v2.0.0-rc.4

Update notifications (initial implementation, not yet live)

• Once-a-day update check against a static TOML manifest (no telemetry); disable with --no-update-check or CLEAVE_NO_UPDATE_CHECK
• New manifest tooling: manifest-gen (Go, soak-gated beta/stable channels) and update-manifest (bash, one-shot builds with cosign signing)

Memory & performance

• Memory-aware admission gate: large archives serialize while small files fill the pool, using live available-memory readings so concurrent instances share the host
• Archive members analyzed in bounded byte-windows instead of all-resident; per-member reports folded and dropped immediately
• Trait regexes moved to a bounded LRU cache — the old design leaked every compiled engine (~7.7 GB RSS on member-heavy archives)
• word:/substr: matching via SIMD literal searchers, no regex engine; ASCII raw patterns skip the unicode engine entirely
• Evidence values capped at storage time; exact match counts computed only when a rule needs them
• Accurate physical-core detection (SMT siblings excluded, Apple Silicon P-cores, illumos, FreeBSD/arm64 sysctl fix) drives pool sizing
• Instantaneous RSS readings on FreeBSD/illumos so the memory gate can reopen; optional memprofile feature for phase-tagged heap accounting

Matching semantics & correctness

• AST query cache made unbounded with serialized compiles — fixes nondeterministic finding loss during parallel archive analysis
• UTF-16 scripts normalized to UTF-8 before text matching — a UTF-16 VBS now matches like its UTF-8 twin
• not: exact: is now case-sensitive, so excluding PowerShell doesn't excuse pOwErShElL
• AST walks bounded by CPU time, not wall clock — starved threads no longer silently drop detections
• Markdown code blocks treated as documentation, not embedded scripts
• New trait surface: type: comment, type: path (basename/dirname scopes), import alias: filters, multi-arg args: matching, is: valid_ip, bare section names (rsrc,
  __cstring) for PE/Mach-O
• Cache-hit reports re-stamp file.basename/file.stem — no more phantom diffs between identical files

Analyzers

• Chrome/WebExtension manifests now emit neutral per-permission and per-host capability traits instead of hardcoded risk scores
• XML parsing rejects pathologically deep documents (stack-overflow DoS guard)
• VBA identifier metrics (length, entropy, distinct triggers); compact JSON schema bumped to v6 with smaller evidence locations

Rule validation

• New checks: scope: archive with non-archive for:, repeated inline unless: exclusions, duplicate detection scoped to matching sections
• Explicit for: type limit relaxed to 8; per-condition-type caps removed; hardware/gpu taxonomy section added

API & maintenance

• New scan_files() library entry point (explicit path list, shared resources, streaming callback)
• Symbol source field removed from output; deadlock detection now an opt-in feature
• Dependency updates