bindery-cli 0.41.1__tar.gz → 0.42.0__tar.gz

{bindery_cli-0.41.1 → bindery_cli-0.42.0}/.github/workflows/publish.yml

@@ -73,13 +73,12 @@ jobs:
 
       # The tag message IS the release's patchnotes entry (verbatim, per the
       # tagging procedure), so the release body is extracted from the tag
-      # object rather than paraphrased here. Without it the release page
-      # renders blank beside the zip. The checkout is depth-1 and carries no
-      # tag objects, so the tag ref is fetched explicitly first (without
-      # this, `git tag -l` lists nothing and the release body silently falls
-      # back to the commit message).
+      # object rather than paraphrased here. The checkout is depth-1 and
+      # leaves a LIGHTWEIGHT local tag on the commit (whose %(contents) is
+      # the commit message, not the release entry), so the real annotated
+      # tag object is force-fetched from the origin before reading it.
       - name: Fetch the tag object
-        run: git fetch --no-tags origin "refs/tags/${GITHUB_REF_NAME}:refs/tags/${GITHUB_REF_NAME}"
+        run: git fetch --no-tags --force origin "refs/tags/${GITHUB_REF_NAME}:refs/tags/${GITHUB_REF_NAME}"
 
       - name: Extract the release body from the tag message
         run: git tag -l --format='%(contents)' "${GITHUB_REF_NAME}" > release-body.md

{bindery_cli-0.41.1 → bindery_cli-0.42.0}/CLAUDE.md

@@ -82,7 +82,7 @@ Born from the 2026 library audit (see the user memory `calibre-library-epubcheck
 
 ## Layout
 
-- `src/bindery/transforms.py`: pure `str -> (str, int)` text transforms (including `strip_broken_tags`). Since v0.32.0: `strip_attrs_in_start_tags` anchors attribute edits on the quote-aware start-tag matcher, `_outside_protected` forwards arguments (context-carrying transforms can be decorated), `fix_id_colons` matches only the bare `id` attribute and only internal fragments (`fix_ncx_src_fragments` carries renames into the NCX), `fix_ncx_playorder` is anchored to `<navPoint>` start tags, and the css selector boundary covers namespaced and functional selector forms. HAZARD (the 0.41.0 spin): the quote-aware tag-prefix alternation (double-quoted | single-quoted | [^>]) OVERLAPS ([^>] matches quotes too), so a plain `*` re-partitions exponentially on failing candidates; every such loop must carry the possessive `*+` (re 3.11+, the plugin's minimum Calibre). Since v0.37.0: `fix_ncx_playorder` strips quotes before its already-correct comparison (regex groups carry quote characters; comparing quoted values against bare numbers counted phantom fixes on every sequential NCX and rewrote single-quoted correct attributes to double quotes).
+- `src/bindery/transforms.py`: pure `str -> (str, int)` text transforms (including `strip_broken_tags`). Since v0.32.0: `strip_attrs_in_start_tags` anchors attribute edits on the quote-aware start-tag matcher, `_outside_protected` forwards arguments (context-carrying transforms can be decorated), `fix_id_colons` matches only the bare `id` attribute and only internal fragments (`fix_ncx_src_fragments` carries renames into the NCX), `fix_ncx_playorder` is anchored to `<navPoint>` start tags, and the css selector boundary covers namespaced and functional selector forms. HAZARD (the 0.41.0 spin): the quote-aware tag-prefix alternation (double-quoted | single-quoted | [^>]) OVERLAPS ([^>] matches quotes too), so a plain `*` re-partitions exponentially on failing candidates; every such greedy loop must carry the possessive `*+` (re 3.11+, the plugin's minimum Calibre). Since v0.42.0 the census is complete and pinned by tests/test_matcher_hardening.py: every greedy loop of this family is possessive (the three 0.41.1 rewrites plus _START_TAG_RE, _COVER_META_RE, _GUIDE_REF_RE, prune_dangling_edges' spine|item|itemref matcher, _ITEM_TAG_RE, _SPINE_ITEM_RE -- possessive is byte-identical on success because the loop is always followed by a literal `>` the [^>] branch cannot consume), and the five LAZY siblings (_VOID_RE, the transforms <img> matcher, and epub's link/a/img matchers) use the disjoint catch-all `[^>"']` instead: mutually exclusive branches cannot re-partition, and an unterminated quote inside a tag now fails to match rather than pairing across markup. NEW tag matchers: quote-aware possessive for greedy loops, the disjoint catch-all for lazy ones, and the tempered-quote idiom (["'])((?:(?!\1).)*)\1 for attribute values. Since v0.37.0: `fix_ncx_playorder` strips quotes before its already-correct comparison (regex groups carry quote characters; comparing quoted values against bare numbers counted phantom fixes on every sequential NCX and rewrote single-quoted correct attributes to double quotes).
 - `src/bindery/pagination.py`: the opt-in lossy page-number strip (runhead detection, page-layer decision, block-centric removal/merge, safety nets).
 - `src/bindery/watermark.py`: the opt-in lossy watermark strip (anchored and anchorless signature removal).
 - `src/bindery/reserialize.py`: structural repair via `html5lib`.

