fix(jq): carry the fold register into its UPDATE/EXTRACT nested pipes (#3145) by newhoggy · Pull Request #3151 · rust-works/succinctly

newhoggy · 2026-09-18T08:45:34Z

Fixes #3145
Refs #3133, #3120, #2046, #1440

Summary

#3133 gave a pipe stage's Frame the register's value, so a pipe nested under try/if/, could seed itself with it. A fold's UPDATE/EXTRACT takes its own route — FoldRegister::resolve passes the register to resolve_seq explicitly, under a frame built by unknown()/clone() — so the same nesting was still register-less there: try ($v | .b) could not re-establish $v, raised the resolver's own refusal, and try swallowed it.

$ echo '{"a":{"b":1}}' | jq -c 'del(foreach .a as $v (.; try ($v | .b); .))'
{"a":{}}
$ echo '{"a":{"b":1}}' | succinctly jq -c 'del(foreach .a as $v (.; try ($v | .b); .))'   # main
{"a":{"b":1}}                                                                             # exit 0

Fix: the fold's update frame carries self.value, gated on self.trackable && !tr && !fans_out(expr) in jq mode, and only on the non-Pipe arm (the Pipe arm passes the register explicitly, which resolve_seq_sink prefers).

The self.trackable half is load-bearing, and the fuzz is what found it. My first gate was !tr alone. An untracked FoldRegister's value is not a register at all (enter's untracked arm seeds it from the ambient), and handing that to a nested pipe let markers re-establish where jq refuses: three fabricated writes across 18,000 fuzzed programs (e.g. (foreach first(.a) as {a:{b:$v0}} ?// {c:$v0} ([1]; ($v0[0]?, $v0); ($v0 | getpath([]) | .b?))) = 9, which jq refuses and the wrong gate wrote through). Neither the sweep rows nor the unit matrix reached any of them — the narrowed gate is at zero fabricate / zero mismatch on the same seeds.

Not reached: a fold whose INIT is untracked after a literal stage re-seeds its register from the ambient, so the marker is unrecognised there (the pre-existing literal-then-fold-untracked-init / carried-register-passthrough class), and a try around it turns that refusal into a no-op write: del(.a as $y | .a | 5 | foreach range(1) as $i (0; .; try ($y | .b))) is {"a":{}} in jq and echoes here. Recorded in limitations.md and pinned in the unit test so a later fix flips it visibly.

Review round (`/code-review 3151`, standard effort)

Three findings, all fixed. The register reached a fold body's nested pipe but not a sibling branch of the same multi-output body (those go through resolve_node, whose non-pipe arms this frame does not reach — #2046's scope limit), so an UPDATE that refused wholesale could half-succeed: (foreach .a as {a:$v} ?// {c:$v} (0; ($v[0]?, $v))) = 9 wrote .a.c, a key jq never names, because only the second output refused and drove a ?// retry jq does not perform; and del(foreach .a as $v (.; (($v | .b?), 1); try ($v | .b?))) turned a loud refusal into a silent no-op write. The gate now declines a body that can fan out, and the frame no longer carries the register on the Expr::Pipe arm at all (third finding: that copy was allocated per fold step and never read).

The review found this by re-running the PR's own fuzz fold-only — the changed code is reachable only from a fold, and at the stock FOLD_P = 0.2 my 3×6000 runs drew ~3,600 fold programs, under this class's ~1-in-12,000 rate. The script gains a --fold-p flag so that weighting is a flag rather than an edit, and both fabricating shapes are now sweep rows.

Acceptance oracle

scripts/jq-bind-origin-oracle-sweep.sh: 6 new fold-* rows; agree=305 fabricate=0 mismatch=0 refuse-only=38 refuse-only-NEW=0.
scripts/jq-bind-origin-fuzz.py against a merge-base build: 3 seeds × 6000 stock and 3 seeds × 4000 at --fold-p 1.0 (including the review's seed 1001), all fabricate=0 mismatch=0. Earlier gates scored 1 fabricate + 5 mismatch (no self.trackable) and a wrong write at --fold-p 1.0 (no fans_out).

Test plan

github-actions · 2026-09-18T09:00:40Z

Coverage

Total: 93.95% ⚪ 0 pp vs main

Comparing 73fe8e9..6b21207 (merge-base → PR head)

No per-file coverage changes vs main.

🔇 0 ignored region(s), 175 tolerated region(s)

ignore removes the lines from both reports; tolerate keeps them in the reported percentage but scores them against the baseline, so a cross-run flip cannot move a delta. Regions are read from each revision's own source.

