unstd 2.1.1__tar.gz → 3.1.0__tar.gz

unstd-3.1.0/.gitattributes

@@ -0,0 +1,3 @@
+# Reviewed envelopes are exact parser inputs, including whitespace and newlines.
+# Never normalize their bytes during checkout or merge them as text.
+tests/tooling/fuzz/corpus/**/*.bin binary

unstd-3.1.0/.github/workflows/chaos.yml

@@ -0,0 +1,75 @@
+name: chaos
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "43 7 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: chaos-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'schedule' }}
+
+jobs:
+  inventory:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      matrix: ${{ steps.groups.outputs.matrix }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          enable-cache: false
+          version: "latest-known"
+          python-version: "3.13"
+      - id: groups
+        shell: bash
+        run: |
+          matrix=$(uv run --no-project --python 3.13 python -m tests.tooling.chaos list --json)
+          printf 'matrix=%s\n' "$matrix" >> "$GITHUB_OUTPUT"
+
+  campaign:
+    needs: inventory
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.inventory.outputs.matrix) }}
+    env:
+      ROUNDS: ${{ github.event_name == 'schedule' && '10' || '1' }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          enable-cache: false
+          version: "latest-known"
+          python-version: "3.13"
+      # Both lanes install extras; the stdlib worker blocks acceleration imports
+      # before product loading, and propagates that policy into nested workers.
+      - run: uv sync --locked --all-extras --group dev --python 3.13
+      - name: Recorded faults, interruption and recovery
+        run: >-
+          uv run --no-sync python -m tests.tooling.chaos run
+          --group ${{ matrix.group }} --backend ${{ matrix.backend }}
+          --seed 173 --rounds "$ROUNDS"
+          --wall-seconds 120 --per-test-seconds 45 --cpu-seconds 60 --memory-mb 2048
+          --artifact-dir .local/chaos/
+      - name: Retain schedules, observations and failures
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: chaos-${{ matrix.group }}-${{ matrix.backend }}-${{ matrix.os }}-${{ github.run_attempt }}
+          path: .local/chaos/
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14

{unstd-2.1.1 → unstd-3.1.0}/.github/workflows/ci.yml

@@ -35,6 +35,10 @@ jobs:
           version: "latest-known"
           python-version: "3.13"
       - run: uv sync --locked --all-extras --group dev --python 3.13
+      - run: uv run --no-sync --python 3.13 python -m tests.tooling check
+      - run: uv run --no-sync --python 3.13 python -m tests.tooling.fuzz check
+      - run: uv run --no-sync --python 3.13 python -m tests.tooling.chaos check
+      - run: uv run --no-sync --python 3.13 python -m tests.tooling.concurrency check
       - run: uv run --python 3.13 ruff check .
       - run: uv run --python 3.13 ruff format --check .
       - run: uv run --python 3.13 mypy
@@ -59,7 +63,8 @@ jobs:
           version: "latest-known"
           python-version: ${{ matrix.python-version }}
       - run: uv sync --locked --all-extras --group dev --python ${{ matrix.python-version }}
-      - run: uv run --python ${{ matrix.python-version }} pytest -q
+      - run: uv build --python ${{ matrix.python-version }} --sdist --wheel --out-dir "$RUNNER_TEMP/unstd-build-cache"
+      - run: uv run --no-sync --python ${{ matrix.python-version }} pytest --require-extras -q
 
   floors:
     # Every extra declares a floor, and a floor is a promise: install this old a
@@ -86,11 +91,12 @@ jobs:
       # Which versions the floors admitted — the first thing anyone reading a
       # failure here needs, and not recoverable from the traceback.
       - run: uv pip list
+      - run: uv build --python 3.13 --sdist --wheel --out-dir "$RUNNER_TEMP/unstd-build-cache"
       # `--no-sync` is what makes this job mean anything. A bare `uv run`
       # re-resolves in the default `highest` mode and quietly reinstalls the
       # newest of everything first, so the suite would run against the same
       # environment `test` already covers and pass no matter what the floors say.
-      - run: uv run --no-sync --python 3.13 pytest -q
+      - run: uv run --no-sync --python 3.13 pytest --require-extras -q
 