{bindery_cli-0.41.1 → bindery_cli-0.42.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: bindery-cli
-Version: 0.41.1
+Version: 0.42.0
 Summary: Audit EPUB body text and repair broken EPUBs with deterministic, epubcheck-gated fixes; atomic in-place replacement in a Calibre library.
 Project-URL: Homepage, https://github.com/VirInvictus/bindery-cli
 Project-URL: Repository, https://github.com/VirInvictus/bindery-cli

{bindery_cli-0.41.1 → bindery_cli-0.42.0}/patchnotes.md

@@ -1,4 +1,11 @@
 # bindery-cli Patch Notes
+## v0.42.0 (2026-09-16)
+
+### The matcher audit executed: every quote-aware tag matcher hardened
+The follow-up box the 0.41.1 hotfix opened is closed with a full per-matcher census, and the audit found the box's own enumeration incomplete. Six GREEDY patterns of the exponential overlap class were unhardened -- `_START_TAG_RE` (the quote-aware start-tag matcher anchoring `--strip-epub3-attrs` and `--strip-bad-attrs`, running under `repair --all` on every content doc; not even named in the box), `_COVER_META_RE`, `_GUIDE_REF_RE`, `prune_dangling_edges`' spine|item|itemref matcher, `_ITEM_TAG_RE`, and `_SPINE_ITEM_RE`. All six are possessive-bounded now: byte-identical on every successful match (the loop is always followed by a literal `>` that the `[^>]` branch cannot consume, so backtracking only ever happened on failure) and linear on failure. Five LAZY patterns of the quadratic class (`_VOID_RE`, the transforms `<img>` matcher, and epub's link/anchor/img matchers) took the disjoint catch-all `[^>"']` instead of a blind possessive swap: mutually exclusive branches cannot re-partition, so any quantifier is linear, and an unterminated quote inside a tag now fails to match instead of pairing with a distant quote and matching across markup. Every well-formed shape is byte-identical. The epub `_IMG_TAG_RE` is renamed `_PRUNE_IMG_TAG_RE` (it collided with the transforms matcher of the same name). Everything else in the package audited safe by construction: tempered-quote value matchers, two-branch quote alternations, `[^>]*` single-class prefixes (linear, not quote-aware -- accepted, documented), lazy paired-delimiter spans, and the analyzer tokenizers.
+
+Pinned by `tests/test_matcher_hardening.py` (15 tests): alarm-guarded spin shapes per greedy site (OPF flavor, the truncated-OPF prune shape), unterminated-quote skips, and well-formed byte-identity. `CLAUDE.md`'s hazard note now carries the census and the rule for new matchers. The full suite is 491 tests.
+
 ## v0.41.1 (2026-09-15)
 
 ### The 0.41.0 CPU-spin regression: possessive bounds on the quote-aware tag matchers

{bindery_cli-0.41.1 → bindery_cli-0.42.0}/project.done

@@ -4,6 +4,13 @@ Completed: 2026-09-15 (THE FINAL BLITZ, repo agent lane)
 Range: 2b9f24e (analyzer trio) through f47fc8f (ci tag-fetch fix), on main,
 pushed; CI green throughout; v0.41.0 tagged and published to PyPI.
 