File	Kind	Lines	Rev	Reason
`src/bin/succinctly/jq_runner.rs`	`tolerate`	1499-1511	both	unreachable: `try_parse_meta_op` only fires under `ParserMode::Yq` (src/jq/parser.rs), and `rewrite_namespaced_calls` is only reached via `ModuleProcessor::process_program`, which jq_runner's own jq-mode `run` is the sole caller of -- so a `MetaAssign` node can never reach this function (#798)
`src/bin/succinctly/jq_runner.rs`	`tolerate`	2124	both	unreachable by construction: every error this wrapper receives today is a decode or nesting-depth failure the evaluator raised itself, never error(v); kept so a future one is rendered rather than dropped (#2999)
`src/bin/succinctly/jq_runner.rs`	`tolerate`	2125	both	see the arm above (#2999)
`src/bin/succinctly/jq_runner.rs`	`tolerate`	2682-2685	both	unreachable in a single-process run by construction: `run_id_for` (the sole source of an `origin` id) always inserts a `run_origins` entry for the id it hands back -- from a real load's canonical path, or its own literal-path fallback on a resolve failure -- and a def body only ever gets stamped with an `origin` after its module loaded successfully, so `at` always names a file that existed and was readable moments earlier. Reaching this arm needs that same file to vanish (or become unreadable) in the narrow window between that load and this re-read, entirely outside this process's control (#2964)
`src/bin/succinctly/jq_runner.rs`	`tolerate`	2942	both	unreachable: widening the shadow-candidate set never rejects a program the first parse accepted -- a newly covered name only wraps an already-successful dedicated parse, and a failing one would have propagated its error in the first parse too, so the retry budget is charged at the identical sites in both (#2395)
`src/bin/succinctly/jq_runner.rs`	`tolerate`	9148	both	unreachable in a passing suite by design -- the fixed b\
`src/bin/succinctly/main.rs`	`tolerate`	1430	both	the CLI suites drive yq through the `syq` multi-call arm above; this arm is the same call reached only when spelled `succinctly yq` (#2999)
`src/bin/succinctly/yq_runner.rs`	`tolerate`	1652	both	unreachable: bytes already parsed successfully by every caller (#1350)
`src/bin/succinctly/yq_runner.rs`	`tolerate`	3318	both	unreachable: `path` is always the raw output of the `path(TARGET)` builtin evaluated a few lines up in `resolve_one_meta_assign` -- `path/1` is a jq/yq language invariant that always answers an array of path components (see `Expr::Builtin(Builtin::PathNoArg) => Ok(Some(OwnedValue::Array(..)))` in eval_generic.rs), never any other shape (#798)
`src/bin/succinctly/yq_runner.rs`	`tolerate`	3420	both	unreachable: `resolve_meta_assign_writes` runs `expr` through this before any evaluation begins (see its own doc comment), and `Expr::Shared` is never constructed by the parser -- only at eval time, by function-call argument substitution (`substitute_func_param` in eval.rs) -- so a pre-evaluation AST can never contain one here (#798)
`src/bin/succinctly/yq_runner.rs`	`tolerate`	4052	both	unreachable: every arm of the `match result { .. }` above that assigns `docs` (L3492-3622) constructs `Ok(..)` -- none ever produces `Err`, so this `if let`'s implicit else can't be taken; symmetric to L1625's `?` (#798)
`src/jq/document.rs`	`tolerate`	1125-1132	both	unreachable: both implementors (StandardJson, YamlValue) override this to decode once; the default exists as the contract a future implementor inherits, and is deliberately the two-call sequence it replaces (#965)
`src/jq/eval.rs`	`tolerate`	1142	both	unreachable: def is always a collect_alias_groups anchor path, which step_to_expr never fails on (#1351)
`src/jq/eval.rs`	`tolerate`	1163	both	unreachable: redirect_paths with Redirect::SINGLE always contributes exactly one output per input, so a 1-element paths always pops Some (#1351)
`src/jq/eval.rs`	`tolerate`	1172	both	unreachable: a concrete setpath/delpaths path's components are always Field/Index -- step_to_expr never produces another shape (#1351)
`src/jq/eval.rs`	`tolerate`	1176	both	unreachable: the map above never yields None, since it only ever matches Field/Index (#1351)
`src/jq/eval.rs`	`tolerate`	4388	both	unreachable: `is_escape()` is exactly `Error
`src/jq/eval.rs`	`tolerate`	4389	both	unreachable: see the `if let` above -- `push_owned_values` never answers `None` for an `is_escape()` result (#2180)
`src/jq/eval.rs`	`tolerate`	5555	both	unreachable today: to_owned's only failures are is_decode_failure()-tagged, and suppresses() answers false for those whatever `optional` is -- the same defensive-but-dead arm eval_generic's own Builtin::Path materialization documents under #2280 (#2908)
`src/jq/eval.rs`	`tolerate`	6301	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval.rs`	`tolerate`	7446	both	unreachable: `optional` is never `true` here. `eval_each` is entered with a forced `true` at exactly one site (`Expr::Optional` over an `IndexExpr`/`SliceExpr`), and both of those evaluate their target (`eval_index_expr`) and their key (`eval_each(key, .., false)`) with a hardcoded `false`, so only the final index/slice step ever sees it -- nothing carries it down to an `Expr::Object` (#2180)
`src/jq/eval.rs`	`tolerate`	10732	both	unreachable: every entry point supplies path context, so `path` never evaluates without one; pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval.rs`	`tolerate`	10862	both	unreachable: only ever constructed by builtin_sort_keys's own eval_update_no_vivify call, whose enclosing eval_update_impl already runs to_owned on the whole document up front (#2855) -- a decode failure anywhere raises there, before this filter ever sees a value to re-decode; confirmed live, `sort_keys(.a)`/`sort_keys(..)` on a document with a decode-failure subtree both raise from the outer to_owned
`src/jq/eval.rs`	`tolerate`	21925	both	unreachable: escape_with_prefix! sets `terminal` before Demand::Stop; already returned above (#2138)
`src/jq/eval.rs`	`tolerate`	22294	both	unreachable: escape! sets `terminal` before Demand::Stop; already returned above (#2546)
`src/jq/eval.rs`	`tolerate`	30253	both	reachable only on a genuine allocation failure: `Vec::try_reserve(1)` on a vector that has spare capacity, or can grow, cannot fail -- this is the whole purpose of the branch, converting an OOM into a catchable error rather than an abort (ADR-0018's 'would take the host process down' exception). The pre-#2267 form of the same guard, `out.try_reserve(branches.len())` in `resolve_index_expr`/`resolve_slice_expr`, was 0-hit for the identical reason (#2267)
`src/jq/eval.rs`	`tolerate`	30254	both	see the line above -- the `Demand::Stop` half of the same allocation-failure-only branch (#2267)
`src/jq/eval.rs`	`tolerate`	30260	both	reachable only when the `try_reserve` above failed, i.e. only on a genuine allocation failure (#2267)
`src/jq/eval.rs`	`tolerate`	32530	both	unreachable: `is_primitive` admits only Identity/Field/Index/Slice, and of those only a Slice's computed bounds can halt -- all four have their own arm in `resolve_node_sink`/`resolve_node_eager`, so none reaches this function. Pre-existing; #2694 only wrapped the return in `Some` (#2694)
`src/jq/eval.rs`	`tolerate`	32564	both	unreachable, as this arm's own comment above says: indexing or slicing a value yields zero or one result, so `is_primitive` never produces more than one -- kept as a named error rather than a panic. Pre-existing; #2694 only wrapped the enclosing return in `Some` (#2694)
`src/jq/eval.rs`	`tolerate`	34970	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval.rs`	`tolerate`	36002	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval.rs`	`tolerate`	36026	both	unreachable: every arm of the loop's last iteration returns -- a walk refusal, an exhausted walk, and a step outcome that never retries on the last alternative (#2979, #2872)
`src/jq/eval.rs`	`tolerate`	36573	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval.rs`	`tolerate`	36593	both	unreachable: every path through the loop's last iteration returns -- a walk refusal, an exhausted walk, and a step outcome that never retries on the last alternative (#2979, #2872)
`src/jq/eval.rs`	`tolerate`	39284	both	unreachable in a passing suite by design -- a panic-message format argument for the #682 single-valued-tail pin, evaluated only if that assert's own condition is false (#2190)
`src/jq/eval.rs`	`tolerate`	39361	both	unreachable: the only caller reaches this after classify_static_component answered Field for this same value, which it does only for an object (#2190)
`src/jq/eval.rs`	`tolerate`	39405	both	unreachable: both callers establish the container first -- navigate_static_component_ref via classify_static_component's Index arm, and walk_path's Expr::Iterate arm by matching on the container itself (#2190)
`src/jq/eval.rs`	`tolerate`	41799	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval.rs`	`tolerate`	41976	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval.rs`	`tolerate`	43261	both	unreachable: stop_with_escape's only write is `slot.set(Some(control))` with the control it was handed, which is always the `Control::Error` built one line above (#2180)
`src/jq/eval.rs`	`tolerate`	43608	both	unreachable: on_update records a `step_outcome` before every Demand::Stop it answers, and the fallback match runs only when it recorded none (#2872)
`src/jq/eval.rs`	`tolerate`	43631	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval.rs`	`tolerate`	44154	both	unreachable by construction: the per-fork match only ever hands stop_with_downstream a non-Exhausted flow, so `terminal` can never hold Exhausted. `foreach_forks`' identical arm is 0-hit for the same reason and is only unflagged because it predates this diff (#2899)
`src/jq/eval.rs`	`tolerate`	46910	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval.rs`	`tolerate`	48883	both	pre-existing zero-hit line; #2999 changed only which null constant it names
`src/jq/eval.rs`	`tolerate`	51517	both	defensive, unreachable via ordinary JSON parsing (#3068)
`src/jq/eval.rs`	`tolerate`	51520	both	defensive, unreachable via ordinary JSON parsing (#3068)
`src/jq/eval.rs`	`tolerate`	51561	both	`optional` is never true through either caller of this function -- confirmed live (`eprintln!` probe): `[1,2,3]
`src/jq/eval.rs`	`tolerate`	51570	both	every array literal written in filter source, and every array-element JSON parses, decodes to NumberLiteral (#1035), not a bare Int -- Int is for internally-synthesized values spliced post-parse; probed a computed element ([1970,(0+0),..]) and it still decoded as NumberLiteral here, so this arm has no known real producer (#3068)
