Deliver

Max concurrent in-flight probe requests. Bounds the fiber/socket fan-out so a large endpoint set can't exhaust file descriptors. Backed by the validated --concurrency value (already clamped to a sane ceiling).

Export ships one request carrying the entire catalog, so it gets more room: the body can be megabytes and the receiver may index it inline.

Path-param names that name a number. A framework route constrained to an integer (/users/{id:int}, Django's <int:pk>) rejects a word, so these get 1; anything else gets a harmless string.

Crest defaults both connect_timeout and read_timeout to nil, i.e. no timeout at all, and every delivery class relied on that default. A host that accepted the connection and then went quiet blocked forever:

• probe / proxy: the stalled request keeps holding its --concurrency slot, so enough blackholed hosts starve every remaining endpoint.
• export: deliver runs at the end of analyze, which is BEFORE report is called, so a hung Elasticsearch or webhook host hangs noir before any output is written and the user loses the whole scan.

Values are deliberately generous rather than snappy. A probe's purpose is to deliver the request (so an intercepting proxy or the app's own logs see it); a slow-but-working target answering in 12s should not start being reported as undeliverable. These bound the pathological case without second-guessing a live one.

Framing headers the HTTP client derives itself. A discovered one carries no real value (req.headers['content-length'] reads it, it does not set it), and copying it empty broke the request: Content-Length: "" raised before anything was sent, and an empty Host is invalid.

An endpoint that satisfies several matchers (e.g. ["GET", "GET:/api"]) is kept once, logged against the first.

Requests that never completed during the last run — connection refused, TLS handshake rejected, DNS failure, timeout. Deliberately not incremented for an HTTP error response: a 404 or 500 means the probe was delivered and answered. Exposed so the distinction is assertable, since the count is otherwise only visible as a log line.