+POSTSCRIPT 2026-09-15 (same day, Brandon's regression report): v0.41.1
+hotfixed the one real defect the blitz shipped, the catastrophic-backtracking
+CPU spin in `repair --all`'s rewritten quote-aware span matcher (the Physics
+fixture; Brandon bisected and root-caused it). Fix: possessive quantifiers
+on all three rewritten tag-prefix patterns; verified on his fixture against
+the 0.40.0 output shape; the follow-up matcher-audit box is in the roadmap.
+
 ## What shipped
 
 - The analyzer-robustness trio: spineless-EPUB verdicts, per-book try

{bindery_cli-0.41.1 → bindery_cli-0.42.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "bindery-cli"
-version = "0.41.1"
+version = "0.42.0"
 description = "Audit EPUB body text and repair broken EPUBs with deterministic, epubcheck-gated fixes; atomic in-place replacement in a Calibre library."
 readme = "README.md"
 classifiers = [

{bindery_cli-0.41.1 → bindery_cli-0.42.0}/roadmap.md

@@ -1642,7 +1642,7 @@ four interpreter families.
       (the oldest series whose embedded interpreter CI covers; the hollow
       (2, 0, 0) is gone) and the README plugin section documents platforms
       (Linux-tested) and the verification story.
-- [ ] **Analyzer robustness on untrusted input:** spine_integrity
+- [x] **Analyzer robustness on untrusted input:** *(SHIPPED in v0.41.0 -- the analyzer-robustness trio; verified 2026-09-16 by the post-blitz audit run: per-book verdicts over truncated/renamed-zip/zero-byte fixtures with no run abort.)* ** spine_integrity
       IndexErrors on a spineless EPUB (nums[0] with an empty list) and
       the call sites sit OUTSIDE the per-book try - one malformed book
       aborts a whole run; load_book raises NameError (encrypted_names
@@ -1671,7 +1671,7 @@ four interpreter families.
       --encode-url-spaces entry renames (the reference-rewrite half
       shipped v0.28.0; the remainder is renaming archive entries whose
       filenames carry raw spaces; PKG-010, 280 books); plugin log rotation.
-- [ ] **GitHub presentation (workspace batch):** description rewrite
+- [x] **GitHub presentation (workspace batch):** *(EXECUTED and verified at the ticked box below (line ~1745) during the blitz; ticked 2026-09-16 to stop it reading as open work.)* ** description rewrite
       (leads with deterministic epubcheck-gated repair); 7 topics swapped
       (add epub3/calibre-plugin/python-cli/ebook-audit); codex page still
       says calibredb; wiki off.
@@ -1690,7 +1690,7 @@ four interpreter families.
       real 3.12/3.13 (258 tests per leg, verified locally under
       3.12.14/3.13.15). Suite 445, ruff 0.16.2 clean.
 
-- [ ] **Candidate (lossy lane): strip duplicate stub spine docs.** Opened
+- [x] **Candidate (lossy lane): strip duplicate stub spine docs.** *(SHIPPED as --strip-stub-docs (the ticked box at ~1796); verified 2026-09-16: the no_worse gate correctly refuses a fabricated regression-stub.)* ** Opened
       2026-09-13 from the phase-1 Redwall-fleet successor run: The River
       Has Roots (bookmate platform conversion) carries 14 of 37 spine
       docs that are identical stubs (the same short boilerplate body
@@ -1708,7 +1708,7 @@ four interpreter families.
       (kept in ~/Downloads pending Brandon's import-or-re-source call);
       the 2026-09-13 phase-1 JSON has the analyzer verdicts.
 