   test-fallback:
     # A base install (no optional extras) is a load-bearing, documented contract
@@ -100,8 +106,8 @@ jobs:
     # fixtures inside the suite. This job takes the real path.
     #
     # Which modules can't be collected without their extra is decided by
-    # `tests/conftest.py`, which probes importability rather than carrying a
-    # list. A hardcoded `--ignore` roster here would be a second copy of that
+    # `tests/conftest.py`, which centralizes module importability probes.
+    # A hardcoded `--ignore` roster here would be a second copy of that
     # decision, and the copy that lives in CI is the one nobody updates.
     runs-on: ubuntu-latest
     steps:
@@ -114,8 +120,9 @@ jobs:
           version: "latest-known"
           python-version: "3.13"
       - run: uv sync --locked --group dev --python 3.13
+      - run: uv build --python 3.13 --sdist --wheel --out-dir "$RUNNER_TEMP/unstd-build-cache"
       # A diagnostic, not a gate — the zero-closure claim is asserted offline by
-      # `tests/test_package.py`. This is here because a failure that reproduces
+      # `tests/suites/assurance/gates/packaging/test_package.py`. A failure that reproduces
       # only on the fallback leg is nearly unreadable without knowing which
       # backends were actually present when it ran (the test tooling drags in a
       # couple of its own, e.g. hypothesis → sortedcontainers).

unstd-3.1.0/.github/workflows/concurrency.yml

@@ -0,0 +1,75 @@
+name: concurrency
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "13 8 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: concurrency-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'schedule' }}
+
+jobs:
+  inventory:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      matrix: ${{ steps.groups.outputs.matrix }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          enable-cache: false
+          version: "latest-known"
+          python-version: "3.13"
+      - id: groups
+        shell: bash
+        run: |
+          matrix=$(uv run --no-project --python 3.13 python -m tests.tooling.concurrency list --json)
+          printf 'matrix=%s\n' "$matrix" >> "$GITHUB_OUTPUT"
+
+  campaign:
+    needs: inventory
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.inventory.outputs.matrix) }}
+    env:
+      ROUNDS: ${{ github.event_name == 'schedule' && '10' || '1' }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          enable-cache: false
+          version: "latest-known"
+          python-version: "3.13"
+      # Both lanes install extras; the stdlib worker blocks acceleration imports
+      # before product loading, and propagates that policy into nested workers.
+      - run: uv sync --locked --all-extras --group dev --python 3.13
+      - name: Recorded overlap, ordering and isolation
+        run: >-
+          uv run --no-sync python -m tests.tooling.concurrency run
+          --group ${{ matrix.group }} --backend ${{ matrix.backend }}
+          --seed 173 --rounds "$ROUNDS"
+          --wall-seconds 120 --per-test-seconds 45 --cpu-seconds 60 --memory-mb 2048
+          --artifact-dir .local/concurrency/
+      - name: Retain schedules, observations and failures
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: concurrency-${{ matrix.group }}-${{ matrix.backend }}-${{ matrix.os }}-${{ github.run_attempt }}
+          path: .local/concurrency/
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14

unstd-3.1.0/.github/workflows/fuzz.yml

@@ -0,0 +1,84 @@
+name: fuzz
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "23 6 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fuzz-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'schedule' }}
+
+jobs:
+  inventory:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      matrix: ${{ steps.targets.outputs.matrix }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          enable-cache: false
+          version: "latest-known"
+          python-version: "3.12"
+      - id: targets
+        shell: bash
+        run: |
+          matrix=$(uv run --no-project --python 3.12 python -m tests.tooling.fuzz list --json --all-backends)
+          printf 'matrix=%s\n' "$matrix" >> "$GITHUB_OUTPUT"
+
+  campaign:
+    needs: inventory
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.inventory.outputs.matrix) }}
+    env:
+      RUNS: ${{ github.event_name == 'schedule' && '100000' || '1000' }}
+      WALL: ${{ github.event_name == 'schedule' && '120' || '30' }}
+      CPU: ${{ github.event_name == 'schedule' && '110' || '20' }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          enable-cache: false
+          version: "latest-known"
+          python-version: "3.12"
+      # Atheris has a tested binary wheel here; it is a development group,
+      # never a runtime dependency or a silently substituted mutation engine.
+      - run: uv sync --locked --all-extras --group dev --group fuzz --python 3.12
+      - name: Replay and deterministic mutation
+        run: >-
+          uv run --no-sync python -m tests.tooling.fuzz campaign
+          --target ${{ matrix.target }} --backend ${{ matrix.backend }}
+          --engine deterministic --runs 1000 --seed 173
+          --wall-seconds 30 --cpu-seconds 20
+          --artifact-dir .local/fuzz/deterministic
+      - name: Instrumented Python coverage campaign
+        run: >-
+          uv run --no-sync python -m tests.tooling.fuzz campaign
+          --target ${{ matrix.target }} --backend ${{ matrix.backend }}
+          --engine atheris --runs "$RUNS" --seed 173
+          --wall-seconds "$WALL" --cpu-seconds "$CPU"
+          --artifact-dir .local/fuzz/atheris
+      - name: Retain reports, findings, and coverage corpus
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: fuzz-${{ matrix.target }}-${{ matrix.backend }}-${{ github.run_attempt }}
+          path: .local/fuzz/
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14

