PyCForge 1.3.1 — complete-application reliability audit
Audit date: 14 October 2026 (America/Chicago)

SPLASH AND DEPENDENCY CORRECTION — VERSION REMAINS 1.3.1
This correction was made in the complete delivered v1.3.1 source. No source
from the older package on PyPI was downloaded, incorporated or changed.

The embedded Ting dependency gate rejected installed NumPy 2.5.3 based solely
on its version. PyCForge now declares PySide6, numpy, numba, jedi and autopep8
without version specifiers. Its numeric dependency check asks only whether
NumPy and Numba are installed; it performs no version comparison. Actual
imports, checked numerical warmup and rulepack validation remain. Missing
numerical dependencies receive an install command for the current interpreter,
not an instruction to reinstall standalone Ting. Dependency libraries retain
their own compatibility rules and implementation; these were not modified.

The splash used a fixed height smaller than its layout required. It now fits
its layout, wrapped details and font metrics, preserves the full logo dimensions
and adds subtitle descent space. Its X was receiving initial keyboard focus
and therefore the focus highlight even with the pointer elsewhere. Initial
focus now belongs to Cancel/Close; pointer leave, reopen, keyboard access and
error-close behavior are covered by regressions.

Testing Jedi 0.20.1 exposed parameter-reference groups that included an unrelated
same-named global and omitted parameter reassignments. Rename now validates
reciprocal references and owning scope, retaining nonlocal bridges. Tests cover
both Jedi 0.19.2 and 0.20.1. This correction does not change conversion behavior.

Exactly five packaged files changed from the previous v1.3.1 wheel:
  pycforge/_vendor/ting_reasoner/numeric.py
  pycforge/_vendor/ting_reasoner_provenance.json
  pycforge/ide/editing_operations.py
  pycforge/ide/qt_startup.py
  pycforge/ide/rename_safety.py
Package metadata, regression tests and release/audit records were also updated.
The application version, all conversion files and all 21 Help pages are unchanged.
No development-cycle status was added to Help.

Current v1.3.1 correction validation:
  Full suite: 1667 tests + 4233 subtests passed; 19 skipped; 470.87s.
  Native PCFC11 selection, with compiler configured: 33 passed, 8 subtests passed in 6.28s
  Remaining unavailable/inapplicable checks: 19; individual reasons are recorded.
  Installed-wheel regressions: 54 passed, 1 deselected, 6 subtests passed in 14.48s
  Installed startup/editor/Typed/Runtime/Help/gutter/worker-cleanup workflows passed
    with NumPy 2.5.3 and again in the fresh NumPy 2.5.4 installation.
  Older dependency selection: 54 passed, 1 deselected, 6 subtests passed.
  Splash regressions: 8 passed at each of 125%, 150% and 200% scaling;
    the full suite includes default scaling and font sizes 11, 14 and 18.
  Normal wheel installation preserved preinstalled NumPy 2.5.3, Numba 0.68.0,
    Jedi 0.20.1 and autopep8 2.3.2. pip check passed in both installations.
  Windows x64 wheel resolution passed for Python 3.11, 3.12 and 3.13.
  All 815 package files match source and both installed wheels exactly.
  Compared with the previously delivered v1.3.1 wheel: 815 retained, 810 unchanged,
    five corrected, zero removed. All 14 Runtime files and 21 Help pages unchanged.

Validation environments: Linux x86-64, Python 3.12.14, PySide6 6.12.0, offscreen Qt.
Current set: NumPy 2.5.3, Numba 0.68.0, llvmlite 0.50.0, Jedi 0.20.1,
autopep8 2.3.2. Fresh install selected NumPy 2.5.4 with those same other versions.
Older set: NumPy 2.3.5, Numba 0.67.0, llvmlite 0.49.0, Jedi 0.19.2,
autopep8 2.3.2. Numerical checks execute JIT-compiled filters, packed masks,
short-circuit counts, sequential floating sums and checked integer overflow.

The first fresh test-environment install contained a truncated llvmlite shared
library. Reinstalling that same 0.50.0 wheel restored its recorded bytes. The
subsequent installed workflow passed; source/binary RECORD verification found
no remaining mismatches. Two regenerated Python bytecode caches are separately
identified in fresh-install-file-integrity.json. No dependency downgrade was used.