-- [ ] **`run phase3`'s aggregate before/after summary mixes a rejected
+- [x] **`run phase3`'s aggregate before/after summary mixes a rejected
       candidate's projected after-state into the totals** (observed
       2026-09-13, OMW batch): Ghost Brigades measured 0f/47e -> 1f/24e
       REGRESSION and was correctly rejected, untouched; the only applied
@@ -1870,14 +1870,30 @@ four interpreter families.
       earlier transforms move where failing candidates sit; the regex
       was input-sensitive, not the flags broken. Unpin 0.40.0 once
       0.41.1 is installed.
-- [ ] **Audit the remaining quote-aware tag matchers for the same
-      overlap ambiguity** (follow-up from the 0.41.1 hotfix): _VOID_RE
-      and the OPF matchers (cover meta, guide reference,
-      spine/item/itemref) share the overlapping-alternation shape but
-      were tested against the spin shape and do not blow up (the lazy
-      loop and always-matching candidates behave differently;
-      _VOID_RE's failure mode on a quote-run with no reachable `>` is
-      quadratic at worst, and it can match surprisingly far across
-      quoted spans, pre-existing since 0.40.0). Decide per matcher:
-      possessive-bound for uniformity, or document why the shape is
-      safe there. Never a third grammar copy.
+- [x] **Audit the remaining quote-aware tag matchers for the same
+      overlap ambiguity** *(EXECUTED 2026-09-16, v0.42.0 -- the full
+      per-matcher census, one ruling each: the audit found the box's own
+      enumeration incomplete. Six GREEDY exponential-class sites were
+      unhardened, possessive-bounded now (success is byte-identical:
+      the loop is always followed by a literal `>` that `[^>]` cannot
+      consume): transforms.py `_START_TAG_RE` -- the true gap, not even
+      named in the box, running under repair --all on every content doc;
+      `_COVER_META_RE`; `_GUIDE_REF_RE`; prune_dangling_edges'
+      spine|item|itemref matcher; `_ITEM_TAG_RE`; `_SPINE_ITEM_RE`.
+      Five LAZY quadratic-class sites took the disjoint catch-all
+      `[^>"']` instead of a blind possessive swap (a lazy `*?` ->
+      `*+` is NOT byte-identical with the trailing `\s*(/?)>`
+      continuation, which peels whitespace and the self-close slash):
+      `_VOID_RE`, the transforms `<img>` matcher, and epub's
+      link/a/img matchers -- mutually exclusive branches make any
+      quantifier linear and fix the far-match wart: an unterminated
+      quote inside a tag now fails to match instead of pairing across
+      markup. The epub `_IMG_TAG_RE` renamed `_PRUNE_IMG_TAG_RE` (name
+      collision with the transforms one). Everything else audited safe
+      by construction: tempered-quote value matchers, two-branch
+      quote alternations, `[^>]*` single-class prefixes (linear,
+      not quote-aware -- accepted), lazy paired-delimiter spans, and
+      the analyzer tokenizers. Pinned by tests/test_matcher_hardening.py:
+      15 tests (spin shapes alarm-guarded per greedy site, unterminated-
+      quote skips, well-formed byte-identity, prune spin over the
+      truncated-OPF shape). Never a third grammar copy.)*

{bindery_cli-0.41.1 → bindery_cli-0.42.0}/src/bindery/__init__.py

@@ -11,7 +11,7 @@ Calibre plugin built from this core.
 Single source of truth for the version. pyproject.toml must match VERSION below.
 """
 
-VERSION = "0.41.1"
+VERSION = "0.42.0"
 __version__ = VERSION
 
 from .epub import RepairReport, repair_epub  # noqa: E402

{bindery_cli-0.41.1 → bindery_cli-0.42.0}/src/bindery/epub.py

@@ -316,14 +316,14 @@ _EDGE_ATTR_RES = (
     re.compile(r"""\s+fallback\s*=\s*(?:"[^"]*"|'[^']*')""", re.IGNORECASE),
 )
 _COVER_META_RE = re.compile(
-    r"""<meta\b(?=(?:[^>]*\bname=)["']cover["'])(?:(?:"[^"]*"|'[^']*'|[^>])*)>""",
+    r"""<meta\b(?=(?:[^>]*\bname=)["']cover["'])(?:(?:"[^"]*"|'[^']*'|[^>])*+)>""",
     re.IGNORECASE,
 )
 _COVER_CONTENT_RE = re.compile(
     r"""\s+content\s*=\s*(["'])((?:(?!\1).)+)\1""", re.IGNORECASE
 )
 _GUIDE_REF_RE = re.compile(
-    r"""<reference\b(?:(?:"[^"]*"|'[^']*'|[^>])*)>""", re.IGNORECASE
+    r"""<reference\b(?:(?:"[^"]*"|'[^']*'|[^>])*+)>""", re.IGNORECASE
 )
 
 
@@ -421,7 +421,7 @@ def prune_dangling_edges(opf_text: str, pruned_ids: set[str]) -> tuple[str, int]
         return tag
 
