tolerate`	259	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
`src/jq/parser.rs`	`tolerate`	263	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
`src/jq/parser.rs`	`tolerate`	279	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
`src/jq/parser.rs`	`tolerate`	8949	both	unreachable in a passing suite by design -- this is the panic message for the #3044 pin itself, only formatted if the let-else pattern fails to match (#3044)
`src/jq/resolve.rs`	`tolerate`	2261	both	unreachable in practice today: this arm needs builtin_fallback==None (the name was never a shadow candidate) yet is_jq_builtin==true (a real jq builtin at this arity) -- every implemented builtin's own dedicated parse already lowers that shape to Expr::Builtin before resolve.rs ever runs, and #3042/#3046 closed the once-real 'unimplemented builtin' gap this existed for (see JQ_BUILTIN_ROSTER's own doc comment)
`src/jq/resolve.rs`	`tolerate`	2263	both	unreachable with the current roster: every `JQ_BUILTIN_ROSTER` entry of arity >= 1 already has a dedicated parser form (a `matches_keyword` special case or a `Libm1`/`Libm2`/`Libm3::ALL` entry -- confirmed by cross-referencing the full roster against both), so it is parsed straight to `Expr::Builtin` and never reaches here as a bare `FuncCall`. This arm exists for a roster name with no dedicated parse yet and a nonzero arity -- there is none today, so the loop body is reached with an empty `args` on every pinned-suite run (355 hits on the arm's own condition, 0 in the loop) and would only start executing if such a name were added (#2964)
`src/jq/share_stats.rs`	`tolerate`	97	both	process-global env var; exercised by the CLI audit run, not by an in-process test (#2999)
`src/jq/value.rs`	`tolerate`	358	both	unreachable by construction: the slow path is entered only after `significant_digit_count` found 18+ digits over the same mantissa bytes this loop walks (#2936)
`src/jq/value.rs`	`tolerate`	382	both	unreachable by construction: 18+ significant digits were counted, so at least one nonzero digit was kept (#2936)
`src/jq/value.rs`	`tolerate`	2771	both	unreachable: `format_float_with_fraction` of a finite double is always RFC 8259 number text, which `parse_i64_or_f64` reads (#2936)
`src/jq/value.rs`	`tolerate`	4541	both	unreachable in a passing suite by design -- every caller built the value as an array (#2999)
`src/jq/value.rs`	`tolerate`	4784	both	unreachable in a passing suite by design -- the value was built as this container a few lines above (#2999)
`src/jq/value.rs`	`tolerate`	5603	both	unreachable in a passing suite by design -- the failure message for a malformed oracle table (#2936)
`src/json/light.rs`	`tolerate`	7068	both	unreachable in a passing suite by design -- the failure message for the assertion this #2877 test exists to make
`src/json/light.rs`	`tolerate`	7150	both	unreachable in a passing suite by design -- the failure message for the assertion this #2877 test exists to make
`src/json/light.rs`	`tolerate`	7238	both	unreachable in a passing suite by design -- the failure message for the assertion this #2877 test exists to make
`src/json/light.rs`	`tolerate`	7263	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
`src/json/light.rs`	`tolerate`	7274	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
`src/json/light.rs`	`tolerate`	7355	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
`src/util/simd/x86.rs`	`tolerate`	208-258	both	CPU-gated: the avx512f early-return only executes on Zen 4+ / Skylake-X runners, and its absence changes which AMD/Intel branch below executes too (#2449)
`src/yaml/index.rs`	`tolerate`	1268	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
`src/yaml/index.rs`	`tolerate`	1272	both	unreachable: every fixture field_key_head_foot is called with in this test module is a top-level mapping (#798)
`src/yaml/index.rs`	`tolerate`	1283	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this if-let's pattern can never fail to match (#798)
`src/yaml/index.rs`	`tolerate`	1285	both	unreachable: every call to field_key_head_foot in this test module passes a key that the fixture's mapping actually has (#798)
`src/yaml/index.rs`	`tolerate`	1295	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
`src/yaml/index.rs`	`tolerate`	1299	both	unreachable: every fixture seq_item_head_foot is called with in this test module is a top-level sequence (#798)
`src/yaml/index.rs`	`tolerate`	1322	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
`src/yaml/index.rs`	`tolerate`	1341	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
`src/yaml/index.rs`	`tolerate`	1364	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
`src/yaml/index.rs`	`tolerate`	1373	both	unreachable: every fixture field_key_head_foot_in_doc is called with in this test module is a top-level mapping (#798)
`src/yaml/index.rs`	`tolerate`	1384	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this if-let's pattern can never fail to match (#798)
`src/yaml/index.rs`	`tolerate`	1386	both	unreachable: every call to field_key_head_foot_in_doc in this test module passes a key that the fixture's document actually has (#798)
`src/yaml/index.rs`	`tolerate`	1397	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
`src/yaml/index.rs`	`tolerate`	1401	both	unreachable: every fixture nested_key_head_foot is called with in this test module is a top-level mapping (#798)
`src/yaml/index.rs`	`tolerate`	1405	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this let-else's pattern can never fail to match (#798)
`src/yaml/index.rs`	`tolerate`	1411	both	unreachable: every fixture nested_key_head_foot is called with has a nested mapping under `outer` (#798)
`src/yaml/index.rs`	`tolerate`	1422	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this if-let's pattern can never fail to match (#798)
`src/yaml/index.rs`	`tolerate`	1425	both	unreachable: every call to nested_key_head_foot in this test module passes an outer.inner pair that the fixture actually has (#798)
`src/yaml/light.rs`	`tolerate`	3364	both	unreachable: an alias target is never None for a built index (#1374)
`src/yaml/light.rs`	`tolerate`	15398	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
`src/yaml/light.rs`	`tolerate`	15409	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
`src/yaml/light.rs`	`tolerate`	15566	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
`src/yaml/parser.rs`	`tolerate`	1583	both	unreachable: every block-sequence open registers a frame at its own depth before any item of it can be parsed (#1079)
`src/yaml/parser.rs`	`tolerate`	1613	both	unreachable: this function's sole caller (record_standalone_comment) only invokes it from inside a match on `pending_head_lines.last()`, so pending_head_lines is already known non-empty here (#798)
`src/yaml/parser.rs`	`tolerate`	7999	both	unreachable: every byte here already passed the `[0-9.eE+-]` charset check above, a strict subset of ASCII, so `str::from_utf8` can never fail (#2778)

