[lee3Q]

Problem

Length-set syntax supports closed ranges like {2-4}. Two incomplete forms are mishandled today:

• test[a-c]{2-} — the dash is consumed but the range has no end. The lenset silently comes out empty, so the pattern expands to zero permutations and the scan runs on no targets without any error (it just reports nothing found). The mirror form {-2} already raises a parse error, so {2-} slipping through quietly is inconsistent.
• {2-;3} — the malformed part is silently dropped and only {3} is scanned.

Fix

In _parse_lenset, when the - was consumed but no range end follows, raise ValueError('Missing range end after "-" in lenset') instead of continuing with an empty/partial lenset. This is the same error class as the existing {-2} rejection. All finite forms ({3}, {2-4}, mixed lists) parse exactly as before.

Testing

• New regression test test_error_open_range_missing_end: on main the expression expands to zero permutations silently; with the fix it raises the ValueError.
• Full suite: 516 passed on Python 3.10 (515 baseline + 1 new), repo-pinned mcp<2, ReportLab present. An independent second environment observed 511 passed / 4 skipped → 512 passed / 4 skipped (the 4 skips are ReportLab-absent test_pdf_generator.py skips), the same +1 delta. No real handles were scanned and no network calls were made; the test exercises the pure pattern expander.
• ruff check: the repo carries pre-existing findings on main; the two changed files introduce zero new ones.

[kaifcodec]

LGTM.