Coverage measured by name, and what it found was failing open

Test coverage was being measured the flattering way. A new by-name measurement over the standard library asked a blunter question, which functions does no test ever reach, and answered 710 public functions. Working through that list in batches did what a coverage number never does on its own: it found code that had never worked. std.graph had never compiled. So had std.integrity, a documented security module that was, in practice, dead code.

All four of a decoder family failed open on malformed input, as did jwt_payload and base64url_decode, which is the worst possible direction for an auth primitive. pg_ping, pg_is_connected and check_db reported the inverse of reality, so a health check called a dead database healthy. List == List was always true and read out of bounds while doing it (now E0318). Builtin dispatch hijacked any stdlib function whose name happened to match a C symbol. A private stdlib function poisoned that name everywhere it appeared.

The test harness itself reported a perfect PASS when handed a non-executable compiler. Each is now fixed and pinned, and the tooling learned from it: W0002 warns on an import that names nothing the module exports, with a location, and the resolver's module-name guard stopped rejecting 27 legitimate files. This is the unglamorous half of a trust claim, and the register is kept in public: coverage is reported as two axes with the remaining gaps recorded as open validations, not gated exclusions.