The first full run stopped in the new splash test's teardown while it restored
the global QApplication stylesheet across unrelated retained test windows. The
display probes now run in a fresh QApplication subprocess, with all original
geometry/focus assertions retained. The failing trace is preserved in
full-current-display-fixture-crash.log; the final suite was rerun in full.

Evidence is under evidence/startup_fix_1_3_1, including the initial Jedi failure,
fixed regressions, dependency resolution, file preservation and installation checks.
The memory/idle-CPU measurements below remain the earlier reliability audit's
measurements, not new measurements for the changed numerical dependency set.
Native Windows visual/interaction, Windows compiler execution and laptop energy
measurements remain pending. Windows wheel resolution is not native execution.

EARLIER V1.3.1 RELIABILITY AUDIT (RETAINED HISTORICAL EVIDENCE)

This is one cumulative reliability update to the complete v1.3.0 application.
No conversion or editor feature was removed. The installed package and the
source archive are distribution formats of the same application.

RESULT AND SCOPE
The audit examined resource ownership, cancellation, shutdown, bounded queues,
file I/O, source-token publication, editor lifecycle, conversion/build workflows,
and package preservation. It combines code review, failing-before/fixed-after
regressions, a 100-cycle desktop soak, native generated-C checks and the full
regression suite. This is evidence of the tested behavior, not proof that every
possible input, platform or hardware configuration is defect-free.

Validation before the splash/dependency correction:
  Full suite: 1648 tests + 4233 subtests passed; 19 skipped; 450.49s.
  Installed-wheel regressions: 45 tests + 8 subtests passed.
  Native ASan/UBSan selection: 10 passed (leak inspection unavailable here).
  Installed startup/editor/mode/Jedi/autopep8/Help/gutter checks: passed.
  Installed three-module file workflow, CLI and artifact inspection: passed;
    generated-program output/file bytes matched Python and the expected fixture.
  All 815 wheel package files exactly match the final source and installation;
    21 Help pages and all seven Windows compatibility headers are included.
  No packaged dependency was added or removed.
The 19 skips comprise 18 unavailable historical sealed predecessor checks and
one test that only applies when PySide6 is absent. They are listed individually
in evidence/reliability_1_3/skipped-checks.json.

During this audit, the first complete run passed 1,643 tests and 4,233 subtests
with 19 skips but failed five source-contract checks: one expected the old
QTimer call text, and four rejected qt_projection.py at 603 lines against its
existing less-than-600-line budget. The assertion now requires the QObject
context; function signatures were compacted to 598 lines without weakening
the budget. The first-run logs are retained as full-suite-first.xml/.log.

EXACTLY WHAT THE EARLIER “MERGE ERRORS” WERE
That phrase was too broad. The saved first complete-suite run had 11 failures:

1. ConversionModeUiTests.test_button_and_keyboard_use_selected_mode_and_both_save_c
   “UI did not reach the expected state.” A canceled startup dialog remained
   modal, blocking the later keyboard conversion action. Real application bug.
2. WorkspaceEditorTests.test_tall_menu_can_scroll_to_last_command_with_keyboard
   Expected editor.auto_complete, received None. The test did not descend through
   the nested overflow menu. Test navigation/expectation corrected.
3. Phase122QtBehaviorTests.test_ctrl_h_opens_replace_once_while_find_field_has_focus
   Expected one activation, observed zero. The same lingering startup modal
   blocked Ctrl+H. Same real application bug as item 1, not a second root cause.
4. Phase15AMetadataTests.test_active_ide_modules_and_runtime_authority_are_bounded
   Old toolchain-free audit rejected the token “gcc” in qt_build.py after PCFC11
   compilation became an intended application feature. Audit scope corrected.
5. Phase15BActionContractTests.test_action_catalog_has_no_forbidden_product_commands
   Old contract still prohibited the intended Compile command. Contract corrected.
6. Phase15CActionContractTests.test_action_metadata_avoids_excluded_and_deferred_vocabulary
   Same obsolete command vocabulary exclusion. Contract corrected.
7. Phase15CActionContractTests.test_registry_identity_and_inventories_are_exact
   Expected 72 actions; actual was 73 after adding Compile. Inventory corrected.
8. Phase15CQtWorkspaceIntegrationTests.test_shell_registers_exactly_all_71_static_handlers
   Expected 71 static handlers; actual was 72. Inventory corrected.
9. Phase8Tests.test_boolean_short_circuit
   Expected “a && b || c”; emitted C was “(a && b) || c”. The explicit parentheses
   preserve semantics and support PCFC11. Exact-text expectation corrected.
10. ReleaseContract0163Tests.test_action_and_surface_inventories_match_the_new_identity
    Expected 72 actions; actual was 73. Inventory corrected.
11. Phase15AValidatorTests.test_current_runtime_is_byte_only_process_isolated_and_toolchain_free
    Same obsolete toolchain-free audit as item 4. Scope corrected.