`src/jq/eval.rs`	`tolerate`	51585	both	`optional` is never true through this call path -- see the array-length check above (#3068)
`src/jq/eval.rs`	`tolerate`	51600	both	`optional` is never true through either caller of this function, same as the array-length check above (#3068)
`src/jq/eval.rs`	`tolerate`	53365	both	unreachable from `combinations`, whose own empty-input return runs first; pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval.rs`	`tolerate`	54460	both	confirmed live (eprintln! probe): optional is always false in builtin_abs regardless of whether the filter writes abs?, since that suppression happens entirely outside builtin dispatch here -- the same 'optional is never true here' shape eval.rs already documents elsewhere (#2180) (#3041)
`src/jq/eval.rs`	`tolerate`	56438	both	unreachable: the sink is a plain collector that always answers Demand::Continue (#2872)
`src/jq/eval.rs`	`tolerate`	56548	both	unreachable: `optional: false` makes index_one_owned answer Ok(Some)/Err only (#2872)
`src/jq/eval.rs`	`tolerate`	56694	both	unreachable: `pattern_has_computed_key` is false for `Pattern::Var`, so the loop walker above always takes it (#2872)
`src/jq/eval.rs`	`tolerate`	56741	both	unreachable: every caller gates on `pattern_has_computed_key` being false (#2872)
`src/jq/eval.rs`	`tolerate`	57799	both	unreachable in practice: a def with more than 32 parameters; the fallback exists so ScopeMask's one-bit-per-parameter u64 is a performance ceiling rather than a correctness limit (#2633)
`src/jq/eval.rs`	`tolerate`	57825	both	unreachable: bind_def_call only calls this for a non-empty params, and install_def_calls only builds a DefCall whose args.len() equals params.len(), so the zip is never empty here (#2560)
`src/jq/eval.rs`	`tolerate`	57845	both	unreachable in practice: needs more than 32 duplicated-name parameters; see the non-duplicate path's own note (#2633)
`src/jq/eval.rs`	`tolerate`	57866	both	unreachable: `name` was just read from `params`, so the zip over (params, args) has a matching pair unless args is shorter than params, which install_def_calls' own arity guard rules out (#2560)
`src/jq/eval.rs`	`tolerate`	57886	both	unreachable: `params` is non-empty here (bind_def_call's own guard) and its first entry is never skipped, so at least one substitution always ran (#2560)
`src/jq/eval.rs`	`tolerate`	57947	both	unreachable: same arity invariant as bind_def_call_params' own copy of this loop -- `name` came from `params`, so the zip has a matching pair unless args is shorter, which install_def_calls rules out (#2560)
`src/jq/eval.rs`	`tolerate`	59265	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
`src/jq/eval.rs`	`tolerate`	59287	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
`src/jq/eval.rs`	`tolerate`	59305	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
`src/jq/eval.rs`	`tolerate`	59375	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
`src/jq/eval.rs`	`tolerate`	59389	both	substitute_func_param_impl's FuncDef arm always returns FuncDef (#2555)
`src/jq/eval.rs`	`tolerate`	66550	both	unreachable in a passing suite by design -- this is the failure message for the assertion the test exists to make (#2190)
`src/jq/eval.rs`	`tolerate`	78611	both	unreachable in a passing suite by design -- this test's own diagnostic (#3071)
`src/jq/eval.rs`	`tolerate`	79377-79382	both	the closure is asserted never called below (on_update_calls stays 0) -- Err(_) with optional=true short-circuits fold_step_each before this sink runs (#3122)
`src/jq/eval.rs`	`tolerate`	84054	both	unreachable in a passing suite by design -- this test's own diagnostic (#3071)
`src/jq/eval.rs`	`tolerate`	89896	both	unreachable in a passing suite by design -- this test's own diagnostic (#3071)
`src/jq/eval.rs`	`tolerate`	96452	both	unreachable in a passing suite by design -- every filter this helper is called with parses to an AsPattern (#2649)
`src/jq/eval.rs`	`tolerate`	96496	both	unreachable in a passing suite by design -- a literal-key pattern's walk either completes or refuses with an error (#2872)
`src/jq/eval.rs`	`tolerate`	96505	both	unreachable in a passing suite by design -- every call site passes the origin of a binding this same test already proved carries a marker (#2649)
`src/jq/eval.rs`	`tolerate`	96833	both	unreachable in a passing suite by design -- the assertion above is the test (#2872)
`src/jq/eval.rs`	`tolerate`	97480	both	unreachable in a passing suite by design -- every row here is a shape jq accepts, confirmed live (#2649)
`src/jq/eval.rs`	`tolerate`	97548	both	unreachable in a passing suite by design -- every row here is a shape jq refuses, confirmed live (#2649)
`src/jq/eval.rs`	`tolerate`	97933	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the let-else pattern fails to match (#2072)
`src/jq/eval.rs`	`tolerate`	97944	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the let-else pattern fails to match (#2072)
`src/jq/eval.rs`	`tolerate`	97965	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the match doesn't hit the expected arm above (#2072)
`src/jq/eval.rs`	`tolerate`	97981	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the match doesn't hit the expected arm above (#2072)
`src/jq/eval.rs`	`tolerate`	98066	both	unreachable in a passing suite by design -- every expression this closure receives is built by `marker` above (#3037)
`src/jq/eval.rs`	`tolerate`	98144	both	unreachable in a passing suite by design -- `rewrite_markers` rebuilds the same node kind it was given (#3037)
`src/jq/eval.rs`	`tolerate`	98171	both	unreachable in a passing suite by design -- every expression this closure receives is built by `marker` above (#3122)
`src/jq/eval.rs`	`tolerate`	98189	both	unreachable in a passing suite by design -- `rewrite_markers` rebuilds the same node kind it was given (#3122)
`src/jq/eval.rs`	`tolerate`	98257	both	unreachable in a passing suite by design -- fires only if demote_for_reentry's own let-else assertion condition is false (#3122)
`src/jq/eval.rs`	`tolerate`	98261	both	unreachable in a passing suite by design -- fires only if demote_for_reentry's own let-else assertion condition is false (#3122)
`src/jq/eval.rs`	`tolerate`	98301	both	unreachable in a passing suite by design -- fires only if reroot's own let-else assertion condition is false (#3122)
`src/jq/eval.rs`	`tolerate`	98305	both	unreachable in a passing suite by design -- fires only if reroot's own let-else assertion condition is false (#3122)
`src/jq/eval.rs`	`tolerate`	99783	both	unreachable in a passing suite by design -- this is the panic message for the assertion above, only formatted if the match doesn't hit the Error arm (#3119)
`src/jq/eval.rs`	`tolerate`	102175	both	unreachable in a passing suite by design -- this is the failure message for the assertion this test exists to make (#2937)
`src/jq/eval.rs`	`tolerate`	102329	both	every pinned filter below yields an owned value; kept so a cursor answer still renders rather than panics (#2999)
`src/jq/eval.rs`	`tolerate`	102330	both	unreachable in a passing suite by design -- the failure message for the assertions this helper serves (#2999)
`src/jq/eval_generic.rs`	`tolerate`	3729	both	unreachable: the sole remaining caller (`retain_truthy_generic`'s `Many` arm) runs `to_owned` on an item before keeping it, so re-converting a kept item here cannot fail; the `ManyCursor` caller that made this reachable went with the truthiness walk (#2692, re-establishing #2661's premise)
`src/jq/eval_generic.rs`	`tolerate`	7092	both	unreachable in a passing suite by design -- this is the panic message for the #2368 pin itself, only formatted if the assert's own condition is false (#2368)
`src/jq/eval_generic.rs`	`tolerate`	8950	both	the CLI evaluates every program that uses input/inputs on the eager route (jq_runner's can_use_lazy_path excludes them), so this guard never fires today -- #2968's identical guards on the arms above are equally unfired; kept for the day the lazy path admits such a program (#1309)
`src/jq/eval_generic.rs`	`tolerate`	8967	both	the CLI evaluates every program that uses input/inputs on the eager route (jq_runner's can_use_lazy_path excludes them), so this guard never fires today -- #2968's identical guards on the arms above are equally unfired; kept for the day the lazy path admits such a program (#1309)
`src/jq/eval_generic.rs`	`tolerate`	10156	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval_generic.rs`	`tolerate`	11650	both	unreachable: every producer that reaches this empty-`exprs` tail (`each_lazy_keys_iterate_sink`'s `sorted`/`!sorted` arms, `each_lazy_index_range_iterate_sink`, `each_lazy_seq_iterate_sink`) yields `OneCursorValue`/`OneCursor`/`Owned`, never a cursorless `GenericItem::One` -- so `cursor` is always `Some` here; kept for exhaustiveness/symmetry with the `Some` arm (#2103)
`src/jq/eval_generic.rs`	`tolerate`	14768	both	unreachable: escape_generic!/ensure_owned! set `terminal` before Demand::Stop; already returned above (#2138)
`src/jq/eval_generic.rs`	`tolerate`	15122	both	unreachable: escape! sets `terminal` before Demand::Stop; already returned above (#2546)
`src/jq/eval_generic.rs`	`tolerate`	15714	both	unreachable by construction: key_elements_generic builds every key of a run from the same Option<&Expr> (#2999)
`src/jq/eval_generic.rs`	`tolerate`	15724	both	unreachable by construction: key_elements_generic builds every key of a run from the same Option<&Expr> (#2999)
`src/jq/eval_generic.rs`	`tolerate`	16237	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval_generic.rs`	`tolerate`	17919	both	unreachable: `len_checked` and `SliceBounds::resolve` already bound every index in `range` to `[0, len)`, so `get_cursor` cannot miss (#2168)
`src/jq/eval_generic.rs`	`tolerate`	20702	both	unreachable by construction: path_context_resolvable admits an any(cond) read only through admits.prefetch, so the rewriter always has one -- the AnyCond arm above carries the identical assertion (#3079)
`src/jq/eval_generic.rs`	`tolerate`	20706	both	unreachable by construction, see above
`src/jq/eval_generic.rs`	`tolerate`	20707	both	unreachable by construction, see above
`src/jq/eval_generic.rs`	`tolerate`	21511	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval_generic.rs`	`tolerate`	21532	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval_generic.rs`	`tolerate`	21875	both	unreachable: `malformed_object_member` above already proved every key stringifies (the `None` half), and `to_owned_cursor` on an untagged key `decoded_key_str` decoded cannot fail (the `Err` half) (#2785)
`src/jq/eval_generic.rs`	`tolerate`	21956	both	unreachable: `map(f)` over an array emits exactly one array; kept so a future `map` shape produces no output rather than a panic (#2785)
