Deliver

Export ships one request carrying the entire catalog, so it gets more room: the body can be megabytes and the receiver may index it inline.

Path-param names that name a number. A framework route constrained to an integer (/users/{id:int}, Django's <int:pk>) rejects a word, so these get 1; anything else gets a harmless string.

Crest defaults both connect_timeout and read_timeout to nil, i.e. no timeout at all, and every delivery class relied on that default. A host that accepted the connection and then went quiet blocked forever:

• probe / proxy: the stalled request keeps holding its --concurrency slot, so enough blackholed hosts starve every remaining endpoint.
• export: deliver runs at the end of analyze, which is BEFORE report is called, so a hung Elasticsearch or webhook host hangs noir before any output is written and the user loses the whole scan.

Values are deliberately generous rather than snappy. A probe's purpose is to deliver the request (so an intercepting proxy or the app's own logs see it); a slow-but-working target answering in 12s should not start being reported as undeliverable. These bound the pathological case without second-guessing a live one.

Verbs whose path templates get filled in before probing. Restricted to the read-only ones (the shared safe set, QUERY included) on purpose.

register_path_param in the optimizer only substitutes a placeholder when --set-pvalue-path supplied a value, so on a default scan /users/{id} is probed literally and 404s. Filling it makes the probe actually reach the route — but it also makes destructive verbs real: DELETE /users/{id} is a harmless 404 today and would become DELETE /users/1 against a live record. Read-only verbs get the benefit without that risk; for the rest the literal template still reaches an intercepting proxy, where the user can edit and replay it deliberately.

Requests that never completed during the last run — connection refused, TLS handshake rejected, DNS failure, timeout. Deliberately not incremented for an HTTP error response: a 404 or 500 means the probe was delivered and answered. Exposed so the distinction is assertable, since the count is otherwise only visible as a log line.