The next suite retained only failures 1 and 3. Their startup-dialog root cause
was fixed with done(0)/deleteLater cleanup. The final v1.3.0 suite then passed:
1,638 tests and 4,233 subtests, with 19 skips. These failures were not unresolved
textual conflict markers or evidence that advanced conversions had to be removed.
Exact test identifiers, messages and traces are preserved in
  evidence/reliability_1_3/earlier-failures-exact.json
and the original logs under evidence/consolidation/.

Separate implementation work was also necessary before v1.3.0: PCFC11's build
service needed a Runtime entry adapter (context initialization/destruction,
Runtime callable invocation and exit/error handling), math linkage and seven
Windows compatibility headers for missing PCFC11/UCRT declarations. This was
real compatibility work, not merely a test expectation adjustment. Linux native
builds and Windows-target assembly were exercised; native Windows execution
was not available here.

NEW FINDINGS FIXED IN THIS AUDIT

A. Deferred Qt work could outlive its native owner.
   A real MainWindow regression closed/deleted the window while large generated
   output and layout work were queued. A later callback touched a deleted
   QSplitter and raised RuntimeError. All 20 owner-touching QTimer.singleShot
   calls now provide the QObject context. Shutdown invalidates pending output
   slices and releases their source string. Snapshot/progress/layout and session
   restoration paths stop after closing. Repeated closed windows were also
   checked for collectable Python owners.
   Evidence: before-fixes.xml, qt-preview-fixes.xml, ownership-cancellation.xml.

B. Source-preview reads did not enforce their regular-file contract.
   The loader blocked on a POSIX FIFO and accepted /dev/null. The chooser normally
   filters regular files, but selection can become stale before the read.
   The loader now uses a nonblocking open where available, fstat on the actual
   opened descriptor, a regular-file check and size validation before allocation.
   It retains its bounded read and strict UTF-8 behavior. This does not establish
   a timeout for a stalled regular file on a network filesystem.
   Evidence: FIFO/device regressions in test_reliability_audit.py.

C. An outline process could be orphaned if startup raised after creating it.
   Fault injection created the OS child and then raised. The previous exception
   path closed pipes but left the child and process handle alive. It now owns
   cleanup through terminate/join/kill as required and closes process handles.
   This is a demonstrated exception-path gap, not a claim that normal startup
   routinely fails.
   Evidence: outline-start-before.xml and ownership-cancellation.xml.

D. Source artifact publication duplicated a large token dictionary tree.
   Publication now freezes token records incrementally, retaining all fields,
   token spellings, locations, immutable behavior and canonical fingerprints.
   Ten reference conversions (current and historical Typed profiles, Unicode,
   CRLF, functions and comments) retained identical complete semantic results,
   generated C and artifact fingerprints after this optimization.
   Evidence: conversion-preservation-baseline.json, source-publication.xml,
   allocations-before.json, allocations-after.json, conversion-memory-after.json.

E. Typed token ceilings were enforced after the entire input was tokenized.
   With a 20-token ceiling, the old implementation still consumed a file with
   thousands of excess tokens before rejecting it. The tokenizer now stops at
   the first excess token, including the remaining aggregate module budget.
   Supported inputs and existing rejection codes PYC3510/PYC2003 are preserved.
   Runtime already checked its token budget incrementally and is unchanged.
   Evidence: token-budget-before.xml and token-budget-after.xml.

