fix: a target that matches everything, a leak guard that never failed, and two CLI answers

[donislawdev]

Five changes, each its own commit. Two are safety or guard holes found by reading a set of
general engineering rule documents against this code; two make the CLI answer a bad input the
way the rest of the tool already does; one gives the size ratchet the knob it was missing.

Everything here was checked against the code before it was written: a rule that this project
already followed was not turned into a change (that is what most of the reading produced -
nothing).

A target that matches everything is not a target

Start with impairment on and --target *, and the tool stayed quiet, because a target WAS set -
to every process on the machine. The blast-radius warning is the one that keeps a run from taking
the network down with the shell that started it, and an expression that narrows nothing is exactly
the case it exists for.

Matcher.covers_everything answers by PROBING, not by pattern-matching the text: each matcher
class carries a small group of representative values, and an expression that accepts the whole
group covers everything. *, re:.*, 1-65535, 0.0.0.0/0 and a PID range spanning the space
all trip it; a real target does not, and neither does a real target with an exclusion beside it.
Probing is why a NEW spelling of "everything" cannot slip past - it never had to be listed.

Show the leak guard failing, and teach it the class it missed

tools/check_public_text.py runs in CI and had reported "clean" many times, which proved it runs -
not that it catches anything. There was no test that ever saw it FAIL.

tests/test_public_text_guard.py now feeds it each thing it is supposed to catch and asserts it
says no. Writing those cases found the gap: the guard knew patterns (a path shape, an address
shape), so a value that is only private because it is THIS machine's was invisible to it. The list
of those values lives outside the repository, in an ignored file, and the guard reports a hit
without printing the value - printing it would put it in the CI log, which is the thing being
prevented. With no list present the guard behaves exactly as before.

One known gap is pinned by a test rather than papered over: Polish written without diacritics
passes the "is this English" check, because it is indistinguishable from English by that check.
The test records it so the next reader learns it from the suite instead of from a merged PR.

Report every bad value in one run

--loss 500 --latency -5 --dup 900 named the latency and stopped. Three mistakes, three runs.

settings.range_errors is a second reader of the same field registry, not a replacement. The form
still fails on the first field: it is typed into LIVE, and complaints about fields nobody has
reached yet are noise. A command line arrives FINISHED, where the opposite is true.
validate_ranges keeps its contract, so no window caller moved.

Suggest the nearest preset when one is mistyped

An unknown --preset answered with all seventeen canonical ids. The tool already offers a nearest
match for a mistyped config key and a mistyped scenario key, so preset names were the one closed
vocabulary left without it.

The suggestion is drawn from what a person can TYPE - the translated names as well as the ids.
Somebody reaching for "modem56k" writes that, not "presets.modem56k", and a search over ids alone
finds nothing close and stays silent exactly when it is needed.

The size ratchet gets the knob that sees creep

The ratchet capped the largest file and the largest function, so a hundred files could climb to
one line under the ceiling and it would not notice. It now also caps how many files and functions
sit in the top band, and every failure message states the remaining headroom, so the number in the
message is the one you would have to justify raising. A third test keeps the crowd counts honest:
it fails if they are set so far above reality that they could never fire.

Verification

• python -m pytest tests - full suite, green (run as the last action, after the prose edits).
• python smoke_gui.py - green.
• python tools/check_public_text.py --commits origin/master..HEAD - 5 blocks, clean.
• Every new guard was mutation-tested: the change was broken on purpose and the test had to fail.
  Three mutations SURVIVED on the first attempt and each one found a real defect in the test rather
  than in the product - a fake missing winfo_toplevel, a fallback the fake never reached, and a
  first regex narrow enough to walk around. All three are fixed and now fail as intended.

🤖 Generated with Claude Code