A restart of the operating stack triggered a full scan round, so coverage went
from 0.70 to 0.98 and the pipeline now says by itself what the closeout had to
compute by hand: ninety-two criticals on running targets, all decided, none open.
The decided-versus-open metrics still do not exist there, because that code is in
the repository and not on the machine.
The one remaining coverage gap is the digest finding, live. The missing target is
literally 'sha256:c92477446e98f0…' — the sidecar goes unscanned and a target that
can never be pulled sits in its place.
Thore Cimbal
84585246d8