release: v3.2.4 — cap ALL flat viz sections (final page-size pass)

CHANGELOG.md

@@ -7,6 +7,27 @@ Versioning: [SemVer 2.0](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [3.2.4] — 2026-07-15
+
+Fix (final page-size pass): after v3.2.3 the deployed `self-analysis.html` was
+still ~4.9 MB — capping *program points* alone wasn't enough. The other flat
+sections (Diagnostics ~1.7 MB, Call graph ~1.7 MB, Trap checks, Functions, gaps,
+handle/float/pentagon facts) render one row per entry and scry-on-scry produces
+thousands of each.
+
+### Fixed — scry-viz
+
+- **Every flat list/table section is now capped** (`SECTION_ROW_CAP` = 100 rows +
+  a "showing N of M" note): Diagnostics, Call graph (edge table), Trap checks
+  (POTENTIAL-TRAPs shown first so the cap never hides one), Functions, gaps,
+  handle faults, float facts, relational guards.
+- **The call-graph diagram is skipped for large graphs** — a Mermaid source of
+  thousands of edges was itself ~1.7 MB.
+- **New comprehensive test** `all_flat_sections_capped_page_stays_small` blows up
+  *every* section to 4,000 entries and asserts the page stays <1 MB — the check
+  that would have caught the v3.2.2/v3.2.3 partial fixes. The actionable subset of
+  every section remains available un-capped in the `guidance.json` feed.
+
 ## [3.2.3] — 2026-07-15
 
 Fix: **the v3.2.2 program-points cap was per-function only**, so scry-on-scry's

Cargo.toml

@@ -69,7 +69,7 @@ default-members = [
 # on crates.io matches the release artifacts. The crates.io publish workflow
 # asserts the pushed `v*` tag equals this version, so a release bump must move
 # both in lockstep (and the internal path-dep `version = "..."` fields below).
-version = "3.2.3"
+version = "3.2.4"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/pulseengine/scry"

crates/scry-analyze-core/Cargo.toml

@@ -31,7 +31,7 @@ path = "src/lib.rs"
 # Path deps carry `version` so `cargo publish` rewrites them to the crates.io
 # coordinate (crates.io rejects path-only deps). The version equals the
 # workspace version and must be bumped in lockstep with it.
-scry-sai-interval = { path = "../scry-interval", version = "3.2.3" }
+scry-sai-interval = { path = "../scry-interval", version = "3.2.4" }
 
 # Step 2 (DD-012): the analyze body + helpers moved here. wasmparser parses
 # the input Wasm Core Model module; sha2 digests the module bytes for
@@ -43,44 +43,44 @@ sha2 = { workspace = true }
 
 # Security-label (taint) lattice for the noninterference analysis (FEAT-009)
 # and the pure meld<->scry provenance boundary crate (FEAT-002 / DD-002).
-scry-sai-taint = { path = "../scry-taint", version = "3.2.3" }
-scry-sai-provenance = { path = "../scry-provenance", version = "3.2.3" }
+scry-sai-taint = { path = "../scry-taint", version = "3.2.4" }
+scry-sai-provenance = { path = "../scry-provenance", version = "3.2.4" }
 
 # Octagon relational domain (FEAT-016 slice-2b-ii): carried alongside the
 # intervals through the structured-CFG fixpoint so a loop counter bounded by a
 # VARIABLE relation (`i < n`) stays bounded where the interval domain alone
 # widens it to ⊤. Same pure `#![no_std]` dual-compile crate as scry-interval.
-scry-sai-octagon = { path = "../scry-octagon", version = "3.2.3" }
+scry-sai-octagon = { path = "../scry-octagon", version = "3.2.4" }
 
 # Known-bits × interval-guarded congruence reduced product (FEAT-037 / DD-017):
 # an additive bit/alignment/stride companion computed in a straight-line-sound
 # pass, surfaced library-only on `AnalysisResult.bit_facts`. Same pure
 # `#![no_std]` dual-compile crate as the other domains.
-scry-sai-bits = { path = "../scry-bits", version = "3.2.3" }
+scry-sai-bits = { path = "../scry-bits", version = "3.2.4" }
 
 # Pentagons weakly-relational domain (FEAT-044 / AC-014): intervals + strict
 # `x < y` facts, the cheap relational layer behind sound out-of-bounds-trap
 # detection (FEAT-046). An additive guard-recording pass surfaces proven
 # strict relations library-only on `AnalysisResult.pentagon_facts`. Same pure
 # `#![no_std]` dual-compile crate as the other domains.
-scry-sai-pentagon = { path = "../scry-pentagon", version = "3.2.3" }
+scry-sai-pentagon = { path = "../scry-pentagon", version = "3.2.4" }
 
 # IEEE-754 float-interval domain (FEAT-047 / AC-022): sound f32/f64 abstraction
 # with NaN/±inf tracking + round-to-nearest-aware widening. An additive
 # straight-line pass surfaces sound float intervals library-only on
 # `AnalysisResult.float_facts`. Same pure `#![no_std]` dual-compile crate.
-scry-sai-float = { path = "../scry-float", version = "3.2.3" }
+scry-sai-float = { path = "../scry-float", version = "3.2.4" }
 
 # Affine Component-Model handle-state lattice (FEAT-049 / MF-007): tracks
 # own/borrow resource-handle state to flag use-after-drop / double-drop. A
 # straight-line pass over the canonical-ABI `[resource-drop]` call sites
 # surfaces findings library-only on `AnalysisResult.handle_findings`.
-scry-sai-handle = { path = "../scry-handle", version = "3.2.3" }
+scry-sai-handle = { path = "../scry-handle", version = "3.2.4" }
 
 # FEAT-058: the linear-memory segmentation domain (content-sensitive memory).
 # The interpreter tracks per-offset interval content for i32 loads/stores
 # instead of degrading every load to ⊤.
-scry-sai-segment = { path = "../scry-segment", version = "3.2.3" }
+scry-sai-segment = { path = "../scry-segment", version = "3.2.4" }
 
 [dev-dependencies]
 # Test-only (the crate is otherwise dep-light + no_std): assemble the .wat

crates/scry-analyze-core/src/lib.rs

@@ -856,7 +856,7 @@ mod domain {
         scry_taint::join(a, b)
     }
 }
-const SCRY_VERSION: &str = "3.2.3";
+const SCRY_VERSION: &str = "3.2.4";
 const INVARIANT_SCHEMA_URL: &str = "https://pulseengine.eu/scry-invariants/v1";
 
 /// Default Wasm linear-memory page size (64 KiB).

crates/scry-segment/Cargo.toml

@@ -20,4 +20,4 @@ path = "src/lib.rs"
 # The per-segment content domain. Path dep carries `version` so `cargo publish`
 # rewrites it to the crates.io coordinate; the version equals the workspace
 # version and is bumped in lockstep.
-scry-sai-interval = { path = "../scry-interval", version = "3.2.3" }
+scry-sai-interval = { path = "../scry-interval", version = "3.2.4" }

crates/scry-viz/Cargo.toml

@@ -22,7 +22,7 @@ path = "src/main.rs"
 # The only dependency: the published analyzer library. scry-viz is a plain
 # `std` host tool, so it can read the `AnalysisResult` plain-Rust types and
 # render them — no WIT, no component, no wasmtime.
-scry-sai-core = { path = "../scry-analyze-core", version = "3.2.3" }
+scry-sai-core = { path = "../scry-analyze-core", version = "3.2.4" }
 # Assemble `.wat` inputs to module bytes (so the CLI accepts both .wat and
 # .wasm); host-only, same dep the test harness uses.
 wat = { workspace = true }