Patch coverage

Patch: 99.32% (146/147 new lines covered)

File	Patch	Uncovered new lines
`src/jq/eval.rs`	99.32% (146/147)	99467

Uncovered new lines (1)

src/jq/eval.rs:99467

_{📦 Full per-file coverage summary · run summary}

… first-step identity test resolve_as_pattern's path_intact check only recognized a bare `.` head as the register's own node. Every other is_identity_passthrough spelling (try . catch 1, if true then . else . end, . // 1) fell to the null/bool catch-all, wrongly decided the step was not intact, and either refused (a single pattern) or retried a ?// chain onto the wrong alternative -- which del()/= then wrote through (silent wrong delete: succinctly wrote null where jq deletes one key). First fix attempt bolted three ad-hoc If/Try/Alternative match arms onto the identical computation, reusing is_identity_passthrough / is_raise_free_identity_passthrough directly. Review (four independent passes) found this unsound: those two predicates only certify a shape as a candidate whose value is re-checked LATER, at a separate use site (substitute_bound_var_at's Origin::Snapshot/SnapshotAt contract) -- there is no later check in resolve_as_pattern, so trusting `trackable` alone for a recognized shape wrongly certified whichever branch's value actually ran, including a nested `A // B`'s B-side, or a TrackedVar frozen at an earlier, different position than the current register. Fixed with a single recursive helper, resolves_to_register, that re-runs the bare-TrackedVar arm's own check (marker.value == *reg && frame.certifies(&marker.origin)) at every nesting level it recurses through, rather than trusting trackable as a stand-in. Its Alternative arm requires the register be truthy at each level (A // B only equals `.` exactly when A actually produced the value), matching the #3129 lesson applied to an immediate, non-deferred certification instead of a deferred one. Fixes #3119.

… hole, hoist and dedupe the call site Third review round: resolves_to_register's Alternative arm gated only on `trackable && reg.is_truthy()`, which proves left is never filtered by // if it produces a value, not that it produces one at all. An If on left whose condition can itself yield nothing (if empty then . else . end) slipped through: // falls through to B regardless of the register's truthiness whenever left yields empty, and B (a fresh literal) was wrongly certified as the register's own node -- the same #3129 class of bug reintroduced one level deeper. Fixed by additionally requiring is_raise_free_identity_passthrough(left), matching the guard already used for Try, and matching is_identity_passthrough's own (already-#3129-fixed) Alternative arm. Also, from the second review round's reuse/efficiency findings: - resolve_as_pattern's identical computation delegated to resolves_to_register for Identity/TrackedVar too, removing the duplicated inline checks, while preserving their exact pre-#3119 behavior (no null/bool fallback for those two leaf shapes). - Hoisted the now-single resolves_to_register call out of the per-`bound` loop, since head/trackable/register/frame are all fixed before the loop starts. - Removed the redundant If|Try|Alternative variant enumeration at the call site, since resolves_to_register's own catch-all already refuses every other shape. Recorded both confirmed refuse-only residuals (an off-register truthy-value coincidence, and a mismatched-branch If) in docs/compliance/jq/limitations.md per ADR-0018, and added test coverage for the null/bool fallback and the If arm's && (not ||) proving both are load-bearing, not vestigial.