`src/jq/eval_generic.rs`	`tolerate`	22243	both	unreachable by design -- eval_single's #2368 debug_assert forbids optional=true on Builtin::Reverse, so length never answers None here (#2730)
`src/jq/eval_generic.rs`	`tolerate`	22847	both	the CLI evaluates every program that uses input/inputs on the eager route (jq_runner's can_use_lazy_path excludes them), so this guard never fires today -- #2968's identical guards on the arms above are equally unfired; kept for the day the lazy path admits such a program (#1309)
`src/jq/eval_generic.rs`	`tolerate`	22853	both	see above: the input-queue deferral never fires from the CLI
`src/jq/eval_generic.rs`	`tolerate`	24297	both	unreachable by construction: every shape either guard admits now has an arm above (#2771), and expr_dispatch_catchall_guards_default_conservatively_2549 pins both guards' `_ => false` defaults directly
`src/jq/eval_generic.rs`	`tolerate`	24845	both	unreachable in a passing suite by design -- `owned_identity_rule` maps a bare `Expr::Var` to `Bound` too (for the static gate, which sees a body before its `as` substitution runs), but every runtime dispatch that reaches this rule (`owned_identity_after_stage`/`owned_identity_placed_by`, from `owned_identity_leaving_cursor`'s `Bound` arm) only ever sees a stage after `eval_owned_identity_as`'s unconditional `substitute_bound_var_from` call, which always turns `$x` into `Expr::TrackedVar` before recursing -- confirmed by running the full suite with this arm replaced by a hard `panic!()`, which never fired (#2072)
`src/jq/eval_generic.rs`	`tolerate`	24863	both	unreachable: this `Slice` rule's own two execution paths both exclude `Expr::Slice` before ever reaching `owned_identity_placed_by` -- `eval_owned_identity_stages`'s catch-all only runs a stage `owned_identity_nav_supported` refused, and `owned_identity_leaving_cursor` (`identity_from_first`, eval_generic.rs:10724) only runs a stage `path_context_is_navigational` refused -- and both predicates admit `Expr::Slice` (`owned_identity_nav_supported`/`path_context_is_navigational_at` each list `Expr::Slice { .. } => true`), so a bare slice is always resolved by `owned_identity_step`'s own arm first. Kept in `owned_identity_rule`'s match for exhaustiveness/symmetry with the rule table's other entries, the same reason #2072's `Bound` arm above is kept unreachable-by-construction (#2966's review of #2834)
`src/jq/eval_generic.rs`	`tolerate`	26362	both	optional is never true through this pipe: `?` is eval_owned_identity_try, which catches the escape instead, and after #693 only the IndexExpr/SliceExpr special case ever sets it -- kept as any_all_f's scalar_fallback mirror
`src/jq/eval_generic.rs`	`tolerate`	26363	both	optional is never true here, see above
`src/jq/eval_generic.rs`	`tolerate`	26766	both	unreachable in a passing suite by design -- the failure message for the assertion the tests below make (#2999)
`src/jq/eval_generic.rs`	`tolerate`	26905	both	unreachable in a passing suite by design -- the fixture's map(.+1) is always a LazySeq; this arm is the test's own diagnostic (#2666)
`src/jq/eval_generic.rs`	`tolerate`	26933	both	unreachable in a passing suite by design -- the fixture's only escape is Control::Error; this arm is the test's own diagnostic (#2666)
`src/jq/parser.rs`	`tolerate`	226	both	unreachable: parse_join_expr only calls join_expr with two to four arguments (#3046)
`src/jq/parser.rs`	`tolerate`	248	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
`src/jq/parser.rs`	`tolerate`	250	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
`src/jq/parser.rs`	`tolerate`	252	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
`src/jq/parser.rs`	`tolerate`	259	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
`src/jq/parser.rs`	`tolerate`	263	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
`src/jq/parser.rs`	`tolerate`	279	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
`src/jq/parser.rs`	`tolerate`	8949	both	unreachable in a passing suite by design -- this is the panic message for the #3044 pin itself, only formatted if the let-else pattern fails to match (#3044)
`src/jq/resolve.rs`	`tolerate`	2261	both	unreachable in practice today: this arm needs builtin_fallback==None (the name was never a shadow candidate) yet is_jq_builtin==true (a real jq builtin at this arity) -- every implemented builtin's own dedicated parse already lowers that shape to Expr::Builtin before resolve.rs ever runs, and #3042/#3046 closed the once-real 'unimplemented builtin' gap this existed for (see JQ_BUILTIN_ROSTER's own doc comment)
`src/jq/resolve.rs`	`tolerate`	2263	both	unreachable with the current roster: every `JQ_BUILTIN_ROSTER` entry of arity >= 1 already has a dedicated parser form (a `matches_keyword` special case or a `Libm1`/`Libm2`/`Libm3::ALL` entry -- confirmed by cross-referencing the full roster against both), so it is parsed straight to `Expr::Builtin` and never reaches here as a bare `FuncCall`. This arm exists for a roster name with no dedicated parse yet and a nonzero arity -- there is none today, so the loop body is reached with an empty `args` on every pinned-suite run (355 hits on the arm's own condition, 0 in the loop) and would only start executing if such a name were added (#2964)
`src/jq/share_stats.rs`	`tolerate`	97	both	process-global env var; exercised by the CLI audit run, not by an in-process test (#2999)
`src/jq/value.rs`	`tolerate`	358	both	unreachable by construction: the slow path is entered only after `significant_digit_count` found 18+ digits over the same mantissa bytes this loop walks (#2936)
`src/jq/value.rs`	`tolerate`	382	both	unreachable by construction: 18+ significant digits were counted, so at least one nonzero digit was kept (#2936)
`src/jq/value.rs`	`tolerate`	2771	both	unreachable: `format_float_with_fraction` of a finite double is always RFC 8259 number text, which `parse_i64_or_f64` reads (#2936)
`src/jq/value.rs`	`tolerate`	4541	both	unreachable in a passing suite by design -- every caller built the value as an array (#2999)
`src/jq/value.rs`	`tolerate`	4784	both	unreachable in a passing suite by design -- the value was built as this container a few lines above (#2999)
`src/jq/value.rs`	`tolerate`	5603	both	unreachable in a passing suite by design -- the failure message for a malformed oracle table (#2936)
`src/json/light.rs`	`tolerate`	7068	both	unreachable in a passing suite by design -- the failure message for the assertion this #2877 test exists to make
`src/json/light.rs`	`tolerate`	7150	both	unreachable in a passing suite by design -- the failure message for the assertion this #2877 test exists to make
`src/json/light.rs`	`tolerate`	7238	both	unreachable in a passing suite by design -- the failure message for the assertion this #2877 test exists to make
`src/json/light.rs`	`tolerate`	7263	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
`src/json/light.rs`	`tolerate`	7274	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
`src/json/light.rs`	`tolerate`	7355	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
`src/util/simd/x86.rs`	`tolerate`	208-258	both	CPU-gated: the avx512f early-return only executes on Zen 4+ / Skylake-X runners, and its absence changes which AMD/Intel branch below executes too (#2449)
`src/yaml/index.rs`	`tolerate`	1268	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
`src/yaml/index.rs`	`tolerate`	1272	both	unreachable: every fixture field_key_head_foot is called with in this test module is a top-level mapping (#798)
`src/yaml/index.rs`	`tolerate`	1283	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this if-let's pattern can never fail to match (#798)
`src/yaml/index.rs`	`tolerate`	1285	both	unreachable: every call to field_key_head_foot in this test module passes a key that the fixture's mapping actually has (#798)
`src/yaml/index.rs`	`tolerate`	1295	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
`src/yaml/index.rs`	`tolerate`	1299	both	unreachable: every fixture seq_item_head_foot is called with in this test module is a top-level sequence (#798)
`src/yaml/index.rs`	`tolerate`	1322	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
`src/yaml/index.rs`	`tolerate`	1341	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
`src/yaml/index.rs`	`tolerate`	1364	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
`src/yaml/index.rs`	`tolerate`	1373	both	unreachable: every fixture field_key_head_foot_in_doc is called with in this test module is a top-level mapping (#798)
`src/yaml/index.rs`	`tolerate`	1384	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this if-let's pattern can never fail to match (#798)
`src/yaml/index.rs`	`tolerate`	1386	both	unreachable: every call to field_key_head_foot_in_doc in this test module passes a key that the fixture's document actually has (#798)
`src/yaml/index.rs`	`tolerate`	1397	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
`src/yaml/index.rs`	`tolerate`	1401	both	unreachable: every fixture nested_key_head_foot is called with in this test module is a top-level mapping (#798)
`src/yaml/index.rs`	`tolerate`	1405	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this let-else's pattern can never fail to match (#798)
`src/yaml/index.rs`	`tolerate`	1411	both	unreachable: every fixture nested_key_head_foot is called with has a nested mapping under `outer` (#798)
`src/yaml/index.rs`	`tolerate`	1422	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this if-let's pattern can never fail to match (#798)
`src/yaml/index.rs`	`tolerate`	1425	both	unreachable: every call to nested_key_head_foot in this test module passes an outer.inner pair that the fixture actually has (#798)
`src/yaml/light.rs`	`tolerate`	3364	both	unreachable: an alias target is never None for a built index (#1374)
`src/yaml/light.rs`	`tolerate`	15398	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
`src/yaml/light.rs`	`tolerate`	15409	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
`src/yaml/light.rs`	`tolerate`	15566	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
`src/yaml/parser.rs`	`tolerate`	1583	both	unreachable: every block-sequence open registers a frame at its own depth before any item of it can be parsed (#1079)
`src/yaml/parser.rs`	`tolerate`	1613	both	unreachable: this function's sole caller (record_standalone_comment) only invokes it from inside a match on `pending_head_lines.last()`, so pending_head_lines is already known non-empty here (#798)
`src/yaml/parser.rs`	`tolerate`	7999	both	unreachable: every byte here already passed the `[0-9.eE+-]` charset check above, a strict subset of ASCII, so `str::from_utf8` can never fail (#2778)

