Merging this PR will not alter performance

✅ 24 untouched benchmarks

Comparing nsec_support (a46dea6) with master (ea490c0)

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.81%. Comparing base (ea490c0) to head (a46dea6).

@@           Coverage Diff           @@
##           master    #1825   +/-   ##
=======================================
  Coverage   99.81%   99.81%           
=======================================
  Files          33       33           
  Lines        3772     3799   +27     
  Branches      536      543    +7     
=======================================
+ Hits         3765     3792   +27     
  Misses          5        5           
  Partials        2        2           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Previous review — superseded by a newer review below.

PR Review — fix: correct nsec bitmap semantics and resolve txt denials

All four findings from the previous round are resolved; nothing blocking remains. Merge-ready with two non-blocking notes.

Re-verified against the current head (7d711a4):

• Warning ＃1 fixed — query_handler.pxd:86-91 now carries a single @cython.locals block; the stale one-line decorator is gone, so type_seen=cython.bint / nsec=DNSNsec actually take effect.
• Suggestion ＃2 fixed — both get_address_and_nsec_records docstrings (info.py:816, 820) now read "plus an NSEC asserting which address types exist", matching the corrected semantics.
• Suggestion ＃3 fixed — dns_nsec() is back as a one-release shim that warns, delegates to _dns_address_nsec, and documents that missing_types is ignored; test_service_info_dns_nsec_deprecated pins the warning and the delegation. No AttributeError on a patch upgrade.
• Suggestion ＃4 fixed — test_service_info_address_nsec_records now exercises the memoized (override_ttl=None) path, asserts identity across calls, and pins that mutating addresses drops _dns_address_nsec_cache in both directions (v4-only → empty → dual-stack).

The protocol substance still holds up on re-read. _process_nsec_record is only reachable after the record_key != self.key guard, so the host-name NSEC our own responder emits can never be read as a TXT denial — test_own_nsec_response_does_not_complete_service pins exactly that. get_by_details(..., _CLASS_IN) matches the cached unique-bit NSEC because DNSEntry._fast_init_entry masks class_ through _CLASS_MASK. The goodbye path (_core.py:578, override_ttl=0) now retracts the NSEC at the same host name it announced it at, which is self-consistent. Test fixtures (zc_loopback, aiozc_loopback, quick_request_timing, _clear_cache, RecordUpdate) all exist and handle teardown.

Remaining, both non-blocking:

• 🟢 warnings.warn(stacklevel=2) in a cythonized module — compiled defs do not push a Python frame, so the deprecation warning likely reports the caller's caller rather than the caller. Flagged as unverified: I could not build the extension or run Python in this read-only shell.
• 🟢 [Pre-Existing] ANY questions at a host name produce no address answers (RFC 6762 §6) — unchanged by this PR, but it lives in the block that was rewritten and is untested.

Note: I could not execute the test suite (no Python in the review shell), so the author's "466 passed" test plan is taken as a claim, not verified here.

✅ Resolved since last review (4)

• src/zeroconf/_handlers/query_handler.pxd:86 Stale @cython.locals decorator left stacked on _add_address_answers
• src/zeroconf/_services/info.py:804 get_address_and_nsec_records docstrings still describe the old inverted semantics
• src/zeroconf/_services/info.py:775 Public ServiceInfo.dns_nsec() removed without a deprecation shim under a fix: title
• tests/services/test_info.py:2044 New _dns_address_nsec_cache invalidation is untested

🟢 Suggestions

src/zeroconf/_services/info.py is in TO_CYTHONIZE (build_ext.py:29), so in shipped wheels dns_nsec is a compiled def on a cdef class.

Cython does not push a Python frame for a compiled function during normal execution (frames are materialised lazily, only by __Pyx_AddTraceback on the exception path). _warnings.warn resolves stacklevel against the topmost Python frame, which from inside compiled code is already the caller. So stacklevel=2 skips one frame too far and attributes the DeprecationWarning to the caller's caller.

Why it matters: the whole point of the shim is to tell a downstream user where their dns_nsec() call is. In the pure-Python build (and in test_service_info_dns_nsec_deprecated, which only matches on the message) the line is right; in the compiled wheel — the only build most users get — it points at the wrong file:line, which is worse than no location at all.

Caveat: unverified against an actual compiled extension — I could not build or run Python in this review shell. If you want to confirm before changing anything, a REQUIRE_CYTHON=1 build plus python -W always::DeprecationWarning -c "..." will show which line gets reported. If it does misattribute, stacklevel=1 is the correct value for a compiled def; there is no single value correct for both builds, so a short comment naming the trade-off is probably the honest fix.

        warnings.warn(
            "dns_nsec is deprecated, and will be removed in a future version. "
            "Use dns_address_nsec instead; missing_types is ignored.",
            DeprecationWarning,
            stacklevel=2,
        )

Checklist

• Prior warning ＃1 (stacked @cython.locals) resolved
• Prior suggestions ＃2-＃4 (docstrings, deprecation shim, cache-invalidation test) resolved
• NSEC type bitmap encodes present types per RFC 4034 §4.1.2 / RFC 6762 §6.1
• Own-responder NSEC cannot be misread as a TXT denial
• NSEC owner/next_name non-None for all registered services
• _dns_address_nsec_cache invalidated on every address mutation path, and pinned by a test
• .pxd declarations consistent with the .py signatures
• No backward-incompatible public API change without a migration path
• Cython build correctness (frames, cdef return nullability, module globals) — suggestion ＃1
• New branches covered by tests (denial, legacy bitmap, cache load, responder output, no-address service)
• Tests assert observable behavior, not source inspection
• Test resources cleaned up (loopback fixtures handle teardown)
• Diff matches PR description; no unexplained scope creep
• No new unbounded growth, resource leaks, or swallowed errors

Automated review by Kōan (Claude) HEAD=7d711a4 5 min 18s