newhoggy · 2026-09-18T09:06:06Z

Ran `/code-review` (standard effort) three times on this PR — the first pass caught a fundamental soundness gap in the initial fix (reusing `is_identity_passthrough`'s weaker, deferred-certification guarantee for an immediate verdict), the second caught a residual empty-condition hole one level deeper in the corrected `Alternative` arm, and the third (after fixing both) found no further correctness issues across two independent fresh passes.

Fixed across all three rounds:

Initial fix bolted three ad-hoc `If`/`Try`/`Alternative` arms onto `resolve_as_pattern`'s `identical` check, reusing `is_identity_passthrough`/`is_raise_free_identity_passthrough` directly — unsound, since those predicates only certify a shape as a candidate re-verified later at a separate use site; there is no later check here. Confirmed live: a nested `A // B`, or a `TrackedVar` frozen at an earlier position than the current register, both got wrongly certified and `del`/`=` wrote through nodes jq itself refuses to reach.
Replaced with a single recursive helper, `resolves_to_register`, that re-runs the bare-`TrackedVar` arm's own `marker.value == *reg && frame.certifies(...)` check at every nesting level instead of trusting `trackable` as a stand-in.
Its `Alternative` arm's own `reg.is_truthy()` gate turned out to prove "never filtered by `//`" but not "produces a value at all" — an `If` on `left` with an empty-yielding condition (`if empty then . else . end`) slipped through and got `B`'s unrelated literal certified as the register. Closed by additionally requiring `is_raise_free_identity_passthrough(left)`, matching the guard `Try` already needed and `is_identity_passthrough`'s own (already-jq: A // B counts as an identity passthrough when A yields nothing — a fresh right-side value is certified by value and written through #3129-fixed) `Alternative` arm.
Removed the resulting duplication (Identity/TrackedVar checks existed both inline and in the new helper), hoisted the now-single `resolves_to_register` call out of the per-`bound` loop (it's loop-invariant), and dropped a redundant variant-list match at the call site.
Recorded both confirmed refuse-only residuals in `docs/compliance/jq/limitations.md` per ADR-0018.

18 regression rows now cover the full history: the issue's original repro, the first fix's own gap, the second's, plus two rows proving `resolves_to_register`'s null/bool fallback and its `If` arm's `&&` (not `||`) are both load-bearing. Every row confirmed live against `/usr/bin/jq` 1.7.1. Full local suite green: tests, clippy (both feature sets), fmt, 99.32% patch coverage (the one uncovered line a pre-existing-pattern defensive panic arm, `tolerate`-annotated).

newhoggy force-pushed the issue-3119-alternative-identity-passthrough-pattern-head branch from b737cde to 7e812aa Compare September 18, 2026 08:24

newhoggy added this pull request to the merge queue Sep 18, 2026

Merged via the queue into main with commit 73fe8e9 Sep 18, 2026
64 checks passed

newhoggy mentioned this pull request Sep 18, 2026

Backlog processing strategy: volume without compromising quality #235

Open

20 tasks

Navigation Menu

fix(jq): recognize every identity-passthrough spelling in a pattern's first-step identity test - #3147

fix(jq): recognize every identity-passthrough spelling in a pattern's first-step identity test#3147
newhoggy merged 2 commits into
mainfrom
issue-3119-alternative-identity-passthrough-pattern-head

newhoggy commented Sep 18, 2026

Uh oh!

github-actions Bot commented Sep 18, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 18, 2026 •

edited

Loading

Uh oh!

newhoggy commented Sep 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

newhoggy commented Sep 18, 2026

Summary

Test plan

Uh oh!

github-actions Bot commented Sep 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage

Patch coverage

Uh oh!

github-actions Bot commented Sep 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage

Patch coverage

Uh oh!

newhoggy commented Sep 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions Bot commented Sep 18, 2026 •

edited

Loading

github-actions Bot commented Sep 18, 2026 •

edited

Loading