     out = re.sub(
-        r"""<(?:spine|item|itemref)\b(?:(?:"[^"]*"|'[^']*'|[^>])*)>""",
+        r"""<(?:spine|item|itemref)\b(?:(?:"[^"]*"|'[^']*'|[^>])*+)>""",
         strip_attrs,
         opf_text,
         flags=re.IGNORECASE,
@@ -659,21 +659,21 @@ _DROP_HREF_ATTR_RE = re.compile(r"""\s+href\s*=\s*(?:"[^"]*"|'[^']*')""", re.IGN
 # shape as transforms._VOID_RE, so a '>' inside an attribute value cannot end
 # the tag early.
 _LINK_TAG_RE = re.compile(
-    r"""<link(?=[\s/>])((?:"[^"]*"|'[^']*'|[^>])*?)\s*(/?)>""",
+    r"""<link(?=[\s/>])((?:"[^"]*"|'[^']*'|[^>"'])*?)\s*(/?)>""",
     re.IGNORECASE | re.DOTALL,
 )
 _ANCHOR_TAG_RE = re.compile(
-    r"""<a(?=[\s/>])((?:"[^"]*"|'[^']*'|[^>])*?)\s*(/?)>""", re.IGNORECASE | re.DOTALL
+    r"""<a(?=[\s/>])((?:"[^"]*"|'[^']*'|[^>"'])*?)\s*(/?)>""", re.IGNORECASE | re.DOTALL
 )
-_IMG_TAG_RE = re.compile(
-    r"""<img(?=[\s/>])((?:"[^"]*"|'[^']*'|[^>])*?)\s*(/?)>""",
+_PRUNE_IMG_TAG_RE = re.compile(
+    r"""<img(?=[\s/>])((?:"[^"]*"|'[^']*'|[^>"'])*?)\s*(/?)>""",
     re.IGNORECASE | re.DOTALL,
 )
-_ITEM_TAG_RE = re.compile(r"""<item\b(?:(?:"[^"]*"|'[^']*'|[^>])*)>""", re.IGNORECASE)
+_ITEM_TAG_RE = re.compile(r"""<item\b(?:(?:"[^"]*"|'[^']*'|[^>])*+)>""", re.IGNORECASE)
 # `<itemref` must not be swallowed by the `<item\b` matcher above (\b has no
 # boundary before the 'r'), and its own idref carries the spine order.
 _SPINE_ITEM_RE = re.compile(
-    r"""<itemref\b(?:(?:"[^"]*"|'[^']*'|[^>])*)>""", re.IGNORECASE
+    r"""<itemref\b(?:(?:"[^"]*"|'[^']*'|[^>])*+)>""", re.IGNORECASE
 )
 # `\b` is what keeps `<item\b` from matching `<itemref`: "itemref" has a word
 # character right after "item", so there is no boundary there.
@@ -999,7 +999,7 @@ def prune_missing_images(
             counts[key] = counts.get(key, 0) + 1
             return alt if key == "missing_imgs_unwrapped" else ""
 
-        return _IMG_TAG_RE.sub(repl, part), counts
+        return _PRUNE_IMG_TAG_RE.sub(repl, part), counts
 
     total: dict[str, int] = {}
     if "<!" in text:

{bindery_cli-0.41.1 → bindery_cli-0.42.0}/src/bindery/transforms.py

@@ -32,14 +32,14 @@ XML_PREDEFINED = {"amp", "lt", "gt", "quot", "apos"}
 # quote-aware so a `>` inside an attribute value does not end the tag early. Group 3
 # captures an existing trailing slash so already-self-closed tags are left untouched.
 _VOID_RE = re.compile(
-    rf"""<({VOID})(?=[\s/>])((?:"[^"]*"|'[^']*'|[^>])*?)\s*(/?)>""",
+    rf"""<({VOID})(?=[\s/>])((?:"[^"]*"|'[^']*'|[^>"'])*?)\s*(/?)>""",
     re.IGNORECASE | re.DOTALL,
 )
 _VOID_END_RE = re.compile(rf"""</(?:{VOID})\s*>""", re.IGNORECASE)
 _NAMED_ENTITY_RE = re.compile(r"&([a-zA-Z][a-zA-Z0-9]*);")
 _BARE_AMP_RE = re.compile(r"&(?![a-zA-Z][a-zA-Z0-9]*;|#[0-9]+;|#[xX][0-9a-fA-F]+;)")
 # A start tag (quote-aware) and an attribute within it, for invalid-attribute stripping.
-_START_TAG_RE = re.compile(r"""<[a-zA-Z][\w:.-]*(?:"[^"]*"|'[^']*'|[^>])*>""")
+_START_TAG_RE = re.compile(r"""<[a-zA-Z][\w:.-]*(?:"[^"]*"|'[^']*'|[^>])*+>""")
 # The unquoted-value branch stops at whitespace or the end of the tag, and the `/?>`
 # lookahead is what keeps it off the tag's own self-closing slash: a plain `[^\s>]+`
 # swallowed it, so dropping the attribute in `<img 31=x/>` left `<img>` and turned a
@@ -235,7 +235,7 @@ def escape_unknown_entities(s: str) -> tuple[str, int]:
 # An <img> start tag, quote-aware like _VOID_RE; group 1 is the attribute block and
 # group 2 an existing self-closing slash, so the tag is rebuilt without reordering.
 _IMG_TAG_RE = re.compile(
-    r"""<img(?=[\s/>])((?:"[^"]*"|'[^']*'|[^>])*?)\s*(/?)>""",
+    r"""<img(?=[\s/>])((?:"[^"]*"|'[^']*'|[^>"'])*?)\s*(/?)>""",
     re.IGNORECASE | re.DOTALL,
 )
 # Whitespace before `alt` keeps data-alt/xml:alt-style names from matching; a quoted

