Module coverage 

What a prefix entry would newly allow, from the project’s journal: the preview a prefix is saved from ([commands] allow_prefix, [sandbox] network_allow_prefix). Every distinct argv the journal records that the prefix covers and today’s policy does not allow, with how often, when last and how it was decided then; what a fixed rule still asks for or denies is marked. An unreadable journal or run makes the preview incomplete — never “covers nothing” — and an incomplete preview cannot be saved.

Functions

digest

SHA-256 over the canonical JSON of the entry, the rows and complete.

preview

The preview of adding prefix to list, for the project at root whose state lives under state.

show

speccoder config coverage: the preview as a result.

summary

One line: what it would newly allow, or why the preview is incomplete.

widen

WidenPolicy: adds prefix to list as the confirmation of the preview whose digest is digest — refused for a bare program, an incomplete preview, or one that changed since it was shown.