Patch coverage

Patch: 100% (55/55 new lines covered)

File	Patch	Uncovered new lines
`src/jq/eval.rs`	100% (55/55)	—

_{📦 Full per-file coverage summary · run summary}

github-actions · 2026-09-18T09:03:35Z

Coverage

Total: 94.04% ⚪ 0 pp vs main

Comparing 73fe8e9..6b21207 (merge-base → PR head)

No per-file coverage changes vs main.

🔇 0 ignored region(s), 174 tolerated region(s)

ignore removes the lines from both reports; tolerate keeps them in the reported percentage but scores them against the baseline, so a cross-run flip cannot move a delta. Regions are read from each revision's own source.

File	Kind	Lines	Rev	Reason
`src/bin/succinctly/jq_runner.rs`	`tolerate`	1499-1511	both	unreachable: `try_parse_meta_op` only fires under `ParserMode::Yq` (src/jq/parser.rs), and `rewrite_namespaced_calls` is only reached via `ModuleProcessor::process_program`, which jq_runner's own jq-mode `run` is the sole caller of -- so a `MetaAssign` node can never reach this function (#798)
`src/bin/succinctly/jq_runner.rs`	`tolerate`	2124	both	unreachable by construction: every error this wrapper receives today is a decode or nesting-depth failure the evaluator raised itself, never error(v); kept so a future one is rendered rather than dropped (#2999)
`src/bin/succinctly/jq_runner.rs`	`tolerate`	2125	both	see the arm above (#2999)
`src/bin/succinctly/jq_runner.rs`	`tolerate`	2682-2685	both	unreachable in a single-process run by construction: `run_id_for` (the sole source of an `origin` id) always inserts a `run_origins` entry for the id it hands back -- from a real load's canonical path, or its own literal-path fallback on a resolve failure -- and a def body only ever gets stamped with an `origin` after its module loaded successfully, so `at` always names a file that existed and was readable moments earlier. Reaching this arm needs that same file to vanish (or become unreadable) in the narrow window between that load and this re-read, entirely outside this process's control (#2964)
`src/bin/succinctly/jq_runner.rs`	`tolerate`	2942	both	unreachable: widening the shadow-candidate set never rejects a program the first parse accepted -- a newly covered name only wraps an already-successful dedicated parse, and a failing one would have propagated its error in the first parse too, so the retry budget is charged at the identical sites in both (#2395)
`src/bin/succinctly/jq_runner.rs`	`tolerate`	9148	both	unreachable in a passing suite by design -- the fixed b\
`src/bin/succinctly/main.rs`	`tolerate`	1430	both	the CLI suites drive yq through the `syq` multi-call arm above; this arm is the same call reached only when spelled `succinctly yq` (#2999)
`src/bin/succinctly/yq_runner.rs`	`tolerate`	1652	both	unreachable: bytes already parsed successfully by every caller (#1350)
`src/bin/succinctly/yq_runner.rs`	`tolerate`	3318	both	unreachable: `path` is always the raw output of the `path(TARGET)` builtin evaluated a few lines up in `resolve_one_meta_assign` -- `path/1` is a jq/yq language invariant that always answers an array of path components (see `Expr::Builtin(Builtin::PathNoArg) => Ok(Some(OwnedValue::Array(..)))` in eval_generic.rs), never any other shape (#798)
`src/bin/succinctly/yq_runner.rs`	`tolerate`	3420	both	unreachable: `resolve_meta_assign_writes` runs `expr` through this before any evaluation begins (see its own doc comment), and `Expr::Shared` is never constructed by the parser -- only at eval time, by function-call argument substitution (`substitute_func_param` in eval.rs) -- so a pre-evaluation AST can never contain one here (#798)
`src/bin/succinctly/yq_runner.rs`	`tolerate`	4052	both	unreachable: every arm of the `match result { .. }` above that assigns `docs` (L3492-3622) constructs `Ok(..)` -- none ever produces `Err`, so this `if let`'s implicit else can't be taken; symmetric to L1625's `?` (#798)
`src/jq/document.rs`	`tolerate`	1125-1132	both	unreachable: both implementors (StandardJson, YamlValue) override this to decode once; the default exists as the contract a future implementor inherits, and is deliberately the two-call sequence it replaces (#965)
`src/jq/eval.rs`	`tolerate`	1142	both	unreachable: def is always a collect_alias_groups anchor path, which step_to_expr never fails on (#1351)
`src/jq/eval.rs`	`tolerate`	1163	both	unreachable: redirect_paths with Redirect::SINGLE always contributes exactly one output per input, so a 1-element paths always pops Some (#1351)
`src/jq/eval.rs`	`tolerate`	1172	both	unreachable: a concrete setpath/delpaths path's components are always Field/Index -- step_to_expr never produces another shape (#1351)
`src/jq/eval.rs`	`tolerate`	1176	both	unreachable: the map above never yields None, since it only ever matches Field/Index (#1351)
`src/jq/eval.rs`	`tolerate`	4388	both	unreachable: `is_escape()` is exactly `Error
`src/jq/eval.rs`	`tolerate`	4389	both	unreachable: see the `if let` above -- `push_owned_values` never answers `None` for an `is_escape()` result (#2180)
`src/jq/eval.rs`	`tolerate`	5555	both	unreachable today: to_owned's only failures are is_decode_failure()-tagged, and suppresses() answers false for those whatever `optional` is -- the same defensive-but-dead arm eval_generic's own Builtin::Path materialization documents under #2280 (#2908)
`src/jq/eval.rs`	`tolerate`	6301	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval.rs`	`tolerate`	7446	both	unreachable: `optional` is never `true` here. `eval_each` is entered with a forced `true` at exactly one site (`Expr::Optional` over an `IndexExpr`/`SliceExpr`), and both of those evaluate their target (`eval_index_expr`) and their key (`eval_each(key, .., false)`) with a hardcoded `false`, so only the final index/slice step ever sees it -- nothing carries it down to an `Expr::Object` (#2180)
`src/jq/eval.rs`	`tolerate`	10732	both	unreachable: every entry point supplies path context, so `path` never evaluates without one; pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval.rs`	`tolerate`	10862	both	unreachable: only ever constructed by builtin_sort_keys's own eval_update_no_vivify call, whose enclosing eval_update_impl already runs to_owned on the whole document up front (#2855) -- a decode failure anywhere raises there, before this filter ever sees a value to re-decode; confirmed live, `sort_keys(.a)`/`sort_keys(..)` on a document with a decode-failure subtree both raise from the outer to_owned
`src/jq/eval.rs`	`tolerate`	21925	both	unreachable: escape_with_prefix! sets `terminal` before Demand::Stop; already returned above (#2138)
`src/jq/eval.rs`	`tolerate`	22294	both	unreachable: escape! sets `terminal` before Demand::Stop; already returned above (#2546)
`src/jq/eval.rs`	`tolerate`	30253	both	reachable only on a genuine allocation failure: `Vec::try_reserve(1)` on a vector that has spare capacity, or can grow, cannot fail -- this is the whole purpose of the branch, converting an OOM into a catchable error rather than an abort (ADR-0018's 'would take the host process down' exception). The pre-#2267 form of the same guard, `out.try_reserve(branches.len())` in `resolve_index_expr`/`resolve_slice_expr`, was 0-hit for the identical reason (#2267)
`src/jq/eval.rs`	`tolerate`	30254	both	see the line above -- the `Demand::Stop` half of the same allocation-failure-only branch (#2267)
`src/jq/eval.rs`	`tolerate`	30260	both	reachable only when the `try_reserve` above failed, i.e. only on a genuine allocation failure (#2267)
`src/jq/eval.rs`	`tolerate`	32530	both	unreachable: `is_primitive` admits only Identity/Field/Index/Slice, and of those only a Slice's computed bounds can halt -- all four have their own arm in `resolve_node_sink`/`resolve_node_eager`, so none reaches this function. Pre-existing; #2694 only wrapped the return in `Some` (#2694)
`src/jq/eval.rs`	`tolerate`	32564	both	unreachable, as this arm's own comment above says: indexing or slicing a value yields zero or one result, so `is_primitive` never produces more than one -- kept as a named error rather than a panic. Pre-existing; #2694 only wrapped the enclosing return in `Some` (#2694)
`src/jq/eval.rs`	`tolerate`	34970	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval.rs`	`tolerate`	36002	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval.rs`	`tolerate`	36026	both	unreachable: every arm of the loop's last iteration returns -- a walk refusal, an exhausted walk, and a step outcome that never retries on the last alternative (#2979, #2872)
`src/jq/eval.rs`	`tolerate`	36573	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval.rs`	`tolerate`	36593	both	unreachable: every path through the loop's last iteration returns -- a walk refusal, an exhausted walk, and a step outcome that never retries on the last alternative (#2979, #2872)
`src/jq/eval.rs`	`tolerate`	39284	both	unreachable in a passing suite by design -- a panic-message format argument for the #682 single-valued-tail pin, evaluated only if that assert's own condition is false (#2190)
`src/jq/eval.rs`	`tolerate`	39361	both	unreachable: the only caller reaches this after classify_static_component answered Field for this same value, which it does only for an object (#2190)
`src/jq/eval.rs`	`tolerate`	39405	both	unreachable: both callers establish the container first -- navigate_static_component_ref via classify_static_component's Index arm, and walk_path's Expr::Iterate arm by matching on the container itself (#2190)
`src/jq/eval.rs`	`tolerate`	41799	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval.rs`	`tolerate`	41976	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval.rs`	`tolerate`	43261	both	unreachable: stop_with_escape's only write is `slot.set(Some(control))` with the control it was handed, which is always the `Control::Error` built one line above (#2180)
`src/jq/eval.rs`	`tolerate`	43608	both	unreachable: on_update records a `step_outcome` before every Demand::Stop it answers, and the fallback match runs only when it recorded none (#2872)
`src/jq/eval.rs`	`tolerate`	43631	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval.rs`	`tolerate`	44154	both	unreachable by construction: the per-fork match only ever hands stop_with_downstream a non-Exhausted flow, so `terminal` can never hold Exhausted. `foreach_forks`' identical arm is 0-hit for the same reason and is only unflagged because it predates this diff (#2899)
`src/jq/eval.rs`	`tolerate`	46910	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval.rs`	`tolerate`	48883	both	pre-existing zero-hit line; #2999 changed only which null constant it names
`src/jq/eval.rs`	`tolerate`	51517	both	defensive, unreachable via ordinary JSON parsing (#3068)
`src/jq/eval.rs`	`tolerate`	51520	both	defensive, unreachable via ordinary JSON parsing (#3068)
`src/jq/eval.rs`	`tolerate`	51561	both	`optional` is never true through either caller of this function -- confirmed live (`eprintln!` probe): `[1,2,3]
