fix: correct nsec bitmap semantics and resolve txt denials - #1825

Merging this PR will not alter performance

✅ 24 untouched benchmarks

_{Comparing nsec_support (a46dea6) with master (ea490c0)}

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.81%. Comparing base (ea490c0) to head (a46dea6).

@@           Coverage Diff           @@
##           master    #1825   +/-   ##
=======================================
  Coverage   99.81%   99.81%           
=======================================
  Files          33       33           
  Lines        3772     3799   +27     
  Branches      536      543    +7     
=======================================
+ Hits         3765     3792   +27     
  Misses          5        5           
  Partials        2        2           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

Previous review — superseded by a newer review below.

PR Review — fix: correct nsec bitmap semantics and resolve txt denials

All four findings from the previous round are resolved; nothing blocking remains. Merge-ready with two non-blocking notes.

Re-verified against the current head (7d711a4):

• Warning ＃1 fixed — query_handler.pxd:86-91 now carries a single @cython.locals block; the stale one-line decorator is gone, so type_seen=cython.bint / nsec=DNSNsec actually take effect.
• Suggestion ＃2 fixed — both get_address_and_nsec_records docstrings (info.py:816, 820) now read "plus an NSEC asserting which address types exist", matching the corrected semantics.
• Suggestion ＃3 fixed — dns_nsec() is back as a one-release shim that warns, delegates to _dns_address_nsec, and documents that missing_types is ignored; test_service_info_dns_nsec_deprecated pins the warning and the delegation. No AttributeError on a patch upgrade.
• Suggestion ＃4 fixed — test_service_info_address_nsec_records now exercises the memoized (override_ttl=None) path, asserts identity across calls, and pins that mutating addresses drops _dns_address_nsec_cache in both directions (v4-only → empty → dual-stack).

The protocol substance still holds up on re-read. _process_nsec_record is only reachable after the record_key != self.key guard, so the host-name NSEC our own responder emits can never be read as a TXT denial — test_own_nsec_response_does_not_complete_service pins exactly that. get_by_details(..., _CLASS_IN) matches the cached unique-bit NSEC because DNSEntry._fast_init_entry masks class_ through _CLASS_MASK. The goodbye path (_core.py:578, override_ttl=0) now retracts the NSEC at the same host name it announced it at, which is self-consistent. Test fixtures (zc_loopback, aiozc_loopback, quick_request_timing, _clear_cache, RecordUpdate) all exist and handle teardown.

Remaining, both non-blocking:

• 🟢 warnings.warn(stacklevel=2) in a cythonized module — compiled defs do not push a Python frame, so the deprecation warning likely reports the caller's caller rather than the caller. Flagged as unverified: I could not build the extension or run Python in this read-only shell.
• 🟢 [Pre-Existing] ANY questions at a host name produce no address answers (RFC 6762 §6) — unchanged by this PR, but it lives in the block that was rewritten and is untested.

Note: I could not execute the test suite (no Python in the review shell), so the author's "466 passed" test plan is taken as a claim, not verified here.

✅ Resolved since last review (4)

🟢 Suggestions

        warnings.warn(
            "dns_nsec is deprecated, and will be removed in a future version. "
            "Use dns_address_nsec instead; missing_types is ignored.",
            DeprecationWarning,
            stacklevel=2,
        )

Checklist

• Prior warning ＃1 (stacked @cython.locals) resolved
• Prior suggestions ＃2-＃4 (docstrings, deprecation shim, cache-invalidation test) resolved
• NSEC type bitmap encodes present types per RFC 4034 §4.1.2 / RFC 6762 §6.1
• Own-responder NSEC cannot be misread as a TXT denial
• NSEC owner/next_name non-None for all registered services
• _dns_address_nsec_cache invalidated on every address mutation path, and pinned by a test
• .pxd declarations consistent with the .py signatures
• No backward-incompatible public API change without a migration path
• Cython build correctness (frames, cdef return nullability, module globals) — suggestion ＃1
• New branches covered by tests (denial, legacy bitmap, cache load, responder output, no-address service)
• Tests assert observable behavior, not source inspection
• Test resources cleaned up (loopback fixtures handle teardown)
• Diff matches PR description; no unexplained scope creep
• No new unbounded growth, resource leaks, or swallowed errors

Automated review by Kōan (Claude) HEAD=7d711a4 5 min 18s