MEMORY MEASUREMENTS
Environment: Linux x86-64, Python 3.12.14, PySide6 6.12.0; offscreen Qt.
The soak and allocation measurements used the complete source with the listed
fixes before the metadata-only version change from 1.3.0 to 1.3.1. The final
regression/installation results identify the released 1.3.1 package.

The 100-cycle soak opened/closed About, settings and source chooser dialogs
100 times each, opened/closed 100 source modules and completed 100 alternating
Typed/Runtime conversions with the full numeric startup checks enabled.

Parent process RSS (MiB):
  Startup                                      283.39
  After 100 cycles of each transient dialog     290.41
  After module open/close 51 / 100          297.00 / 297.17
  After conversion 51 / 100                301.36 / 301.77
  After close                                  297.28

The final 49 module cycles added about 0.17 MiB; the final 49 conversions added
about 0.42 MiB. That flattening, stable resource counts and ownership tests did
not show unbounded retention in this workload. It does not prove leak freedom.
RSS includes Python allocator arenas, Qt and numeric-library allocations;
closing a window does not unload all libraries from the Python process.

Child peak RSS, representative conversions (MiB, previous measurement -> new):
  One small Typed function                  63.99 -> 67.25
  100 Typed functions                       92.44 -> 94.22
  500 Typed functions                      198.32 -> 202.58
  750,032 bytes, mostly comments            420.42 -> 367.78
  Small Runtime strings/lists/formatting     68.28 -> 68.23

The comment-heavy case improved by about 52.6 MiB (12.5%). The other samples
show no general reduction; these are separate runs with normal runtime noise.
Its traced Python allocation peak fell from 337.80 to 283.16 MiB. After releasing
the result and collecting garbage, traced retained allocations were about
86 KiB in both runs. Tracemalloc adds substantial overhead; its traced bytes
must not be treated as RSS or its runtime as ordinary conversion performance.

The desktop soak deliberately collects garbage frequently to expose retention;
its busy-work durations/CPU are not an interactive performance benchmark.
Worker peaks are self-reported Linux VmHWM; parent peaks are sampled every 20 ms
and may miss brief spikes. Parent/child peaks occur at different times and must
not simply be added as a measured concurrent total.

IDLE ACTIVITY AND LAPTOP LIMITS
In three roughly 10-second idle windows, parent CPU use as a percentage of one
core was 0.1555% just after startup, 0.0037% after dialogs, and 0.0073% after the
conversion workload. The supervisor made zero timed idle waits in every window.
The final workspace had no active owned Qt timers. The transient 350 ms timer
seen immediately after module operations is a single-shot completion debounce.

These are CPU/wakeup observations, not battery-watt, discharge-rate, thermal,
GPU, display, suspend/resume or Windows power measurements. Actual laptop
battery impact remains unverified. Full numeric/Qt startup still consumes about
283 MiB in this environment; the implementation does not promise a small RSS.

THREAD AND PROCESS OWNERSHIP
- Conversion: one coordinator, a bounded IPC transport and at most one active
  child; latest pending work supersedes older work. Encoding/startup cancellation,
  stalled request/reply pipes, malformed replies and forced shutdown are tested.
- Outline: one coordinator and one reusable isolated parser with one IPC thread;
  deadlines/cancellation retire the child. Its partial-start cleanup is now fixed.
- Editor assistance/operations: isolated QProcess workers with request/deadline
  bounds, stale-result checks, idle retirement and ownership cleanup.
- Expensive conversion, revision/outline and editor work share the desktop
  admission budget (capacity one or two). This is not a global cap on all OS
  threads: search, I/O, compiler and native libraries have separate ownership.
- File I/O: two daemon workers and an eight-slot queue. Preview reads use a
  separate lazy two-worker/eight-slot service and cancel queued obsolete work.
- Literal and bundle searches each own one worker with replacement/cancellation
  semantics. Revision/position services release completed payload references.
- PCFC11: one owned build thread per dialog, bounded stdout/stderr retention,
  drained pipes, deadline/cancel handling, descendant cleanup and stale-source
  publication protection. Windows uses its job/launcher implementation, which
  still needs execution on Windows.