`src/jq/eval.rs`	`tolerate`	51570	both	every array literal written in filter source, and every array-element JSON parses, decodes to NumberLiteral (#1035), not a bare Int -- Int is for internally-synthesized values spliced post-parse; probed a computed element ([1970,(0+0),..]) and it still decoded as NumberLiteral here, so this arm has no known real producer (#3068)
`src/jq/eval.rs`	`tolerate`	51585	both	`optional` is never true through this call path -- see the array-length check above (#3068)
`src/jq/eval.rs`	`tolerate`	51600	both	`optional` is never true through either caller of this function, same as the array-length check above (#3068)
`src/jq/eval.rs`	`tolerate`	53365	both	unreachable from `combinations`, whose own empty-input return runs first; pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval.rs`	`tolerate`	54460	both	confirmed live (eprintln! probe): optional is always false in builtin_abs regardless of whether the filter writes abs?, since that suppression happens entirely outside builtin dispatch here -- the same 'optional is never true here' shape eval.rs already documents elsewhere (#2180) (#3041)
`src/jq/eval.rs`	`tolerate`	56438	both	unreachable: the sink is a plain collector that always answers Demand::Continue (#2872)
`src/jq/eval.rs`	`tolerate`	56548	both	unreachable: `optional: false` makes index_one_owned answer Ok(Some)/Err only (#2872)
`src/jq/eval.rs`	`tolerate`	56694	both	unreachable: `pattern_has_computed_key` is false for `Pattern::Var`, so the loop walker above always takes it (#2872)
`src/jq/eval.rs`	`tolerate`	56741	both	unreachable: every caller gates on `pattern_has_computed_key` being false (#2872)
`src/jq/eval.rs`	`tolerate`	57799	both	unreachable in practice: a def with more than 32 parameters; the fallback exists so ScopeMask's one-bit-per-parameter u64 is a performance ceiling rather than a correctness limit (#2633)
`src/jq/eval.rs`	`tolerate`	57825	both	unreachable: bind_def_call only calls this for a non-empty params, and install_def_calls only builds a DefCall whose args.len() equals params.len(), so the zip is never empty here (#2560)
`src/jq/eval.rs`	`tolerate`	57845	both	unreachable in practice: needs more than 32 duplicated-name parameters; see the non-duplicate path's own note (#2633)
`src/jq/eval.rs`	`tolerate`	57866	both	unreachable: `name` was just read from `params`, so the zip over (params, args) has a matching pair unless args is shorter than params, which install_def_calls' own arity guard rules out (#2560)
`src/jq/eval.rs`	`tolerate`	57886	both	unreachable: `params` is non-empty here (bind_def_call's own guard) and its first entry is never skipped, so at least one substitution always ran (#2560)
`src/jq/eval.rs`	`tolerate`	57947	both	unreachable: same arity invariant as bind_def_call_params' own copy of this loop -- `name` came from `params`, so the zip has a matching pair unless args is shorter, which install_def_calls rules out (#2560)
`src/jq/eval.rs`	`tolerate`	59265	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
`src/jq/eval.rs`	`tolerate`	59287	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
`src/jq/eval.rs`	`tolerate`	59305	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
`src/jq/eval.rs`	`tolerate`	59375	both	substitute_var_impl's FuncDef arm always returns FuncDef (#2283)
`src/jq/eval.rs`	`tolerate`	59389	both	substitute_func_param_impl's FuncDef arm always returns FuncDef (#2555)
`src/jq/eval.rs`	`tolerate`	66550	both	unreachable in a passing suite by design -- this is the failure message for the assertion the test exists to make (#2190)
`src/jq/eval.rs`	`tolerate`	78611	both	unreachable in a passing suite by design -- this test's own diagnostic (#3071)
`src/jq/eval.rs`	`tolerate`	79377-79382	both	the closure is asserted never called below (on_update_calls stays 0) -- Err(_) with optional=true short-circuits fold_step_each before this sink runs (#3122)
`src/jq/eval.rs`	`tolerate`	84054	both	unreachable in a passing suite by design -- this test's own diagnostic (#3071)
`src/jq/eval.rs`	`tolerate`	89896	both	unreachable in a passing suite by design -- this test's own diagnostic (#3071)
`src/jq/eval.rs`	`tolerate`	96452	both	unreachable in a passing suite by design -- every filter this helper is called with parses to an AsPattern (#2649)
`src/jq/eval.rs`	`tolerate`	96496	both	unreachable in a passing suite by design -- a literal-key pattern's walk either completes or refuses with an error (#2872)
`src/jq/eval.rs`	`tolerate`	96505	both	unreachable in a passing suite by design -- every call site passes the origin of a binding this same test already proved carries a marker (#2649)
`src/jq/eval.rs`	`tolerate`	96833	both	unreachable in a passing suite by design -- the assertion above is the test (#2872)
`src/jq/eval.rs`	`tolerate`	97480	both	unreachable in a passing suite by design -- every row here is a shape jq accepts, confirmed live (#2649)
`src/jq/eval.rs`	`tolerate`	97548	both	unreachable in a passing suite by design -- every row here is a shape jq refuses, confirmed live (#2649)
`src/jq/eval.rs`	`tolerate`	97933	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the let-else pattern fails to match (#2072)
`src/jq/eval.rs`	`tolerate`	97944	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the let-else pattern fails to match (#2072)
`src/jq/eval.rs`	`tolerate`	97965	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the match doesn't hit the expected arm above (#2072)
`src/jq/eval.rs`	`tolerate`	97981	both	unreachable in a passing suite by design -- this is the panic message for the #2072 pin itself, only formatted if the match doesn't hit the expected arm above (#2072)
`src/jq/eval.rs`	`tolerate`	98066	both	unreachable in a passing suite by design -- every expression this closure receives is built by `marker` above (#3037)
`src/jq/eval.rs`	`tolerate`	98144	both	unreachable in a passing suite by design -- `rewrite_markers` rebuilds the same node kind it was given (#3037)
`src/jq/eval.rs`	`tolerate`	98171	both	unreachable in a passing suite by design -- every expression this closure receives is built by `marker` above (#3122)
`src/jq/eval.rs`	`tolerate`	98189	both	unreachable in a passing suite by design -- `rewrite_markers` rebuilds the same node kind it was given (#3122)
`src/jq/eval.rs`	`tolerate`	98257	both	unreachable in a passing suite by design -- fires only if demote_for_reentry's own let-else assertion condition is false (#3122)
`src/jq/eval.rs`	`tolerate`	98261	both	unreachable in a passing suite by design -- fires only if demote_for_reentry's own let-else assertion condition is false (#3122)
`src/jq/eval.rs`	`tolerate`	98301	both	unreachable in a passing suite by design -- fires only if reroot's own let-else assertion condition is false (#3122)
`src/jq/eval.rs`	`tolerate`	98305	both	unreachable in a passing suite by design -- fires only if reroot's own let-else assertion condition is false (#3122)
`src/jq/eval.rs`	`tolerate`	99783	both	unreachable in a passing suite by design -- this is the panic message for the assertion above, only formatted if the match doesn't hit the Error arm (#3119)
`src/jq/eval.rs`	`tolerate`	102175	both	unreachable in a passing suite by design -- this is the failure message for the assertion this test exists to make (#2937)
`src/jq/eval.rs`	`tolerate`	102329	both	every pinned filter below yields an owned value; kept so a cursor answer still renders rather than panics (#2999)
`src/jq/eval.rs`	`tolerate`	102330	both	unreachable in a passing suite by design -- the failure message for the assertions this helper serves (#2999)
`src/jq/eval_generic.rs`	`tolerate`	3729	both	unreachable: the sole remaining caller (`retain_truthy_generic`'s `Many` arm) runs `to_owned` on an item before keeping it, so re-converting a kept item here cannot fail; the `ManyCursor` caller that made this reachable went with the truthiness walk (#2692, re-establishing #2661's premise)
`src/jq/eval_generic.rs`	`tolerate`	7092	both	unreachable in a passing suite by design -- this is the panic message for the #2368 pin itself, only formatted if the assert's own condition is false (#2368)
`src/jq/eval_generic.rs`	`tolerate`	8950	both	the CLI evaluates every program that uses input/inputs on the eager route (jq_runner's can_use_lazy_path excludes them), so this guard never fires today -- #2968's identical guards on the arms above are equally unfired; kept for the day the lazy path admits such a program (#1309)
`src/jq/eval_generic.rs`	`tolerate`	8967	both	the CLI evaluates every program that uses input/inputs on the eager route (jq_runner's can_use_lazy_path excludes them), so this guard never fires today -- #2968's identical guards on the arms above are equally unfired; kept for the day the lazy path admits such a program (#1309)
`src/jq/eval_generic.rs`	`tolerate`	10156	both	unreachable: every Demand::Stop the sink answers is preceded by `outcome = Some(..)`, handled just above (#2872)
`src/jq/eval_generic.rs`	`tolerate`	11650	both	unreachable: every producer that reaches this empty-`exprs` tail (`each_lazy_keys_iterate_sink`'s `sorted`/`!sorted` arms, `each_lazy_index_range_iterate_sink`, `each_lazy_seq_iterate_sink`) yields `OneCursorValue`/`OneCursor`/`Owned`, never a cursorless `GenericItem::One` -- so `cursor` is always `Some` here; kept for exhaustiveness/symmetry with the `Some` arm (#2103)
`src/jq/eval_generic.rs`	`tolerate`	14768	both	unreachable: escape_generic!/ensure_owned! set `terminal` before Demand::Stop; already returned above (#2138)
`src/jq/eval_generic.rs`	`tolerate`	15122	both	unreachable: escape! sets `terminal` before Demand::Stop; already returned above (#2546)
`src/jq/eval_generic.rs`	`tolerate`	15714	both	unreachable by construction: key_elements_generic builds every key of a run from the same Option<&Expr> (#2999)
`src/jq/eval_generic.rs`	`tolerate`	15724	both	unreachable by construction: key_elements_generic builds every key of a run from the same Option<&Expr> (#2999)
`src/jq/eval_generic.rs`	`tolerate`	16237	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval_generic.rs`	`tolerate`	17919	both	unreachable: `len_checked` and `SliceBounds::resolve` already bound every index in `range` to `[0, len)`, so `get_cursor` cannot miss (#2168)
`src/jq/eval_generic.rs`	`tolerate`	20702	both	unreachable by construction: path_context_resolvable admits an any(cond) read only through admits.prefetch, so the rewriter always has one -- the AnyCond arm above carries the identical assertion (#3079)
`src/jq/eval_generic.rs`	`tolerate`	20706	both	unreachable by construction, see above
`src/jq/eval_generic.rs`	`tolerate`	20707	both	unreachable by construction, see above
`src/jq/eval_generic.rs`	`tolerate`	21511	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval_generic.rs`	`tolerate`	21532	both	pre-existing zero-hit line; #2999 changed only how its array payload is constructed
`src/jq/eval_generic.rs`	`tolerate`	21875	both	unreachable: `malformed_object_member` above already proved every key stringifies (the `None` half), and `to_owned_cursor` on an untagged key `decoded_key_str` decoded cannot fail (the `Err` half) (#2785)
