crimes 0.29.0: faster analysis and safer guidance

JSON schema remains 0.8.0. The follow-up reduces repeated analysis work, makes pin migration recoverable, and corrects advice that encouraged unnecessary restructuring or weaker tests.

What changes

• Source reads and extracted JS/Python parse data are reused within each analysis. A 32 MiB accounting budget and 4096-entry limit bound retained data; there is no compiler AST retention or persistent disk cache. Fresh commands re-evaluate source, configuration and Git state.
• Coverage exclusion matching runs in bounded batches with the same matcher. Scoped context and hooks still analyze the repository before selecting output.
• Pin migration stages all replacements and retains original bytes and permissions. crimes migrate-pins --recover restores interrupted work, including after a killed recovery process, and refuses later conflicting edits. Recovery works without a valid scanner configuration. Each file replacement is atomic; the set is not an atomic snapshot to other readers. This is process interruption recovery, not a power-failure guarantee.
• Literal-scatter advice preserves intentional policy variants and keeps consolidation within the requested task. Connectivity advice distinguishes importers from dependencies and preserves useful regression tests.
• Bundled skill 0.29.0 uses the selected executable path throughout its examples, avoiding accidental switches to an older global installation. It also tells agents to retain regression checks instead of moving them into a one-off command just to clear a risk report.

Upgrade by updating the npm package normally. Interactive use refreshes unchanged generated skills; noninteractive use reports a maintenance notice. crimes init --refresh-skills explicitly refreshes unchanged copies, and --check previews the change. Customized copies remain protected. There are no npm install lifecycle scripts. See skills and migration recovery.

Measured performance

The alternating-process confirmation measured eight corpora × scan/context/ hook, with a first observation plus ten repeated fresh processes per binary. On the frozen 639-file crimes source, context median fell from 6270ms to 2969ms, p95 from 6519ms to 3319ms. Peak memory rose from 283 to 298 MiB. The medium Commander and Next.js fixtures improved from 1311 to 754ms and 820 to 606ms respectively. Small cases changed little; the small JS/TS context median rose from 402 to 408ms.

The initial sequential batch showed a TSX regression that did not recur in the alternating confirmation. Both datasets remain available; its cause was not established. A universal 2× speedup is not demonstrated. The performance record includes every corpus, first and repeated samples, memory, stages, hashes, runtime and measurement limits.

Optimization-only reports matched in full on all 24 command/corpus pairs. Final advice changes are checked with an explicit old/new prose map; findings, scores, fingerprints, ordering and coverage still have to agree. Ranking remains unchanged on the same fixtures and clock: NDCG 0.4770 overall and 0.3895 deep. Neither unchanged ranking nor a faster scan proves safer edits.

Completed edits and advice review

The primary study contains 216 completed trials: twelve behavioral tasks × three assigned conditions × three repeats × two hosts. Six tasks were reserved from tuning. Codex used gpt-5.6-sol; Claude used claude-opus-5, both at high effort. All 216 passed the predefined acceptance checks, including controls. This is a tie, with a ceiling effect on small synthetic tasks, not evidence of improved correctness.

The installed workflow took longer: median task time was 89.3 versus 53.6 seconds for Claude and 116.3 versus 52.2 seconds for Codex. These concurrent host trials are descriptive task timings, separate from scanner benchmarks. All 72 installed runs took a skill action; 70 recorded comparable candidate scans. Two Codex runs switched executables. The assigned-condition results retain those deviations. Usage metrics were corrected uniformly from raw logs where global options preceded the command or help calls inflated context counts; recorded values and audit hashes remain in the evidence.

All 31 primary file-scope flags were reviewed. Twenty-six were relevant test additions. Five briefing runs extracted a shared policy for a small limit change; one changed an unspecified fallback edge. The transcript explicitly linked consolidation to the old advice. The retained reproduction and scope ledger distinguish this supplementary observation from the unchanged primary acceptance score.

The separate 18-run literal-advice check passed all tasks and produced no policy extractions, including none of its six briefing runs. It also exposed a different problem: one installed run removed useful integration assertions after a low-severity fan-out finding, retaining only temporary runtime checks. That result is preserved in the review ledger. It prompted the final connectivity and test-preservation advice correction.

A separate 12-run executable check passed all tasks. All four installed runs on the two previously affected cases used comparable candidate scans, with observable skill actions on both hosts and delivered Claude hook context. The final 18-run test-preservation check also passed every task. Its 16 scope flags were relevant test changes. One installed run encountered the low connectivity finding and retained its integration assertions, describing it as an observation. All six installed runs took a skill action; five had strictly comparable final pre/post scans. The sixth edited its test after the matching post-edit scan and then used a broader scope. That workflow miss is retained. These focused checks support the scoped advice changes; they do not establish a general effect.

The artifact record identifies the package used by each batch. The primary 216 used an earlier frozen candidate; later permission, advice and skill changes were verified separately. Different packages and measurement revisions are never pooled as one condition.

Verification and remaining limits

Workspace verification covers 2510 Vitest tests, twelve original/reference acceptance checks and nine Python harness-method tests. Package smoke covers fresh setup and upgrades from published 0.28.0, 0.28.1 and 0.28.2, including interactive maintenance and preserved customizations. Node 18 checks exercise the tarball’s JS/Python analysis, skill bodies, hook delivery, decision files and recovery after SIGKILL. The website build and internal-link checks, full-report parity, and core/repository self-scans are included in the verification record. No new or escalated high finding was introduced in those self-scans. Check the release workflow for verification of the published tag.

General edit-quality benefit remains unproven. Connected tests may still need design work, but removing checks to satisfy a metric is not an improvement. Per-edit hooks have a cost; no persistent cache or universal latency target is claimed. The self-serve external trial is ready, but no independently reported outcome or recruitment is claimed.