The soak started 100 conversion workers, reaped 100, used at most one at a time
and required zero forced terminations. Parent descriptors were 11 at startup,
15 with active workspace services, and 11 after shutdown. Python threads were
9 at startup, 10 with the outline IPC service, and 1 after close. Native OS
threads were 29/30 and 21 after close; these include loaded Qt/numeric-library
threads and are not all PyCForge workers. Zero transient dialogs accumulated;
the one hidden build dialog is intentionally reused and had no active timer.

NATIVE MEMORY-SAFETY CHECKS
Ten selected Runtime tests passed with GCC AddressSanitizer and UndefinedBehaviorSanitizer,
covering aliased containers, classes, escaping closures, budgets, module contexts,
read/process/write, allocation failures, error unwinding and failed file opens.
Address/UB checks used halt-on-error and nonrecovering instrumentation.

LeakSanitizer was attempted first, but its process-inspection step failed with
“Can't open /proc/.../task” and “LeakSanitizer has encountered a fatal error.”
Those nine harness failures are preserved in native-sanitizers.xml. The later
10-test pass disabled only leak detection; it must NOT be described as an LSan
pass. Existing native allocation-failure tests also wrap malloc/calloc/free and
fopen/fclose and require live-allocation/open-file counts to return to zero.
A full leak-sanitizer run on an unrestricted native host remains outstanding.

PRESERVATION AND USABILITY
Against the delivered v1.3.0 ZIP: all 821 package-tree files remain present;
805 are byte-identical and 16 changed (15 implementation files plus version).
All 14 Runtime implementation/data/header files are byte-identical. The exact
hash inventory is evidence/reliability_1_3/source-preservation.json. Test metadata
assertions and installed checks were updated to the current patch version.
The full package comparison and installed checks are recorded separately.
The wheel contains 815 package files; the six additional source-tree files are
Ting .tingspec.json authoring specifications. Existing packaging deliberately
ships those in the source archive, with compiled .ting assets and the registry
in the wheel. This packaging distinction is unchanged from v1.3.0.

Retained: Typed and Runtime conversions; advanced dictionaries, strings, lists,
classes/closures, formatting, bundled modules and UTF-8 file workflows; PCFC11
builds and dialog fixes; Open/New Module lifecycle fixes; Jedi, autopep8, smart
pairs, multicursor editing, rename previews, tooltips, folding, search/replace,
Help examples, Ting integration, numeric backends and the theme.

Mode selection remains at Transpile -> Typed / Runtime. The toolbar Transpile
button and Ctrl+Enter execute the selected remembered mode. PCFC11 compilation
is Transpile -> Compile with PCFC11 (Ctrl+Shift+Enter).
Right-clicking the gutter opens Classes & Functions. Double-click/Enter jumps
to a definition and reveals folds. Copy copies the complete selected definition
without changing the editor's cursor, selection, scroll or fold state.

The earlier older-base artifact's omissions are recorded in the existing
PyCForge-1.3.0-Version-Reconciliation.txt: 57 newer package files were absent
and 74 shared package files differed. That report preserves the exact file
inventory. Those omissions were corrected in the complete v1.3.0 baseline;
this reliability update removes no package files from that baseline.

UPGRADES RECOVERED FROM DATED SAVED RELEASE/VALIDATION RECORDS
These dates use America/Chicago. They are reconstructed from the saved evidence,
not an assertion of complete access to every earlier chat message.