`src/jq/eval_generic.rs`	`tolerate`	21956	both	unreachable: `map(f)` over an array emits exactly one array; kept so a future `map` shape produces no output rather than a panic (#2785)
`src/jq/eval_generic.rs`	`tolerate`	22243	both	unreachable by design -- eval_single's #2368 debug_assert forbids optional=true on Builtin::Reverse, so length never answers None here (#2730)
`src/jq/eval_generic.rs`	`tolerate`	22847	both	the CLI evaluates every program that uses input/inputs on the eager route (jq_runner's can_use_lazy_path excludes them), so this guard never fires today -- #2968's identical guards on the arms above are equally unfired; kept for the day the lazy path admits such a program (#1309)
`src/jq/eval_generic.rs`	`tolerate`	22853	both	see above: the input-queue deferral never fires from the CLI
`src/jq/eval_generic.rs`	`tolerate`	24297	both	unreachable by construction: every shape either guard admits now has an arm above (#2771), and expr_dispatch_catchall_guards_default_conservatively_2549 pins both guards' `_ => false` defaults directly
`src/jq/eval_generic.rs`	`tolerate`	24845	both	unreachable in a passing suite by design -- `owned_identity_rule` maps a bare `Expr::Var` to `Bound` too (for the static gate, which sees a body before its `as` substitution runs), but every runtime dispatch that reaches this rule (`owned_identity_after_stage`/`owned_identity_placed_by`, from `owned_identity_leaving_cursor`'s `Bound` arm) only ever sees a stage after `eval_owned_identity_as`'s unconditional `substitute_bound_var_from` call, which always turns `$x` into `Expr::TrackedVar` before recursing -- confirmed by running the full suite with this arm replaced by a hard `panic!()`, which never fired (#2072)
`src/jq/eval_generic.rs`	`tolerate`	24863	both	unreachable: this `Slice` rule's own two execution paths both exclude `Expr::Slice` before ever reaching `owned_identity_placed_by` -- `eval_owned_identity_stages`'s catch-all only runs a stage `owned_identity_nav_supported` refused, and `owned_identity_leaving_cursor` (`identity_from_first`, eval_generic.rs:10724) only runs a stage `path_context_is_navigational` refused -- and both predicates admit `Expr::Slice` (`owned_identity_nav_supported`/`path_context_is_navigational_at` each list `Expr::Slice { .. } => true`), so a bare slice is always resolved by `owned_identity_step`'s own arm first. Kept in `owned_identity_rule`'s match for exhaustiveness/symmetry with the rule table's other entries, the same reason #2072's `Bound` arm above is kept unreachable-by-construction (#2966's review of #2834)
`src/jq/eval_generic.rs`	`tolerate`	26362	both	optional is never true through this pipe: `?` is eval_owned_identity_try, which catches the escape instead, and after #693 only the IndexExpr/SliceExpr special case ever sets it -- kept as any_all_f's scalar_fallback mirror
`src/jq/eval_generic.rs`	`tolerate`	26363	both	optional is never true here, see above
`src/jq/eval_generic.rs`	`tolerate`	26766	both	unreachable in a passing suite by design -- the failure message for the assertion the tests below make (#2999)
`src/jq/eval_generic.rs`	`tolerate`	26905	both	unreachable in a passing suite by design -- the fixture's map(.+1) is always a LazySeq; this arm is the test's own diagnostic (#2666)
`src/jq/eval_generic.rs`	`tolerate`	26933	both	unreachable in a passing suite by design -- the fixture's only escape is Control::Error; this arm is the test's own diagnostic (#2666)
`src/jq/parser.rs`	`tolerate`	226	both	unreachable: parse_join_expr only calls join_expr with two to four arguments (#3046)
`src/jq/parser.rs`	`tolerate`	248	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
`src/jq/parser.rs`	`tolerate`	250	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
`src/jq/parser.rs`	`tolerate`	252	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
`src/jq/parser.rs`	`tolerate`	259	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
`src/jq/parser.rs`	`tolerate`	263	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
`src/jq/parser.rs`	`tolerate`	279	both	unreachable: join_expr builds only this shape, and only join_expr names JOIN_IDX_VAR, which no program can spell (#3046)
`src/jq/parser.rs`	`tolerate`	8949	both	unreachable in a passing suite by design -- this is the panic message for the #3044 pin itself, only formatted if the let-else pattern fails to match (#3044)
`src/jq/resolve.rs`	`tolerate`	2261	both	unreachable in practice today: this arm needs builtin_fallback==None (the name was never a shadow candidate) yet is_jq_builtin==true (a real jq builtin at this arity) -- every implemented builtin's own dedicated parse already lowers that shape to Expr::Builtin before resolve.rs ever runs, and #3042/#3046 closed the once-real 'unimplemented builtin' gap this existed for (see JQ_BUILTIN_ROSTER's own doc comment)
`src/jq/resolve.rs`	`tolerate`	2263	both	unreachable with the current roster: every `JQ_BUILTIN_ROSTER` entry of arity >= 1 already has a dedicated parser form (a `matches_keyword` special case or a `Libm1`/`Libm2`/`Libm3::ALL` entry -- confirmed by cross-referencing the full roster against both), so it is parsed straight to `Expr::Builtin` and never reaches here as a bare `FuncCall`. This arm exists for a roster name with no dedicated parse yet and a nonzero arity -- there is none today, so the loop body is reached with an empty `args` on every pinned-suite run (355 hits on the arm's own condition, 0 in the loop) and would only start executing if such a name were added (#2964)
`src/jq/share_stats.rs`	`tolerate`	97	both	process-global env var; exercised by the CLI audit run, not by an in-process test (#2999)
`src/jq/value.rs`	`tolerate`	358	both	unreachable by construction: the slow path is entered only after `significant_digit_count` found 18+ digits over the same mantissa bytes this loop walks (#2936)
`src/jq/value.rs`	`tolerate`	382	both	unreachable by construction: 18+ significant digits were counted, so at least one nonzero digit was kept (#2936)
`src/jq/value.rs`	`tolerate`	2771	both	unreachable: `format_float_with_fraction` of a finite double is always RFC 8259 number text, which `parse_i64_or_f64` reads (#2936)
`src/jq/value.rs`	`tolerate`	4541	both	unreachable in a passing suite by design -- every caller built the value as an array (#2999)
`src/jq/value.rs`	`tolerate`	4784	both	unreachable in a passing suite by design -- the value was built as this container a few lines above (#2999)
`src/jq/value.rs`	`tolerate`	5603	both	unreachable in a passing suite by design -- the failure message for a malformed oracle table (#2936)
`src/json/light.rs`	`tolerate`	7068	both	unreachable in a passing suite by design -- the failure message for the assertion this #2877 test exists to make
`src/json/light.rs`	`tolerate`	7150	both	unreachable in a passing suite by design -- the failure message for the assertion this #2877 test exists to make
`src/json/light.rs`	`tolerate`	7238	both	unreachable in a passing suite by design -- the failure message for the assertion this #2877 test exists to make
`src/json/light.rs`	`tolerate`	7263	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
`src/json/light.rs`	`tolerate`	7274	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
`src/json/light.rs`	`tolerate`	7355	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
`src/yaml/index.rs`	`tolerate`	1268	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
`src/yaml/index.rs`	`tolerate`	1272	both	unreachable: every fixture field_key_head_foot is called with in this test module is a top-level mapping (#798)
`src/yaml/index.rs`	`tolerate`	1283	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this if-let's pattern can never fail to match (#798)
`src/yaml/index.rs`	`tolerate`	1285	both	unreachable: every call to field_key_head_foot in this test module passes a key that the fixture's mapping actually has (#798)
`src/yaml/index.rs`	`tolerate`	1295	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
`src/yaml/index.rs`	`tolerate`	1299	both	unreachable: every fixture seq_item_head_foot is called with in this test module is a top-level sequence (#798)
`src/yaml/index.rs`	`tolerate`	1322	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
`src/yaml/index.rs`	`tolerate`	1341	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
`src/yaml/index.rs`	`tolerate`	1364	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
`src/yaml/index.rs`	`tolerate`	1373	both	unreachable: every fixture field_key_head_foot_in_doc is called with in this test module is a top-level mapping (#798)
`src/yaml/index.rs`	`tolerate`	1384	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this if-let's pattern can never fail to match (#798)
`src/yaml/index.rs`	`tolerate`	1386	both	unreachable: every call to field_key_head_foot_in_doc in this test module passes a key that the fixture's document actually has (#798)
`src/yaml/index.rs`	`tolerate`	1397	both	unreachable: YamlIndex::build always wraps the parsed document(s) in a virtual root Sequence, at TY index 0 (#798)
`src/yaml/index.rs`	`tolerate`	1401	both	unreachable: every fixture nested_key_head_foot is called with in this test module is a top-level mapping (#798)
`src/yaml/index.rs`	`tolerate`	1405	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this let-else's pattern can never fail to match (#798)
`src/yaml/index.rs`	`tolerate`	1411	both	unreachable: every fixture nested_key_head_foot is called with has a nested mapping under `outer` (#798)
`src/yaml/index.rs`	`tolerate`	1422	both	unreachable: a mapping key is always emitted as YamlValue::String -- it is never type-inferred like a value (#222), so this if-let's pattern can never fail to match (#798)
`src/yaml/index.rs`	`tolerate`	1425	both	unreachable: every call to nested_key_head_foot in this test module passes an outer.inner pair that the fixture actually has (#798)
`src/yaml/light.rs`	`tolerate`	3364	both	unreachable: an alias target is never None for a built index (#1374)
`src/yaml/light.rs`	`tolerate`	15398	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
`src/yaml/light.rs`	`tolerate`	15409	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
`src/yaml/light.rs`	`tolerate`	15566	both	unreachable in a passing suite by design -- this is a panic-message format argument for the #2072 pin itself, only evaluated if the assert's own condition is false (#2072)
`src/yaml/parser.rs`	`tolerate`	1583	both	unreachable: every block-sequence open registers a frame at its own depth before any item of it can be parsed (#1079)
`src/yaml/parser.rs`	`tolerate`	1613	both	unreachable: this function's sole caller (record_standalone_comment) only invokes it from inside a match on `pending_head_lines.last()`, so pending_head_lines is already known non-empty here (#798)
`src/yaml/parser.rs`	`tolerate`	7999	both	unreachable: every byte here already passed the `[0-9.eE+-]` charset check above, a strict subset of ASCII, so `str::from_utf8` can never fail (#2778)