bindery_cli-0.42.0/tests/test_matcher_hardening.py

@@ -0,0 +1,165 @@
+"""Regression net for the 2026-09-16 per-matcher hardening (the roadmap's
+matcher-audit follow-up box, executed).
+
+The 0.41.1 hotfix made three rewritten patterns possessive; the audit that
+followed found six more greedy patterns of the same exponential class
+(the quote-aware loop whose branches overlap) and five lazy patterns of
+the quadratic class. The greedy loops are now possessive `*+` (byte-
+identical on success: the loop is always followed by a literal `>` that
+the `[^>]` branch cannot consume, so backtracking only ever happened on
+failure). The lazy loops got a disjoint branch 3 (`[^>"']`: the catch-all
+no longer eats quote characters), which makes re-partitioning impossible
+and stops an unterminated quote inside a tag from pairing with a distant
+quote and matching across markup.
+
+A1 behavioral pins (success cases unchanged) and A2 pins (unterminated-
+quote tags are now skipped rather than mis-paired) live beside the spin
+guards here. The spin guard is the same shape as the 0.41.0 test: a
+failing candidate over an apostrophe-rich run must finish, not hang."""
+
+import signal
+import time
+import unittest
+
+from bindery import epub, transforms
+from bindery.transforms import _START_TAG_RE
+
+
+def _apostrophe_run(times: int = 2000) -> str:
+    return "don't can't won't it's kind of prose, isn't it " * times
+
+
+class GreedyStartTagSpin(unittest.TestCase):
+    """_START_TAG_RE runs under repair --all on every content doc: the same
+    input class as the Physics fixture (an apostrophe-rich run with no `>`
+    after the tag opener) must fail linearly."""
+
+    def test_spin_shape_fails_fast(self):
+        doc = "<p class='broken " + _apostrophe_run() + "and still no closer in sight"
+        signal.alarm(20)
+        try:
+            t0 = time.perf_counter()
+            m = _START_TAG_RE.search(doc)
+            elapsed = time.perf_counter() - t0
+        finally:
+            signal.alarm(0)
+        self.assertIsNone(m)
+        self.assertLess(elapsed, 5.0)
+
+    def test_success_shape_is_unchanged(self):
+        text = "<p class='x' data-y=\"a>b\">body</p>"
+        m = _START_TAG_RE.search(text)
+        self.assertEqual(m.group(0), "<p class='x' data-y=\"a>b\">")
+        # the `>` inside the quoted attribute stays attribute content
+        self.assertNotIn("body", m.group(0))
+
+
+class OpfTagMatchersSpin(unittest.TestCase):
+    """The OPF matchers iterate manifest/spine/guide tags: a truncated OPF
+    that ends inside an apostrophe-rich attribute run must fail linearly."""
+
+    SPIN_PREFIX = "<item id='id1' href='text/part1.xhtml' media-type='application/xhtml+xml' extra='"
+
+    def _assert_fast_no_match(self, regex, text):
+        signal.alarm(20)
+        try:
+            t0 = time.perf_counter()
+            m = regex.search(text)
+            elapsed = time.perf_counter() - t0
+        finally:
+            signal.alarm(0)
+        self.assertIsNone(m)
+        self.assertLess(elapsed, 5.0)
+
+    def test_item_tag_spin_shape(self):
+        self._assert_fast_no_match(
+            epub._ITEM_TAG_RE, self.SPIN_PREFIX + _apostrophe_run(500)
+        )
+
+    def test_itemref_tag_spin_shape(self):
+        text = "<itemref idref='id1' extra='" + _apostrophe_run(500)
+        self._assert_fast_no_match(epub._SPINE_ITEM_RE, text)
+
+    def test_cover_meta_spin_shape(self):
+        text = '<meta name="cover" content="' + _apostrophe_run(500)