unstd-3.1.0/.github/workflows/release.yml

@@ -0,0 +1,93 @@
+# Build and verify native wheels before publishing a version tag to PyPI.
+#
+# ONE-TIME SETUP: PyPI Trusted Publishing, no API token in this repo.
+# On PyPI, add a trusted publisher for the `unstd` project pointing at this
+# repository, workflow `release.yml`, environment `pypi`. Before the project
+# exists this is a pending publisher under Your projects -> Publishing.
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  # A tag push used to publish unconditionally — nothing stood between `git tag`
+  # and PyPI, and a release is the one artifact that cannot be taken back. The
+  # full CI gate (lint + type + the 3.12/3.13/3.14 matrix + the base-install
+  # fallback leg) runs first, by reference rather than by copy, so the bar is
+  # the same one every pull request clears.
+  gate:
+    uses: ./.github/workflows/ci.yml
+    permissions:
+      contents: read
+
+  wheels:
+    needs: gate
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, ubuntu-24.04-arm, macos-15-intel, macos-14, windows-latest, windows-11-arm]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          enable-cache: false
+          version: "latest-known"
+      - name: Build and test CPython wheels
+        run: uvx --from cibuildwheel==4.3.1 cibuildwheel --output-dir dist
+      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: wheels-${{ matrix.os }}
+          path: dist/*.whl
+          if-no-files-found: error
+
+  sdist:
+    needs: gate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          enable-cache: false
+          version: "latest-known"
+      - run: uv build --sdist
+      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: source
+          path: dist/*.tar.gz
+          if-no-files-found: error
+
+  pypi:
+    needs: [wheels, sdist]
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        with:
+          path: dist
+          merge-multiple: true
+      - name: The tag agrees with package metadata
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          python - <<'PY'
+          import os, pathlib, tarfile, tomllib
+          source, = pathlib.Path("dist").glob("*.tar.gz")
+          with tarfile.open(source) as archive:
+              manifest, = (item for item in archive.getmembers() if item.name.endswith("/pyproject.toml"))
+              version = tomllib.loads(archive.extractfile(manifest).read().decode())["project"]["version"]
+          assert os.environ["TAG"] == "v" + version
+          PY
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

{unstd-2.1.1 → unstd-3.1.0}/.gitignore

@@ -2,6 +2,9 @@
 __pycache__/
 *.py[cod]
 *.egg-info/
+*.so
+*.pyd
+build/
 .venv/
 dist/
 .pytest_cache/

{unstd-2.1.1 → unstd-3.1.0}/CHANGELOG.md

@@ -8,7 +8,7 @@ doc_radar:
     - file: .github/workflows/ci.yml
       contains: ['github.sha || github.ref', 'version: "latest-known"', 'uv sync --locked']
     - file: .github/workflows/release.yml
-      contains: ['TAG: ${{ github.ref_name }}', 'uv version --short']
+      contains: ['TAG: ${{ github.ref_name }}', 'Build and test CPython wheels']
     - file: src/unstd/serde/structs.py
       contains: ['Callable[[Decimal], object]', 'decimal_format: _DecimalFormat']
 ---
@@ -17,6 +17,219 @@ doc_radar:
 
