v0.0.93

A release for the audits that never started. Two cloud fixes stop a slow or oddly-shaped origin from ending an audit before its first page (one site had failed every attempt since August), the CLI starts on a third of the memory so install.sh no longer dies at the last step on capped machines, and a re-audit of an unchanged site replays its rule results instead of re-running them. Plus three contributed fixes from the community. We are convinced this is the fastest way to crawl and audit a site, and it is now also the most patient one.

Changed

• A re-audit of an unchanged site replays its rule results. A page whose inputs its rules read are all unchanged is neither parsed nor rule-checked again; its stored results are replayed. On a 2,500-page site the warm rules phase falls from 110 s to 12 s and the warm audit from 143 s to 44 s, with the report byte-identical to a cold run. Site-scope rules always run. When the cache is on, template fan-out (#279) is off for that run, which costs the cold rules phase about 7%; set SQUIRREL_RULE_CACHE=0 to disable the cache. Figures are in benchmarks/2026-09-perf-program.md. squirrelscan/repo#1990

Fixed

• Cloud rendering now reserves time for its plain-HTTP fallback inside each page's fetch deadline: the render has the deadline minus 12 seconds to itself, then the plain fetch starts and races it, and whichever lands first serves the page. A render that finishes late but inside the deadline is still used, and a crawl stop mid-submit no longer leaves the server's render debit unrecorded. The cloud runner's per-page deadline rises from 12 to 30 seconds (the CLI's default) so a far-away origin no longer decides the audit; the preamble budget, sitemap walk window and entry-page retry that derive from it are documented next to the constant. squirrelscan/repo#2026

• A cloud audit of a site whose sitemap points at another domain no longer fails with "No pages were crawled from <site>: The operation was aborted." when the entry page's first fetch hits its deadline. The entry URL now gets one more plain fetch with a doubled deadline before the audit is given up (a warning event says so), an abort from a document fetcher classifies as a timeout that names the fetcher and the deadline instead of unknown with the runtime's text, and a crawl whose preamble budget runs out records a warning naming the budget. squirrelscan/repo#1699

• squirrel starts light. Every invocation used to evaluate the whole CLI (the audit engine and every rule package included) before parsing a single argument, which put squirrel self install at about 140 MB resident and got it killed (exit 137) at the last step of install.sh on memory-capped machines. Subcommands and the startup extras now load on demand, and the standalone binary is built with --splitting, so self install and --version peak at about 43 MB. Commands that need the engine load it when they run. #2023

• install.sh finishes the install itself when self install is killed by a signal (the file work needs no memory), then checks that the binary runs. A binary that will not run is reported under its own step with the binary and link paths, a memory figure, the swap recipe, and the cloud dashboard as the no-binary alternative, instead of "retry". #2023

• squirrel self update now checks that the binary your PATH resolves is the one it just installed, and says so when it isn't. It used to flip the symlink recorded at install time and report success on that alone, so a stale install_bin_dir (or a second squirrel earlier on PATH) left you running the old version after every "Updated to vX". A recorded bin directory that no longer exists is now dropped, and the update falls back to the default one. #293

• squirrel self doctor gained an Install location check: the recorded install_bin_dir, the link and the release version it points at, and the squirrel your PATH actually resolves, with a warning when they disagree. #293

• The script fetch cache is reachable again. It stored a script under the hash of its content but looked it up by the hash of its URL, so every audit re-downloaded every script. Both sides now key by URL, a cached script older than a day is fetched again, and a refresh replaces the stale row instead of keeping the first body forever. Thanks to @WilliamK112 for the fix. #182 #206 #303

• The CLI's end-of-run report to the cloud is retried on transport errors and 5xx responses, three attempts with a short backoff, so a completed audit is no longer left "running" on the dashboard until the reaper finds it. Thanks to @WilliamK112. #178 #208

• install.ps1 enables TLS 1.2 before its first network call, so Windows PowerShell 5.1 with legacy protocol defaults can download the release. Thanks to @WilliamK112. #166 #207