+        self._assert_fast_no_match(epub._COVER_META_RE, text)
+
+    def test_guide_reference_spin_shape(self):
+        text = "<reference type='text' title='" + _apostrophe_run(500)
+        self._assert_fast_no_match(epub._GUIDE_REF_RE, text)
+
+    def test_success_shapes_unchanged(self):
+        opf = (
+            '<package><item id="id1" href="a.xhtml" media-type="application/xhtml+xml"/>'
+            "<itemref idref='id1'/>"
+            '<meta name="cover" content="cover-image"/>'
+            "<reference type='text' title='t' href='a.xhtml'/></package>"
+        )
+        item = epub._ITEM_TAG_RE.search(opf)
+        self.assertEqual(
+            item.group(0),
+            '<item id="id1" href="a.xhtml" media-type="application/xhtml+xml"/>',
+        )
+        self.assertIsNotNone(epub._SPINE_ITEM_RE.search(opf))
+        self.assertIsNotNone(epub._COVER_META_RE.search(opf))
+        self.assertIsNotNone(epub._GUIDE_REF_RE.search(opf))
+
+    def test_prune_dangling_edges_spin_shape(self):
+        # prune_dangling_edges' inline spine|item|itemref matcher over a
+        # truncated OPF: linear failure, no hang.
+        opf = '<package><spine toc="ncx"><itemref idref=\'broken ' + _apostrophe_run(
+            500
+        )
+        signal.alarm(20)
+        try:
+            t0 = time.perf_counter()
+            epub.prune_dangling_edges(opf, {"gone"})
+            elapsed = time.perf_counter() - t0
+        finally:
+            signal.alarm(0)
+        self.assertLess(elapsed, 5.0)
+
+
+class LazyMatcherDisjointBranch(unittest.TestCase):
+    """The lazy matchers (_VOID_RE, the img/link/a tag matchers) now use a
+    disjoint branch 3 ([^>"']): an unterminated quote inside a tag can no
+    longer pair with a distant quote, so the mis-pairing match is gone.
+    Every well-formed shape is byte-identical."""
+
+    def test_void_unterminated_quote_skipped(self):
+        # OLD: this matched, pairing the quote with a distant one and
+        # mis-styling markup after the tag. NEW: no match, text untouched.
+        text = '<br x="a> and more prose follows here'
+        self.assertIsNone(transforms._VOID_RE.search(text))
+
+    def test_void_wellformed_shapes_still_match(self):
+        for tag in ("<br/>", "<br />", '<br class="x"/>', "<hr class='x' />"):
+            self.assertIsNotNone(transforms._VOID_RE.search(tag), tag)
+
+    def test_img_unterminated_quote_skipped(self):
+        text = '<img src="a> more prose'
+        self.assertIsNone(transforms._IMG_TAG_RE.search(text))
+
+    def test_img_wellformed_rebuild_identical(self):
+        tag = '<img src="pic.png" alt="a photo" />'
+        out, count = transforms.add_img_alt("<html><body>" + tag + "</body></html>")
+        self.assertEqual(count, 0)  # alt already present; tag untouched
+        self.assertIn(tag, out)
+
+    def test_prune_img_unterminated_quote_skipped(self):
+        text = '<img src="a> more prose'
+        self.assertIsNone(epub._PRUNE_IMG_TAG_RE.search(text))
+
+    def test_link_and_anchor_unterminated_quote_skipped(self):
+        self.assertIsNone(epub._LINK_TAG_RE.search('<link href="a> prose'))
+        self.assertIsNone(epub._ANCHOR_TAG_RE.search("<a href='a> prose"))
+
+    def test_link_and_anchor_wellformed_match(self):
+        self.assertIsNotNone(
+            epub._LINK_TAG_RE.search('<link href="a.css" rel="stylesheet"/>')
+        )
+        self.assertIsNotNone(epub._ANCHOR_TAG_RE.search('<a href="b.xhtml">text</a>'))
+
+
+if __name__ == "__main__":
+    unittest.main()