 <!-- towncrier release notes start -->
 
+## [3.1.0] - 2026-10-20
+
+### Performance
+
+- JSON encoding can use an optional CPython native guard that checks exact
+  builtin trees and calls orjson while retaining the GIL. Larger text records
+  avoid 3.0.0's Python snapshot budget and stdlib fallback. Compiler-less source
+  builds retain the portable path; release wheels include the guard.
+- Native default spacing preserves punctuation and escaped quotes inside text,
+  avoiding the stdlib fallback for larger string-heavy records.
+- Untyped JSON decoding reuses msgspec's arbitrary-precision integer and correctly
+  rounded float decoder, with a bounded native proof enabling orjson for larger
+  records. CPython 3.14 native dispatch preserves Python function metadata and
+  falls back during instrumentation. Custom options, unsupported inputs and
+  native errors retain stdlib behavior.
+- NDJSON writes use the same guarded encoder's native trailing-newline option,
+  avoiding redundant public dispatch and an extra output copy per record.
+- Whole-blob NDJSON reads batch native parsing over strict physical newline
+  boundaries. Streaming reads, callbacks and error diagnostics keep their
+  existing behavior.
+- Added an output-checked Billy fixture comparison with source and fixture
+  fingerprints, alternating before/after CPU batches, direct-call companions and
+  an optional release-regression gate. The measurement report retains residual
+  costs relative to the permissive 2.1.1 codec; no universal speedup or
+  zero-overhead compatibility claim is made. Public APIs are unchanged.
+
+### Fixed
+
+- Native codec reinitialization keeps earlier helpers' configuration checks and
+  Python fallbacks valid. Module destruction also releases watchers and owned
+  references when garbage collection has not run the clear hook first.
+
+## [3.0.0] - 2026-10-19
+
+### Breaking
+
+- `serde.jsonx` now guarantees the running stdlib's JSON defaults and semantics.
+  `dump` and `dumps` use `ensure_ascii=True` and default spaces, replacing the
+  previous compact, unescaped output. To retain compact text, pass
+  `ensure_ascii=False, separators=(",", ":")` explicitly. Dataclasses, UUIDs and
+  plain enums now require an explicit encoder or `default`, as they do in
+  stdlib `json`; orjson-only type acceptance is removed.
+- JSON numbers retain their values: arbitrary precision integers no longer fail
+  on encode or silently become floats on decode, and non-finite floats follow
+  stdlib's `NaN`/infinity behavior instead of silently becoming `null`.
+  `allow_nan=False` rejects them. Unicode and lone surrogates, UTF-16/32 binary
+  input, supported subclasses, key coercion/sorting, callbacks, custom codec
+  keywords, error diagnostics and interpreter limits follow stdlib too.
+  `dump` preserves streamed writes, including partial output before a later
+  encoding or write failure; `load` reads once through the guarded parser.
+- `jsonx.dumpb` now preserves exact compact stdlib float notation across
+  backends, which can change serialized bytes. NDJSON and Base64 JSON helpers
+  preserve the same numeric values. NDJSON wraps Unicode, integer-limit and
+  recursion failures with physical line numbers and honors `skip_errors=True`.
+
+### Added
+
+- `unstd.yaml`, behind `unstd[yaml]`, provides safe YAML 1.2 native-value
+  loading, multi-document streams, and comment-preserving parse/edit/write.
+  Duplicate keys and unknown tags are rejected; parser instances and scalar
+  semantics are isolated from optional C extensions. The base install keeps
+  zero third-party dependencies.
+- `unstd.compress.gzipx`, behind `unstd[compress]`, accelerates gzip file and
+  one-shot operations with zlib-ng, with exact stdlib bindings on a base
+  install. Streams retain stdlib framing, ownership, modes, seeking and error
+  families; one-shot defaults follow the running interpreter. Compressed bytes
+  may differ between codecs while recovered content remains identical.
+- NDJSON readers and writers accept a reusable `structs.Codec` through `codec=`.
+  Readers decode each row directly into its validated schema, preserving
+  physical line numbers and schema paths on errors. `on_error` reports each
+  rejected record once before the normal raise or explicit skip. Untyped
+  streaming still works on a base install, and typed processing reuses the
+  existing serde extra.
+- Base64 exposes stdlib-compatible `b64encode`/`b64decode`, standard and URL-safe
+  functions, MIME byte helpers and `encode_file`/`decode_file` stream helpers