Patch coverage

Patch: 100% (55/55 new lines covered)

File	Patch	Uncovered new lines
`src/jq/eval.rs`	100% (55/55)	—

_{📦 Full per-file coverage summary · run summary}

…#3145) #3133 gave a pipe stage's `Frame` the register's value, so a pipe nested under `try`/`if`/`,` could seed itself with it. A fold's UPDATE/EXTRACT takes its own route -- `FoldRegister::resolve` passes the register to `resolve_seq` explicitly, under a frame built by `unknown()`/`clone()` -- so the same nesting was still register-less there: `try ($v | .b)` could not re-establish `$v`, raised the resolver's own refusal, and `try` swallowed it. `del(foreach .a as $v (.; try ($v | .b); .))` on `{"a":{"b":1}}` echoed the document where jq writes `{"a":{}}`. The fold's update frame now carries `self.value`, gated on `self.trackable && !tr` in jq mode. The `self.trackable` half is load-bearing and was found by the fuzz, not the sweep: an untracked `FoldRegister`'s `value` is not a register at all (`enter`'s untracked arm seeds it from the ambient), and handing that to a nested pipe fabricated three writes in 18,000 programs -- none of which the sweep rows or the unit matrix reached. Not reached: a fold whose INIT is untracked *after a literal stage* re-seeds its register from the ambient, so the marker is unrecognised there (the pre-existing `literal-then-fold-untracked-init` / `carried-register-passthrough` class) and a `try` around it turns that refusal into a no-op write -- recorded in limitations.md and pinned.

… fuzz knob (#3145 review) The register reached a fold body's nested pipe but not a *sibling* branch of the same multi-output body (those go through `resolve_node`, whose non-pipe arms this frame does not reach -- #2046's documented scope limit), so an UPDATE that used to refuse wholesale could half-succeed: `(foreach .a as {a:$v} ?// {c:$v} (0; ($v[0]?, $v))) = 9` wrote `.a.c`, a key jq never names, because only the second output refused and drove a `?//` retry jq does not perform; `del(foreach .a as $v (.; (($v | .b?), 1); try ($v | .b?)))` turned a loud refusal into a silent no-op write. A body that cannot fan out (`fans_out`) cannot split that way, so the register is carried only there, and the frame stops carrying it on the `Expr::Pipe` arm at all, where the explicit argument already wins and the copy was never read. The fuzz gains `--fold-p`: the changed code is reachable only from a fold, and at the stock 0.2 weight three 6000-program runs drew too few folds to see this class -- the review found it immediately at `--fold-p 1.0`. Both weightings are now at zero fabricate / zero mismatch (3x6000 stock, 3x4000 fold-only including the review's own seed), and both fabricating shapes are pinned in the sweep.

newhoggy added 2 commits September 18, 2026 19:39

newhoggy force-pushed the issue-3145-jq-fold-body-nested-try-has-no-register branch from 5d6a55c to 6b21207 Compare September 18, 2026 09:57

newhoggy added this pull request to the merge queue Sep 18, 2026

Merged via the queue into main with commit 5f65aef Sep 18, 2026
64 checks passed

newhoggy mentioned this pull request Sep 18, 2026

Backlog processing strategy: volume without compromising quality #235

Open

20 tasks

Navigation Menu

fix(jq): carry the fold register into its UPDATE/EXTRACT nested pipes (#3145) - #3151

fix(jq): carry the fold register into its UPDATE/EXTRACT nested pipes (#3145)#3151
newhoggy merged 2 commits into
mainfrom
issue-3145-jq-fold-body-nested-try-has-no-register

newhoggy commented Sep 18, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 18, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 18, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

newhoggy commented Sep 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Review round (/code-review 3151, standard effort)

Acceptance oracle

Test plan

Uh oh!

github-actions Bot commented Sep 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage

Patch coverage

Uh oh!

github-actions Bot commented Sep 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage

Patch coverage

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

newhoggy commented Sep 18, 2026 •

edited

Loading

Review round (`/code-review 3151`, standard effort)

github-actions Bot commented Sep 18, 2026 •

edited

Loading

github-actions Bot commented Sep 18, 2026 •

edited

Loading