TRACK 2. All seven were tested and released; none had a line in
docs/LIMITATIONS.md. Written where each belongs topically, not appended.
36 -> 43 items; README count moved with it. No code change, no release.
- The carrier split LOOSENS a lone anchor, not only tightens. Measured as
shipped: <a href="https://ext.example/p"> alone is active:raw-html-link at
MEDIUM -> quarantine_review on PRESET_USER_UPLOAD (warn on trusted); through
0.6.1 it was HIGH -> fail_secure. An <img src> to the same host is untouched.
Only the tightening direction had been documented.
- The no-URL narrowing's name set is a judgement about affordance no test can
derive. A name wrongly placed in _URL_AFFORDANCE_TAGS goes silently inert,
and no corpus can catch it: what it produces is an absence.
- hybrid-xss:script-tag and active:raw-html do not match the same strings.
<script src="a<b"> raises active:raw-html and NO XSS label -- the lexicon's
[^><] is the 0.3.3 ReDoS fix, HTML_TAG_RE consumes quoted runs atomically.
Disposition never moves; the label does, so that id is not a script census.
- A green ReDoS row is evidence only if seen red, and three rows never were.
Corrected while writing: the third row is
test_gate_is_bounded_on_the_long_attribute_arm, killed by 0.7.0's own
narrowing (separation 1.0x, 0.028s, no findings) -- not active-url-attr-value,
which is a payload-design rule, not a dead row.
- Every suite bound runs on process CPU time (tests/redos_clock.py); the
residual is that a BLOCKING hang would hang the suite. docs/redos-sweep.py
still times on time.monotonic(), so the published 1.5ms floor at N=8000 and
the "~23s at the cap" figure come from a different instrument than the bounds
they justify. Not re-derived; stated as not directly comparable.
- Under DEFAULT_ACTION_MAP the assessment axis adds exactly one judgement over
the disposition (NONE vs LOW). Consequence for this document: the published
FP rates are a risk statement only while NONE+LOW are the WARN pre-image.
- The ZWJ context test is one predicate on two surfaces, and the symbol is
private -- output imports sanitize's _is_joiner_in_emoji_sequence, so a
consumer importing it pins a name 1.x does not promise.
Verified: 802 passed, 129/129 classes, 6/6 gaps hold, grep -c '^- \*\*' = 43,
and the doc scanned for stray format characters (one U+200D remains, the
pre-existing composed emoji -- an accidental U+200C of my own was removed).
Kjell Tore Guttormsen
4472f209a4