What applies here

All data ingress and egress (file, clipboard, database, web, spreadsheet) routes through the pandas.io package, which abstracts reader/writer engines and connection handling behind a common interface.

usage-convention

All I/O formats are implemented as optional extras, declared in pyproject.toml optional-dependencies, with each backend importable only when its extra is installed.

usage-convention

Dependencies are grouped into optional-extras by feature area (excel, html, performance, output-formatting, etc.), each mapping to a distinct I/O or computation capability, allowing users to install only the stack needed for a given workflow.

stack-binding

Each data format family provides both a read and a write path — clipboard, file, and database formats appear as symmetric ingest/export pairs (to_excel/read_excel, to_stata/read_stata, to_sql/read_sql) — sharing the same engine and abstraction layers (ExcelWriter, get_handle) across directions.

usage-convention

Every specialized dimensional type — Categorical, Interval, Period, Timedelta — is realized as a tetrad: an ExtensionArray subclass, a paired Dtype with validation constraints, an index class, and a scalar type, all tied together by type-specific constructors (from_breaks/from_arrays/from_tuples, to_period, timedelta_range) and consistency checks (dtype-freq, closure policy).

layering

Input and output operations dispatch to pluggable backend libraries selected at runtime, with the core I/O code delegating to third-party engines for format-specific parsing and writing.

usage-convention

Input validation happens at construction and I/O boundaries—sanitization in construction.py, parameter checks in _validators.py, and reader-specific checks in parsers—rather than inside the core data structures themselves.

usage-convention

Optional dependencies are organized into named feature groups in pyproject.toml (excel, html, postgresql, compression, computation), and the availability of each data I/O or computation capability is gated on its group's dependency being installed — features degrade gracefully (not implemented or unavailable) when the corresponding optional package is absent.

usage-convention

Optional functionality dependencies are declared in pyproject.toml under optional-dependencies, each tied to a specific feature group, and are not part of the core install set.

stack-binding

Optional functionality is shipped as a pandas extra named after the feature area, pulling in the third-party libraries that power it.

stack-binding

Third-party libraries are declared as optional dependencies grouped by feature (e.g., excel, html, performance, plot, postgresql), each group enabled via a named extra in pyproject.toml.

stack-binding

Validation logic is consolidated into shared helper functions and modules, reused across IO and window operations, checking enums and types through a minimal set of well-named utilities.

usage-convention

Structural duplication: pandas/io/formats/templates/latex_longtable.tpl, pandas/io/formats/templates/latex_table.tpl — ONE concept: LaTeX table rendering template | drift: latex_table.tpl:8-11 handles position_float which latex_longtable.tpl does not; latex_longtable.tpl:14-31 has label handling and repeated caption logic for multi-page output, while latex_table.tpl:12-18 handles caption once; latex_longtable.tpl:74…

Structural Duplication · high

Structural duplication: pandas/_libs/simd/moments_neon.cpp, pandas/_libs/simd/moments_sse2.cpp — ONE concept: SIMD moment calculation kernel | drift: No drift visible in shown windows — files are textually similar implementations of the same algorithm for different instruction sets; actual drift is structural (intrinsic names, data types) inherent to NEON vs SSE2, not a correctness divergence. | lockstep: A bug fix or…

Structural Duplication · medium

The validation discipline is per-surface and consistent, but there's no atom showing cross-surface consistency — e.g., whether validate_integer called from read_csv applies the same rules as the one called from windowing, or whether each call site tweaks behavior silently.

Security · low

Data ingestion surfaces (read_csv, read_html, SQL IO) handle user-controlled input but no pii_field atoms were captured — Preston cannot tell if PII simply isn't handled by this codebase or if the probe never looked for it.

Security · low

All seven observed surfaces have validation, but zero surfaces appear without it — the map may be showing the probe's coverage footprint, not the codebase's actual perimeter discipline.

Security · low