+  alongside the convenience API. Standard defaults, alternative alphabets,
+  buffer handling, exception types and diagnostics follow the running stdlib.
+  Acceleration is limited to plain-byte encoding and strict ASCII decoding;
+  other cases and native decode failures use stdlib.
+- Eleven executable parser/token fuzz targets use independent oracles,
+  authenticated synthetic seed corpora, finite pytest replay, deterministic
+  mutations, and isolated Atheris campaigns. Workers preserve exact failures
+  and enforce wall/input deadlines, POSIX CPU limits and Linux address-space
+  limits. CI runs bounded pull-request campaigns and deeper nightly coverage
+  campaigns, retaining reports and generated corpora. Harness canaries verify
+  that incorrect results, unexpected exceptions, crashes and exhausted budgets
+  fail the run.
+- Recorded chaos campaigns cover mixed filesystem/process histories,
+  handshaken writer interruption, stream failures and clock/entropy outages.
+  Bounded installed/fallback workers, seed replay, exact fault journals, strict
+  completion controls and Linux/macOS pull-request/nightly CI campaigns retain
+  recovery evidence. Ordinary correctness discovery stays separate from
+  explicit chaos runs.
+- Recorded concurrency campaigns cover atomic filesystem histories, UUID
+  contention/fork safety, and shared clone/regex/codec/YAML/map isolation.
+  Independent models, broken-result controls, bounded installed/stdlib workers,
+  lane-specific replay and Linux/macOS pull-request/nightly jobs retain
+  schedules and observations. This explicit lane stays outside default pytest;
+  owning defect regressions remain in ordinary validation.
+
+### Changed
+
+- Native JSON acceleration now requires bounded eligibility proofs. Encoding
+  snapshots at most 16 exact builtin values before calling orjson, retaining
+  exact whitespace and escaping; other inputs use cached or direct stdlib
+  encoders. Decoding verifies the complete backend result and falls back to
+  stdlib for every float, including lossy large-integer conversions.
+  Hooks/custom codecs bypass speculation; deep or unproven cases and backend
+  errors retry the original input with stdlib. Callback isolation, snapshot
+  mutation, DEL escaping and near-limit recursion failures have generated
+  contracts that also assert real backend use.
+- JSON type annotations accept duck-typed writers and typed `default`
+  callbacks. The `numpy=True` conversion extension is consistent across
+  backends. With an explicit custom `cls`, `dump`/`dumps` forward all
+  constructor keywords unchanged. Differential tests use the running stdlib as
+  the authority across Python 3.12–3.14 and optional-backend/base configurations;
+  generated cases include large integers, non-finite values, lone surrogates,
+  mixed keys, formatting options, binary encodings and malformed input.
+- The test suite follows Billy's Python organization: module-owned contracts
+  under `tests/suites/product`, cross-cutting assurance under
+  `tests/suites/assurance`, shared support, and standalone tooling. A validated
+  inventory distinguishes active coverage from planned lanes and provides
+  `python -m tests.tooling list|check|run`. CI checks inventory drift; pytest
+  uses strict markers and shared generation profiles. Existing TLS policy tests
+  run without the BLAKE3 extra. The coverage plan maps remaining property, fuzz,
+  penetration, fault, installation, concurrency, resource and performance work
+  without counting scaffolding as implemented tests. Wall-clock benchmark
+  calibration assertions use the explicit `perf` marker, outside ordinary
+  correctness runs.
+- P0 assurance builds and installs real artifacts in pristine consumers, checks
+  independent optional-extra installations, performs real loopback TLS
+  handshakes, injects filesystem/process failures, and challenges parser and
+  token boundaries with independent controls and bounded workers. Required CI
+  execution fails when declared extras are unavailable.
+
+### Fixed
+
+- Installed-extra checks use locked artifact URLs and hashes for offline
+  consumers, including source-built dependencies at declared floors. Crash
+  controls allow Python 3.14 diagnostics to finish while retaining the short
+  intentional-hang deadline.
+- YAML fuzzing compares scalar `ValueError` exceptions from malformed dates
+  with the reference parser, retaining exact error types and messages. The
+  discovered invalid-date input is preserved in the authenticated seed corpus.