13 October — 1.1.4:
  Ordered mutable dictionaries, comprehensions and annotations; supported key
  rules; mutation methods; live views; iteration guards; identity/order/numeric
  key behavior; hashing and resource bounds.
13 October — 1.1.5:
  Persistent Typed/Runtime menu choices, toolbar/keyboard routing and result
  invalidation when switching modes; ordinary generated-C scrollbar behavior.
13 October — 1.1.6:
  Offline Jedi and autopep8; completions, parameter hints, go-to/return definition;
  current-document rename review; document/selection formatting with undo and
  AST-equivalence protection; up to 256 carets, smart pairs/wrapping, selection
  and regex search and reviewed bundle replacement; grouped/overflow Edit menus.
13 October — 1.1.7 and follow-ups:
  Background editor analysis, isolated persistent outline parsing, shared work
  admission, delayed passive work while typing, cached positions/results;
  caret/modifier and quoting fixes, completion tail replacement, selection-format
  line handling, form-feed positions, safer rename refusal and atomic save checks;
  escaped tooltip/default text, visible styled suggestions, stale-popup dismissal
  on folding, nested-fold and find-reveal fixes, hidden-line paste/cut repair;
  selection search scope, Enter navigation, responsive find-row counts/tooltips,
  replacement limits, gutter Classes & Functions/Copy, dialog ownership cleanup
  and a 50-example Help collection checked against native output.
13 October — 1.1.8:
  Everyday Runtime builtins and list operations; sum/min/max/key/default, abs,
  round, any/all, stable sorted/key/reverse, lazy zip/strict/enumerate/iter/next;
  callable builtins; richer f-strings/format/str.format, conversions and dynamic
  widths/precision; nested/cyclic repr and numeric-rounding corrections.
13 October — 1.1.9:
  Explicit multi-module Runtime bundles, imports/aliases/reexports, classes,
  functions/constants, namespace isolation, ordered once-per-context initialization,
  all-open-document workspace conversion, repeated CLI --module arguments,
  module/source error attribution and inspectable artifacts.
13 October — 1.1.10:
  Scoped UTF-8 file read/readline/readlines/iteration and write/writelines/append/
  flush/close; Unicode paths, newline behavior and content-NUL handling; borrowed
  cursor sharing; cleanup through return/break/continue/errors/failed opens;
  file/session/read/allocation limits; three-module report example and 21 Help pages.
13 October — module/PCFC11 dialog fixes (1.1.11/1.2.1 records):
  Real empty workspace after the final module closes; Open/New stale navigator
  cleanup; fold-marker restoration; About presentation/version consistency;
  corrected PCFC11 compiler/output chooser behavior.
13–14 October — resource work (1.1.12/1.2.2 records):
  Completed-task ownership release, idle-supervisor sleep, cancellation across
  worker startup/transport, bounded regular-file reads, bounded preview service,
  transient-dialog deletion and hidden/idle timer cleanup.
14 October — complete 1.3.0:
  Complete advanced conversion/editor baseline, retained PCFC11/dialog/resource
  work, Runtime PCFC11 entry/header compatibility, startup-modal keyboard fix,
  preservation inventory, installed validation and resource reports.
14 October — this cumulative 1.3.1 update:
  The five new findings, fixes and measurements documented above.

Already-established foundations dated 12 October or earlier remain present:
Runtime classes/closures/containers and the correctness expansion, Ting 0.10.0a21,
NumPy/Numba integration and original PCFC11 support. The recovered PCFC11 base
integration evidence predates these two days; it is not relabeled as a new
13 October addition merely because its dialogs were fixed then.

REMAINING LIMITS / NATIVE ACCEPTANCE WORK
1. Native Windows PCFC11 executable linking/running, job cleanup, Unicode paths,
   modal focus, DPI/display behavior, file locking and application shutdown.
2. Actual laptop idle/busy power, suspend/resume and a multi-hour native soak.
3. Full native leak-sanitizer inspection outside this restricted process environment.
4. High conversion peak memory is reduced but remains material. Source/token/AST
   budgets are logical workload bounds, not an OS RSS quota. Large structured
   artifacts/serialization can amplify source size. No hard per-process RAM cap
   has been added or implied.
5. Undo history intentionally retains user edits while a document remains open;
   open-document contents and their histories are not a small fixed-memory promise.
   Runtime values remain in the owned arena until pv_destroy; arena accounting
   is not the whole native process RSS. The Runtime profile retains its existing
   preview warning and does not gain Typed ForgeLens/proof guarantees.
6. A stalled regular network file can still hold an I/O worker. Queues and worker
   counts are bounded and daemon readers cannot keep the interpreter alive, but
   this is not a filesystem-level cancellation guarantee.

Native follow-up commands and interaction checks are in
PyCForge-1.3.1-Windows-and-Laptop-Checks.txt. No public package publication or
external deployment was performed as part of this audit.