+- URL convenience Base64 decoding behaves the same with and without pybase64:
+  ignored characters no longer interfere with missing-padding repair,
+  completed padding preserves stdlib's handling of trailing data, non-ASCII
+  text raises stdlib's `ValueError`, and strided decoding buffers work. URL
+  decoding no longer emits pybase64's alternate-alphabet warnings. Strict
+  validation still accepts nonzero unused pad bits, as stdlib does; it does not
+  promise canonical spelling. Independent differential and generated
+  malformed-input contracts cover native and fallback paths. The decode
+  benchmark compares the same strict validation mode on both paths.
+- Process timeouts must be positive and finite. Filesystem rollback preserves
+  scratch-descriptor ownership and the original error, and directory syncing
+  remains best effort. Bearer-token envelopes require strict canonical
+  Base64url spelling, and non-ASCII MACs are rejected. The general-purpose URL
+  Base64 codec retains its documented lenient behavior. Editable YAML supports
+  standard `!!str` construction.
+- Native WAV writes select the WAV format for file-like, extensionless and
+  misleading-extension outputs in both one-shot and streaming writers, pinned
+  by independent audio-extra consumer tests.
+- Confirmed surrogate-region regex and truncated PCM frame findings remain as
+  module-owned regressions and corpus entries. Faithful regex recovery is
+  selected before exposing lazy match projections; incomplete PCM frames are
+  rejected explicitly.
+- `proc.run` kills and reaps its direct child before propagating cancellation,
+  including the `KeyboardInterrupt` path where `subprocess.run` could return
+  with an unreaped child. Captured output, timeout behavior and callback
+  semantics are preserved; real SIGINT regressions cover `run`, `capture` and
+  `run_ok`, including recovery.
+- The Python UUIDv7 fallback resets its lock and counter state after POSIX fork
+  so a child can generate IDs even when a vanished parent thread held the
+  counter lock. The parent's state and selected UUID backend are preserved;
+  a bounded ordinary regression and controlled concurrency histories pin the
+  deadlock.
+- Concurrent regular-expression cache misses no longer exceed the documented
+  512-entry limit when multiple threads select the same oldest entry. Compiles
+  publish before trimming and retry lost evictions. A bounded regression forces
+  the duplicate-oldest interleaving against native and stdlib backends.
+- Package metadata lookup is deferred until `unstd.__version__` is requested
+  and the result is cached. Importing submodules such as
+  `unstd.serde.structs` avoids that startup cost while retaining the same native
+  codecs, parsing behavior and metadata-derived version, including the
+  uninstalled-source fallback.
+
+### Performance
+
+- Reduce JSON eligibility and compact-encoding overhead, accelerate URL-safe
+  Base64 decoding, and improve structural cloning and stdlib array packing.
+  The portable Levenshtein fallback evaluates packed dynamic-programming
+  columns. Public call signatures, serialized formats and optional dependencies
+  for these hot-path optimizations stay the same; parity and regression tests
+  cover the optimized boundaries.
+- Reduce serde dispatch and allocation overhead for default JSON encoding,
+  small decoded JSON values, integer snapshot proofs, short Base64 decoding
+  and NDJSON writer setup. These optimizations preserve public signatures,
+  codec policies, output and error semantics. A repeatable complete function
+  profile includes output-checked native/fallback benchmarks and explicit API
+  comparisons.
+- Reduce duplicate private-attribute traversal when cloning Pydantic models
+  and the dataclass conversion entry check. Remove redundant integer
+  conversion, branching and bit assembly in the portable UUIDv7 generator.
+  Existing APIs, direct stdlib aliases, secure entropy and synchronized counter
+  behavior remain. Custom dataclass constructor arguments and msgspec copy
+  reducers defer to the stdlib copy protocol. Reproducible per-function
+  clone/UUID profiles and paired workload timings include output validation,
+  unchanged-signature checks and explicit coverage gaps.
+- JSON benchmarks separately measure fallback records and eligible
+  text/integer cases. Python 3.13.14 measured 5.98× text encoding and 1.91×
+  integer-array decoding. The old speed floors covered incompatible behavior
+  and were reset; no uniform speedup is promised.
+
 ## [2.1.1] - 2026-10-04
 
 ### Fixed